Last updated: August 2026

This policy explains, in plain terms, what personal information I hold, why I hold it, how I look after it, and what rights you have over it. I've written it to describe what I actually do - not a template of things that don't apply to me. If anything here isn't clear, or you'd like to know more about how I handle your information, please just ask.

1. Who I am, and who's responsible for your information

I'm Joanna Whale, and I run Great Expectations Education. I work on my own - there's no team and no agency. For data protection purposes, I'm the 'data controller' for the information I hold, which simply means I'm the person responsible for it and the person you deal with about it.I'm registered with the Information Commissioner's Office (the ICO), the UK's data protection regulator, and I handle personal information in line with UK data protection law - the UK GDPR and the Data Protection Act 2018.You can reach me by email at greatexpectationsed@gmail.com.

2. The information I collect

What I hold depends on how we're working together. I only collect what I actually need.If you enquire or book. Your name and contact details (email, phone, and sometimes your address), and whatever you tell me about why you're getting in touch. Consultations and enquiry meetings are booked through my booking system, so I hold the details you enter there.

For tuition. Your contact details and the learner's name; their age, year group, and school if relevant; and whatever you feel is relevant to the lessons - which often includes information about a child's needs, such as a diagnosed difficulty, a medical condition, or special educational needs. I may also hold assessment scores, writing samples, or a copy of a diagnostic report you've chosen to share. As we work together, I keep session notes, lesson plans, and sometimes marked work.

For consultations. What you tell me about your situation and your child, including any documents you share for a paperwork review. As with tuition, this often includes information about a child's needs.

For the shop. When you buy a resource, the order goes through my website's shop and its payment system. I can see that an order was placed and your name and email, but I don't see or hold your full card details - the payment provider handles those.

For the newsletter. If you sign up to The Hearth, I hold your email address until you unsubscribe.

When you use my website. Like most websites, mine collects some technical information automatically - things like the type of device and browser you're using, and which pages you look at. This is used to understand how the site is doing, not to identify you personally. More on this under cookies, below.Some of what I hold - particularly about a child's needs or health - is what the law calls 'special category' information, which is treated as more sensitive and given extra protection. I handle it with that in mind, and I explain the specific care I take with recordings in section 4.

3. Why I hold it, and my lawful basis

Data protection law asks me to have a clear reason - a 'lawful basis' - for holding your information. Mine are straightforward:

To provide the service you've asked for - teaching a learner, running a consultation, fulfilling a shop order. The law calls this performing a contract with you.

To run my business properly - replying to enquiries, improving my website, keeping records, writing up consultations (including recording them, unless you opt out - see section 4). The law calls this my legitimate interests, and I balance them against your privacy.

To meet legal obligations - keeping financial records for tax, and the safeguarding duty that anyone working with children carries.

With your consent - for the newsletter. Where I rely on consent, you can withdraw it at any time. For the more sensitive information about a child's needs or health, I rely on your explicit consent, given when we begin working together, and on the safeguarding grounds the law provides. I don't use any of this information to make automated decisions about a learner.

4. Recording consultations

I don't record tuition lessons as a matter of course. I do record consultations - including an initial enquiry meeting - so that I can write them up accurately afterwards. Recording lets me give you my full attention in the meeting rather than splitting it to take notes; it's an access need for me.

When you book, you can opt out - there's a box to tick if you'd rather I didn't record, and I'll take notes instead. Where I do record, the recording is held securely, used only to produce your write-up, never shared, and deleted as soon as that write-up is done.

Because an enquiry meeting can happen before you're a client, and can already involve sensitive information about a child, the opt-out is offered at the enquiry stage too - so you can decline before anything is recorded.

5. How I use AI

I want to be plain about this, because it matters and because a lot of policies aren't. I use AI tools in two quite different ways, and only one of them ever touches your information.For my own background work - researching word histories, cross-checking sources for the resources in my shop - I use AI tools such as ChatGPT. These are never used with any information about you or your child. No pupil information goes near them.Separately, where I'm turning my own notes, or a recorded consultation, into a clear written follow-up for you, I may use an AI tool (Claude) to help me organise and draft it. Where I do, I use it with the setting that stops your information being used to train the tool turned off, and I do this work in a space kept separate from my everyday use. Anything held by the tool is kept only briefly and then deleted. The thinking, the judgment and the advice are always mine - the tool helps me write them up, it doesn't decide anything about your child.

6. The tools I use, and who else sees your information

I don't sell, rent, or trade your information, and I don't share it to advertise to you. I don't run adverts. To actually deliver what I do, though, I rely on a small number of trusted providers who process information on my behalf, under agreements that require them to protect it and use it only for the service they provide me. They are:

Squarespace - my website, my shop, and the newsletter.

Google - I use Google Drive to store files, Gmail for email, and Google Analytics to understand how my website is doing.

FreeAgent - my accounting software, for invoicing and records.

Appointlet - my booking system for consultations and enquiry meetings.

Stripe - card payments for bookings. My shop's payments are handled through my website's own payment system. In both cases, the payment provider handles your card details, not me.

Zoom - for online lessons and consultations.

WhatsApp - where you've chosen it as the way we message.

An AI tool (Claude) - for writing up follow-ups, as described in section 5.I also have a presence on Facebook and Instagram. If you comment on or message my pages there, that interaction is handled by those platforms under their own privacy policies, not just this one.Beyond these providers, I only share your information in two situations. The first is safeguarding: if I'm worried a child is at risk of harm, I may need to share what I know with the people who can help, as set out in my terms. The second is where the law requires it - for example, a legal or regulatory request I can't refuse. Very occasionally, I may share teaching materials or examples with other professionals for training, appraisal, or sharing good practice, or with PATOSS for their evaluation - but only with all identifying details removed, so no child can be recognised.

7. Sending information outside the UK

Some of my providers - Google in particular, and others such as Zoom and WhatsApp - are based in the United States, which means some of your information is processed outside the UK. UK data protection law allows this only where the information stays properly protected, and for US providers that protection comes through the safeguards UK law requires. The main one is the UK-US Data Bridge, the UK government's arrangement that lets data go to US organisations certified to protect it to UK standards; where a provider relies instead on the standard contractual safeguards UK law recognises, those do the same job. In plain terms, your information is looked after to the same standard whether it's held in the UK or with one of these providers abroad.

8. How long I keep it

I keep your information only as long as I genuinely need it, and then I delete it. In practice:

Tuition contact details and records - kept for a year after tuition ends, then removed.

Consultation write-ups - the full write-up, the follow-up email, and any documents you shared for the consultation are kept for a short period, up to about three months, so we can settle any query, and then deleted. After that I keep only a brief record with your child's identifying details removed - the date, the type of consultation, and the gist of what I advised - for twelve months in case a question or complaint comes up, and then that's deleted too.

Messaging records - kept while your subscription is running and for a short period after it ends, then deleted.

Financial and accounting records - kept for as long as tax and accounting law requires.

Newsletter sign-up - kept until you unsubscribe, which you can do at any time.If some information is no longer needed, out of date, or simply wrong, I'll correct or remove it.

9. How I keep it safe

I take real care with the security of your information. Electronic files are kept in a secure Google Drive account; my computer and phone are password- and passcode-protected. Any paper records are kept in a locked filing cabinet. Where I send anything sensitive by email or file-share, I protect it with a password. I take reasonable steps to keep your information safe, though no method of storing or sending information is ever completely without risk, and I can't guarantee against every possibility. If a data breach ever happened that put your rights at risk, I'd report it to the ICO as the law requires, and tell you where I needed to.

10. Your rights

Under UK data protection law, you have the right to:

See the personal information I hold about you or your child, and get a copy of it.

Have anything inaccurate corrected.

Ask me to delete information, where I'm not required to keep it.

Object to, or ask me to restrict, how I use it.

Receive information you gave me in a portable format.

Withdraw consent at any time, where I've relied on it.To do any of these, just email me at greatexpectationsed@gmail.com. Some of these rights have limits - for instance, I'm required to keep certain records for legal and accounting reasons even if you ask me to delete them - and I'll always explain plainly where that applies. IIf you're unhappy with how I've handled your information, you have the right to complain to me - email me at the same address and tell me what's wrong. I'll acknowledge your complaint within 30 days, look into it properly, and let you know the outcome as soon as I can. You can also complain to the Information Commissioner's Office at ico.org.uk at any time - you don't have to raise it with me first, though I'd always rather have the chance to put it right.

11. Cookies

My website uses cookies - small files a site stores on your device - to work properly and to help me understand how the site is being used. Some are essential to make the site function; others, like the ones behind Google Analytics, help me see which pages are useful so I can improve them, without identifying you personally. You can control or clear cookies through your browser's settings, and through any cookie choices shown on the site. Turning some off may mean parts of the site work less smoothly.

12. Children

Much of my work is with children, and I take their privacy seriously. Where a learner is a child, it's you as the parent or carer who arranges things with me and gives consent on their behalf, and it's you I communicate with about bookings and payment. I don't knowingly collect information directly from a child without a parent's or guardian's involvement. If you ever think a child has given me information without your knowledge, please contact me and I'll put it right.

13. Changes to this policy

I may update this policy from time to time, so that it always reflects what I actually do. When I do, I'll change the date at the top, and if a change is significant I'll say so plainly rather than leave you to spot it.

14. How to get in touch

If you have any questions about this policy, or about how I handle your information, please contact me:Email: greatexpectationsed@gmail.com.

And if you'd like to raise something with the regulator, you can contact the Information Commissioner's Office at ico.org.uk.