Privacy policy

PRIVACY POLICY

Prelude Education Ltd

Last updated: 16 April 2026

1. Who We Are

Prelude Education Ltd ("we", "us", "our") is a music tutoring agency based in the United Kingdom. We match students with independent music teachers. We are the data controller for the personal data described in this policy.

ICO Registration Number: ZB530858

Contact: DOP@preludeeducation.com

2. What Data We Collect

For clients (parents/guardians):

Full name

Email address

Phone number

Instrument preference for your child

Enquiry and lesson dates

For teachers:

Full name

Email address

Location/area

Instruments taught

We do not collect any special category data (health, religion, ethnicity, etc.).

3. How We Use Your Data

Matching students with suitable teachers based on instrument and location

Managing lesson bookings and schedules

Processing invoices and payments

Communicating with you about your tutoring arrangements

Internal business analytics to improve our service (using aggregated data)

Marketing and audience targeting: We may use your name, email address, and phone number to create "lookalike audiences" on Meta (Facebook/Instagram) — a marketing technique where Meta finds users who share similar characteristics with our existing clients. Meta does not share audience members with us; instead, they use the data anonymously to identify and target similar users with our advertising. You can opt out of this use at any time by contacting us.

4. Legal Basis for Processing

We process your data under the following lawful bases:

Legitimate Interest (Article 6(1)(f) UK GDPR) — for pipeline management, tutor matching, business analytics, and marketing to reach prospective clients

Contract Performance (Article 6(1)(b)) — for delivering our tutoring service and managing bookings

Legal Obligation (Article 6(1)(c)) — for financial records required by HMRC (6-year retention)

5. Who Has Access to Your Data

Your data is accessible only to authorised Prelude Education admin staff. Access is controlled through role-based authentication.

Third parties we share data with:

Meta Platforms, Inc. — We share your name, email, and phone number with Meta (Facebook/Instagram's parent company) to create lookalike audiences for targeted advertising. Meta processes this data under their own privacy terms and does not make it visible to us or our marketing team. Meta anonymises the data and uses it solely to identify similar users for advertising purposes. You have the right to object to this use.

Our data processors (service providers):

TutorCruncher — our operational platform for managing bookings and invoices

Supabase — our secure database hosting provider (encrypted at rest and in transit)

Both processors operate under Data Processing Agreements and process data only on our instructions.

6. How Long We Keep Your Data

Active client/teacher data: Duration of the relationship plus 2 years

Financial records (invoices): 6 years as required by HMRC

Aggregated analytics: Retained indefinitely (non-personal)

7. Your Rights

Under UK GDPR, you have the right to:

Access — Request a copy of the data we hold about you

Rectification — Ask us to correct inaccurate data

Erasure — Ask us to delete your data (subject to legal retention requirements)

Restriction — Ask us to limit how we process your data

Portability — Receive your data in a structured, machine-readable format

Object — Object to processing based on legitimate interest

Object to marketing use — Object specifically to your data being used for Meta lookalike audiences

To exercise any of these rights, contact us at [email address]. We will respond within one month.

8. Data Security

We take appropriate technical and organisational measures to protect your data, including:

Encryption in transit (HTTPS/TLS)

Encryption at rest (database-level encryption)

Role-based access control (admin-only access)

Row-Level Security policies on all database tables

Authentication required for all system access

9. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk/make-a-complaint/

Phone: 0303 123 1113

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or through our service.