How your information is handled

Last updated: 2 August 2026

Who is responsible for your information

Damian Lake, trading as Damian Lake Tutoring, is the data controller for personal information used to provide this private tutoring service. Privacy questions and rights requests can be sent through the contact page or by email to damian.lake@icloud.com.

Information collected

When a parent or carer requests or arranges a lesson, this may include:

the parent or carer's name, email address and telephone number;
the child's first name and optional age or school year;
the requested subject, lesson time, delivery format and price;
learning goals and any optional message provided; and
booking status, communication and email-delivery records.

The booking service also creates random booking references and uses protected hashes to prevent duplicate or excessive requests. If optional analytics are accepted, limited website usage and device information is collected as described in the cookie information.

Children's information

The public forms are intended for a parent, carer or responsible adult, not for a child to complete independently. Only information reasonably needed to discuss and provide tutoring should be entered. Please do not submit medical records, diagnostic reports, safeguarding records or other unnecessary sensitive information through the website.

Why the information is used

to review, confirm, provide and administer requested lessons;
to communicate about bookings, payment arrangements, changes and cancellations;
to maintain appropriate business and accounting records;
to secure the booking and administration services and prevent misuse; and
where accepted, to understand website usage and improve the site.

The legal bases used are steps requested before entering a contract and performance of a tutoring agreement; legitimate interests in operating, improving and securing the service; compliance with legal obligations such as accounting requirements; and consent for optional analytics. Analytics consent can be withdrawn at any time.

Who receives the information

Information is not sold. It is shared only where needed to operate the service, comply with the law or protect someone's vital interests. Cloudflare provides website hosting, database and security services. Resend delivers transactional booking and administrator emails. If analytics are accepted, Google Analytics, Microsoft Clarity and Cloudflare Web Analytics process website usage information.

Some providers may process information outside the UK. Where this happens, the relevant provider arrangements and lawful transfer safeguards are relied upon. Each provider also publishes its own privacy information.

How long information is kept

Booking, contact and learning information is normally kept for up to 24 months after the latest lesson or contact, then deleted or anonymised unless it is still needed for a dispute or legal duty.
Minimal payment and transaction records needed for tax or accounting are kept for the period required by law, normally at least five years after the 31 January submission deadline for the relevant tax year.
Expired authentication, rate-limit and email-delivery records are reviewed periodically and removed when no longer needed for security, troubleshooting or evidence of delivery.
The analytics preference is kept in the browser for up to 180 days. Analytics providers apply their configured retention periods.

Security

Administration access is restricted, sign-in and session credentials are protected, and sensitive credentials are not stored in the public source code or website database. No internet service can guarantee absolute security, but proportionate technical and organisational measures are used to protect the information held.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or transfer of your personal information, or object to how it is used. You may withdraw analytics consent at any time through Cookie settings. A request can be made using the contact details above, and identity may need to be verified before information is disclosed or changed.

You may also complain to the UK Information Commissioner's Office. This policy will be updated if the service or its use of information changes materially.