Legal

Privacy Policy

How Merit Education Foundation collects, uses, and protects your personal data — in plain English.

Last updated: 1 November 2025 UK GDPR Compliant ~12 min read
Contents
Overview
Data We Collect
How We Use Data
Sharing Data
Cookies
Your Rights
Children's Privacy
Security
Contact DPO

Version: 3.2

Effective: 1 Nov 2025

Next review: 1 Nov 2026

1. Overview

Merit Education Foundation ("we", "our", "us") is committed to protecting the privacy of all individuals who interact with our website, services and charitable programmes. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

This policy applies to all users of meriteducation.org, parents and guardians who book lessons, donors, volunteers, and students enrolled in our programmes. It complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect different types of personal data depending on your interaction with us:

Account & Registration Data:

Name, email address, phone number and address
Password (stored in encrypted form only — we cannot see it)
Profile photo (optional)

Student Data (collected from parents/guardians):

Student name and age
Current learning level and academic history
Progress reports and lesson notes

Donation & Financial Data:

Donation amounts and frequency
Gift Aid declarations (UK taxpayer status)
Payment information (processed by secure third-party providers — we do not store card details)

3. How We Use Your Data

We use your personal data only for legitimate purposes, including:

Providing and managing lesson bookings
Processing donations and issuing Gift Aid declarations
Communicating lesson schedules, updates and reports
Ensuring safeguarding compliance for all students
Sending newsletters (only where you have consented)
Improving our services and website

Legal basis: We rely on contract performance, legitimate interests, legal obligation, and consent as our legal bases for processing data under UK GDPR Article 6.

4. Sharing Your Data

We do not sell, rent or trade your personal data. We may share your data only in the following limited circumstances:

Tutors: Assigned tutors receive student names, learning level and lesson schedules only
Payment processors: Stripe or PayPal for secure payment processing
HMRC: For Gift Aid claims (name and address only, with your declaration)
Legal authorities: Only where required by law or to protect child safety

5. Cookies

We use cookies to improve your experience on our website. You can manage your preferences at any time.

TYPE PURPOSE DURATION
EssentialLogin sessionsSession
AnalyticsUsage tracking2 years
MarketingCampaign tracking90 days

6. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access — request a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to restrict processing
Right to data portability
Right to object to processing based on legitimate interests

To exercise any of these rights, contact our Data Protection Officer at dpo@meriteducation.org. We will respond within 30 days.

7. Children's Privacy

We take children's privacy extremely seriously. All student data is provided by a parent or legal guardian — we do not collect data directly from children under 16. Student data is used solely for educational purposes and is never shared with third parties without parental consent.

All tutors are DBS checked and operate under our Safeguarding Policy. Parents can request deletion of their child's data at any time by contacting us at safeguarding@meriteducation.org.

8. Security

We use industry-standard security measures to protect your personal data, including SSL encryption, access controls, and regular security audits. In the unlikely event of a data breach, we will notify affected users and the ICO within 72 hours as required by UK GDPR.

9. Contact Our DPO

If you have any questions, concerns, or wish to exercise your data rights:

Data Protection Officer

dpo@meriteducation.org

Merit Education Foundation, London, UK

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.