General Data Protection Regulation (G.D.P.R.) policy
Last updated: 1st August 2026
1. Introduction
Captain Physics (“I”, “me”, “my” or “Captain Physics”) provides online physics tuition and educational services to students and their parents or guardians.
I take the privacy and security of personal information seriously. This policy explains what personal information I collect, why I collect it, how I use and protect it, and the rights individuals have regarding their personal information.
I aim to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
For the purposes of data protection law, I am generally the data controller for the personal information I collect and use in providing my tutoring services.
Data controller:
Captain Physics / Huw Curnow
Email: captainphysicstutoring@gmail.com
Website: captainphysics.com
2. What information do I collect?
Depending on the services provided, I may collect some or all of the following information:
Students
Name
Age or year group
Email address
Exam board, where relevant to tuition
Information about academic progress and areas where support is required
Lesson notes and records of topics covered
Responses to questions, assignments or assessments
Information provided by the student during lessons
Technical information required to provide online lessons, such as a display name or username
Parents or guardians
Where a student is under 18, I may collect:
Parent/guardian name
Email address
Telephone number
Billing and payment information
Information relating to the student's tuition
Communications between the parent/guardian and me
Customers and enquiries
If someone contacts me about tuition, I may collect:
Name
Contact details
Information about the student and the tuition being requested
Any other information voluntarily provided in an enquiry
Payments
Where payment is made for tuition, I may retain information necessary to record and manage payments and invoices.
I do not normally need to see or store complete payment-card details. Where online payment services are used, payment information is processed by the relevant payment provider in accordance with its own privacy policy and security procedures.
3. How do I use personal information?
I use personal information only where there is a legitimate reason for doing so. This may include:
Responding to enquiries about tuition
Arranging and providing tuition sessions
Communicating with students and parents/guardians
Preparing appropriate lessons and resources
Keeping records of lessons and academic progress
Providing feedback
Managing bookings and cancellations
Processing and recording payments
Issuing invoices and maintaining business records
Managing the administration of my tutoring business
Meeting legal, accounting and tax obligations
Maintaining the security of my services and systems
Dealing with complaints or concerns
Sending information about my services where I am legally permitted to do so
I will not use personal information for purposes that are incompatible with the reason it was originally collected without first considering whether additional privacy information or consent is required.
4. Lawful basis for using personal information
Under the UK GDPR, organisations need a lawful basis for processing personal information.
Depending on the circumstances, I may rely on:
Contract
I may use personal information where it is necessary to provide the tuition service that has been requested or agreed.
For example, I need a student's name and contact details to arrange and provide tuition.
Legitimate interests
I may process information where this is necessary for my legitimate business interests and those interests are not overridden by the individual's rights.
For example, this may include maintaining appropriate business records, communicating with existing customers, managing enquiries and protecting the security of my services.
Legal obligation
I may need to retain or use certain information to comply with legal obligations, such as accounting, tax or other legal requirements.
Consent
Where consent is the appropriate lawful basis, I will ask for consent before processing the information concerned. Where consent is relied upon, it can generally be withdrawn at any time.
5. Information about children
My tutoring services may involve students under the age of 18.
I take additional care with children's personal information and only collect information that is reasonably necessary for providing and managing the tuition service.
Where appropriate, I will communicate with a parent or guardian regarding arrangements for a student's tuition, particularly for younger students.
Students should not provide unnecessary personal information during lessons or through online services.
I do not knowingly collect sensitive personal information about students unless there is a clear and appropriate reason for doing so.
6. Special category and sensitive information
I do not normally require sensitive information about students or parents/guardians.
For example, I do not generally need information about health, medical conditions, religion, ethnicity or similar matters in order to provide physics tuition.
If sensitive information is provided to me, I will only use it where there is a lawful reason to do so and where appropriate safeguards are in place.
7. Online lessons and third-party services
Online tuition requires the use of third-party technology and service providers.
Depending on the services being offered, these may include providers of:
Video conferencing
Email
Online forms
Online whiteboards
Cloud storage
Payment processing
Website hosting
Scheduling and booking
Accounting and invoicing
These providers may process personal information on my behalf or may process information as separate data controllers.
I will take reasonable steps to use reputable providers and to ensure that personal information is handled appropriately.
Where a service provider processes personal information on my behalf, appropriate contractual and data protection arrangements should be in place where required.
Some service providers may process information outside the UK. Where this happens, I will take appropriate steps to ensure that any international transfer of personal information is made in accordance with applicable data protection law.
8. Lesson recordings
If online lessons are recorded, students and/or their parents or guardians will be informed. Recording will only be made of the owner’s screens, i.e. students and responses will not be recorded
Recordings will only be made for a clearly stated purpose, such as providing students with access to a lesson they have attended or allowing a session to be reviewed.
Recordings will not be publicly shared or used for unrelated purposes without an appropriate lawful basis and, where required, consent.
If lessons are not recorded, no lesson recording will be created simply for record-keeping purposes.
9. Sharing personal information
I will not sell students' or parents' personal information.
I will only share personal information where there is a legitimate reason to do so.
This may include sharing information with:
Online service providers required to provide the tutoring service
Payment providers
Accounting or bookkeeping services
Professional advisers where necessary
Government bodies or authorities where I am legally required to provide information
Law enforcement or other organisations where disclosure is legally required or necessary to protect someone's safety
I will only provide information that is reasonably necessary for the relevant purpose.
10. How I protect personal information
I take reasonable technical and organisational measures to protect personal information against:
Unauthorised access
Loss
Accidental destruction
Unauthorised disclosure
Unauthorised alteration
This includes using password-protected devices and accounts, appropriate access controls, secure online services and keeping software and devices appropriately updated.
However, no method of transmitting or storing information online can be guaranteed to be completely secure.
11. How long do I keep personal information?
I will not keep personal information for longer than is reasonably necessary for the purpose for which it was collected, unless I am legally required to retain it for longer.
As a general guide:
Enquiries that do not result in tuition: normally deleted within a reasonable period after the enquiry has ended.
Student and parent/guardian contact information: normally retained while the tuition relationship continues and for a reasonable period afterwards.
Lesson notes and academic records: retained while they are useful for providing tuition and for a reasonable period afterwards.
Financial and invoice records: retained for the period required by applicable tax and accounting requirements.
Lesson recordings: deleted when they are no longer required for the stated purpose, subject to any agreed retention period.
Retention periods may vary depending on the type of information and the circumstances.
12. Your data protection rights
Under UK data protection law, individuals may have a number of rights regarding their personal information.
Depending on the circumstances, these include the right to:
Ask for a copy of personal information I hold about you
Ask for inaccurate or incomplete information to be corrected
Ask for personal information to be deleted where there is no longer a valid reason for me to keep it
Ask for processing to be restricted in certain circumstances
Object to certain types of processing
Request the transfer of certain information to another organisation
Withdraw consent where consent is the lawful basis for processing
These rights are subject to certain legal conditions and exemptions, so they may not apply in every situation.
To exercise a data protection right, please contact me using the details below.
Email: captainphysicstutoring@gmail.com
I may need to verify the identity of the person making a request before providing personal information.
13. Marketing communications
I may occasionally contact existing customers about relevant tutoring services, courses or educational resources where this is permitted by data protection and electronic marketing laws.
Where consent is required, I will ask for it.
Individuals can opt out of marketing communications at any time by contacting me or using an unsubscribe option where one is provided.
I will not sell or rent customer contact details to other organisations for marketing purposes.
14. Cookies and website information
If my website uses cookies or similar technologies, information about their use will be provided through the website's cookie notice or privacy information.
Some cookies may be necessary for the website to function, while others may be used for analytics or other purposes.
Where required, consent will be obtained before using non-essential cookies.
15. What happens if there is a data breach?
If I become aware of a personal data breach, I will assess what has happened and take appropriate steps to contain and address the incident.
Where required by law, I will report a breach to the Information Commissioner's Office (ICO) and/or notify affected individuals.
16. Changes to this policy
I may update this Privacy & GDPR Policy from time to time to reflect changes to my services, technology or data protection requirements.
The latest version will be made available through my website or provided to customers where appropriate.
The date at the top of this document shows when it was last updated.
17. Questions or concerns
If you have any questions about how I use personal information, please contact me:
Captain Physics / Huw Curnow
Email: captainphysicstutoring@gmail.com
Website: captainphysics.com
I will try to resolve any concerns about the way personal information is handled.
You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully.
Information about making a complaint is available from the ICO website: Information Commissioner's Office (ICO)
This policy was last reviewed: 1st August 2026