Privacy policy

Prelude Education Ltd

Last updated: 14 July 2026

1. WHO WE ARE

Prelude Education Ltd ("we", "us", "our") is a UK company arranging private music tuition, matching students with independent music, drama and art teachers. We are the data controller for the personal data described in this policy.

•    ICO Registration Number: ZB530858

•    Contact: dpo@preludeeducation.com

This policy applies to parents and guardians, students, and the teachers we work with — “you” means whoever is reading. Where something applies only to families or only to teachers, we say so.

2. WHAT DATA WE COLLECT

For clients (parents/guardians):

•    Name, email address, phone number, postcode

•    Enquiry details, lesson bookings, cancellations and invoices

•    Messages you exchange with us (email, SMS, WhatsApp)

For students:

•    First name, age, instrument and level

•    Lesson reports and progress reports written by the teacher

•    Health or accessibility notes a parent volunteers, and safeguarding records where we have a concern — this is special category data and we protect it accordingly (see section 4)

For teachers:

•    Name, contact details, location, instruments taught

•    DBS certificate number and date, ID checks, references, and a short onboarding video

3. HOW WE USE YOUR DATA

For families:

•    Matching students with suitable teachers and scheduling lessons

•    Processing invoices and payments — card details are handled by TutorCruncher/Stripe and never stored by us

•    Communicating with you about your lessons (our messaging runs through GoHighLevel)

•    Lesson reports: after each lesson your teacher writes notes, and an AI assistant polishes them into the short report we email you. Where the notes need more detail, the teacher or our team completes the report before it is sent. The AI provider cannot train on this content. We also use AI to help track the skills and progress mentioned in reports over time, so lessons and future reports reflect your child’s development — this stays within our system.

•    Bi-monthly progress reports: every two months your teacher writes a fuller progress report. Teachers can use an AI assistant to polish their draft — the teacher reviews and edits every report, and we check it, before it reaches you. The AI provider cannot train on this content.

•    Bi-monthly report links: we send these progress reports via a private link unique to your family, so you don’t need to create an account. Links expire automatically after 180 days (the report itself is kept under the retention periods in section 7). Please don’t forward the link — anyone who has it can view the report until it expires.

•    Marketing: we plan to use hashed contact details (never your child’s data) for Meta advertising audiences. This has not started, and will not start before our impact assessment is complete. You can opt out at any time via dpo@preludeeducation.com.

For teachers:

•    Vetting and onboarding: we use your ID, references, DBS details and onboarding video to meet our safeguarding duties before introducing you to families.

•    Matching and proposals: your profile, bio and availability help us match you to students and draft the proposals we send families.

4. LEGAL BASIS FOR PROCESSING

•    Contract (Art. 6(1)(b)) — delivering and billing lessons

•    Legal obligation (Art. 6(1)(c)) — tax records; safeguarding checks

•    Legitimate interests (Art. 6(1)(f)) — service messages, teacher vetting, AI-assisted drafting, marketing

•    Special category data (health, accessibility, safeguarding) — Art. 9(2)(g) with Schedule 1 DPA 2018, under our Appropriate Policy Document

5. WHO HAS ACCESS TO YOUR DATA

Only authorised Prelude admin staff, under role-based access control. Our processors and sub-processors:

•    TutorCruncher — bookings, scheduling, invoicing

•    Stripe — payment processing (via TutorCruncher)

•    GoHighLevel — email, SMS and WhatsApp messaging

•    Supabase — database and file storage (AWS London, managed via Lovable Cloud)

•    Google Workspace — team email and documents

•    Lovable (Lovable Cloud) — platform hosting and management of the Hub, including its database; also provides the AI gateway (Google models, EU region) for AI-assisted report drafting

•    Resend — transactional email delivery

•    Meta Platforms Ireland — hashed contact details for advertising audiences (not yet started)

6. INTERNATIONAL TRANSFERS

Some processors are US-based. Where data leaves the UK/EEA we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

7. HOW LONG WE KEEP YOUR DATA

•    Active client families — while lessons continue

•    Dormant client families — identifying details replaced 24 months after the last lesson

•    Lesson records and reports — 7 years

•    Invoices and financial records — 6 years (HMRC)

•    Messages — content removed 24 months after the last message

•    Marketing contacts who never book — deleted after 24 months

•    Teacher onboarding videos — deleted 12 months after a teacher leaves

•    Teacher DBS details — anonymised 6 months from the certificate date

8. YOUR RIGHTS

Under UK GDPR you can ask us to: access, correct, delete, or restrict your data; receive a portable copy; object to processing based on legitimate interests, including marketing.

To exercise any right, email dpo@preludeeducation.com. We respond within one month.

Requests about a student’s data are normally made by their parent or guardian. If a young person contacts us directly, we handle the request in line with ICO guidance on children’s capacity, verify identity, and involve a parent or guardian wherever appropriate.

9. DATA SECURITY

•    Encryption in transit (HTTPS/TLS) and at rest

•    Role-based access control; row-level security on all database tables

•    Authentication required for all system access

10. COMPLAINTS

If you’re ever unhappy with how we handle your data, please contact us first at dpo@preludeeducation.com — we’ll do our best to put it right. You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

11. CHANGES TO THIS POLICY

We will update this page when our processing changes and notify you by email where a change is material.