Privacy Policy

1. Introduction

This Privacy Policy explains how Klasu ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Klasu platform at klasu.co.uk ("Platform").

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy. We may update this policy from time to time and will notify registered users of material changes by email or via the Platform.

2. Who We Are

Klasu operates an online tutoring marketplace connecting Students with Tutors. For the purposes of data protection law, Klasu is the data controller for personal data collected through the Platform.

Contact details:

• Email: support@klasu.co.uk
• Website: klasu.co.uk

3. What Data We Collect

We collect different types of personal data depending on how you use the Platform and the type of account you hold.

3.1 Data You Provide Directly

• Account registration: Name, email address, password, phone number, account type (Student, Tutor, or Parent)
• Tutor profile information: Biographical details, qualifications, experience, subjects offered, hourly rate, profile photograph, date of birth (for HMRC reporting purposes)
• Student profile information: Name, learning preferences, date of birth (for age verification)
• Background checks: DBS certificate number and related verification data (Tutors only)
• Payment information: Payment card details are collected and processed by our payment provider, Stripe. Klasu does not store full card numbers.
• Messages and communications: Messages sent between Users through the Platform's messaging system
• Support queries: Information you provide when contacting our support team or using the AI support chat
• Reviews: Written reviews and ratings left by Students for Tutors

3.2 Data We Collect Automatically

• Usage data: Pages visited, features used, time spent on the Platform, and interaction patterns
• Device information: Browser type, operating system, screen resolution, and device identifiers
• IP address: Your internet protocol address, which may indicate your approximate location
• Online status: When you were last active on the Platform (used for messaging features)
• Cookies and similar technologies: As described in Section 8 below

3.3 Data from Third Parties

• Stripe: Payment confirmation, transaction status, and payout information
• DBS Update Service: Results of background check verifications for Tutors
• Lessonspace: Lesson attendance data, session duration, and recording availability

4. How We Use Your Data

We use your personal data for the following purposes:

4.1 Providing the Platform

• Creating and managing your account
• Facilitating Bookings between Students and Tutors
• Processing payments and Tutor payouts
• Providing the Online Classroom for Lesson delivery
• Enabling messaging between Users
• Displaying Tutor profiles in search results and directories

4.2 Safety and Moderation

• Verifying Tutor identities and background checks
• Filtering and moderating messages for prohibited content
• Detecting and preventing fraud, abuse, or other harmful activity
• Enforcing our Terms and Conditions and content policies
• Protecting the safety of Users, particularly children

4.3 Communications

• Sending transactional emails (booking confirmations, payment receipts, lesson reminders)
• Sending SMS notifications (where you have opted in)
• Responding to support queries
• Sending platform updates and service announcements

4.4 Improvement and Analytics

• Analysing platform usage to improve features and user experience
• Generating anonymised and aggregated statistics
• Monitoring platform performance and resolving technical issues

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by UK GDPR:

• Contract: Processing necessary to perform our contract with you (providing the Platform, processing Bookings and payments)
• Legitimate interests: Processing necessary for our legitimate interests (platform security, fraud prevention, content moderation, service improvement), where those interests are not overridden by your rights
• Consent: Where you have given specific consent (marketing communications, SMS notifications, optional cookies)
• Legal obligation: Processing necessary to comply with a legal obligation (tax reporting, responding to law enforcement requests)

6. Who We Share Data With

We share your personal data with the following categories of third parties, only to the extent necessary to provide the Platform and as described in this policy:

6.1 Other Users

When you use the Platform, certain information is visible to other Users. For Students, this includes your first name and last initial. For Tutors, your profile information (including name, biography, qualifications, and reviews) is publicly visible.

6.2 Service Providers

We use the following third-party service providers to operate the Platform:

• Stripe — payment processing and Tutor payouts. Stripe processes your payment information under its own privacy policy. Stripe Privacy Policy
• Twilio — SMS notifications (where you have opted in). Twilio Privacy Policy
• Lessonspace — online classroom for Lesson delivery, including optional session recording. Lessonspace Privacy Policy
• Amazon Web Services (AWS) — secure file storage for profile photographs, documents, and uploaded files
• OpenAI — AI-powered support chat functionality (conversation data is processed but not used to train AI models)
• Cloudflare — bot protection and security (Turnstile challenge)
• DigitalOcean — application and database hosting

6.3 DBS Update Service

Where a Tutor subscribes to the DBS Update Service, we may share their DBS certificate number with the Disclosure and Barring Service to verify the status of their criminal record check.

6.4 Legal and Regulatory

We may disclose your data where required by law, regulation, or legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7. International Data Transfers

Our primary servers and database are hosted in the United Kingdom (London region) via DigitalOcean. However, some of our third-party service providers may process data outside the UK. Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO)
• Transfers to countries that have received an adequacy decision from the UK government
• Other appropriate safeguards as required by UK GDPR

8. Cookies and Similar Technologies

8.1 What Cookies We Use

We use the following types of cookies on the Platform:

• Essential cookies: Required for the Platform to function. These include session authentication cookies (to keep you logged in) and CSRF protection tokens (to prevent cross-site request forgery). These cannot be disabled.
• Security cookies: Cloudflare Turnstile cookies used for bot protection during registration and login.
• Analytics cookies: We plan to use Google Analytics (GA4) to understand how Users interact with the Platform. These cookies are only set with your consent.

8.2 Managing Cookies

When you first visit the Platform, you will be shown a cookie consent banner allowing you to accept or decline optional cookies. You can change your cookie preferences at any time through your browser settings. Disabling essential cookies may affect the functionality of the Platform.

9. Data Retention

We retain your personal data for as long as necessary to provide the Platform and fulfil the purposes described in this policy. Specifically:

• Active accounts: Data is retained for the duration of your account and for 7 years from your last activity on the Platform, to comply with tax and legal obligations.
• Closed accounts: Following account closure, we retain essential records (transaction history, tax-relevant data) for 7 years. Other personal data is deleted or anonymised within a reasonable period.
• Lesson recordings: Recordings made through Lessonspace are automatically deleted after 90 days. Klasu does not retain copies of recordings.
• Messages: Chat messages are retained for the duration of the account and the applicable retention period to support dispute resolution and platform safety.
• Inactive accounts: Accounts with no activity for an extended period may be flagged for review. We may contact you before taking any action on an inactive account.
• If you start a tutor application but do not complete it within 90 days of your last activity, we will permanently delete your account, profile data, and any uploaded documents. We may send reminder emails before deletion. You can re-register at any time afterwards.

10. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data in certain circumstances (also known as the "right to be forgotten").
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.