Privacy policy

Aspire is two companies under common ownership, one in the United Kingdom and one in the United States. They are separate legal entities, and each is a separate data controller for the data it holds. They are not joint controllers.

Which company holds your data

The UK company runs this website. It is the controller for everything the site collects, including the booking form, the feedback form, tutor applications, cookies and analytics, whoever you are and wherever you live.

The UK company is the controller for clients in the United Kingdom and everywhere except the United States. If you contract with us, your Agreement names Aspire Education Services Ltd as the Provider.

The US company is the controller for clients resident in the United States, from the point your enquiry is passed to it. Section 7 explains how that transfer works and what protects it.

The two companies do not pool client records. A UK client's file sits in the UK company's systems. A US client's file sits in the US company's systems.

Neither company is required to appoint a Data Protection Officer. Privacy questions, data requests and complaints for both companies are handled by our founder, Dr Hamish Roberts, at the email address above. Write once and it reaches the right company.

This policy covers our website, the booking form, the feedback form, tutor applications, sessions delivered on Google Meet, and any correspondence between you and Aspire by email, WhatsApp, Instagram or LinkedIn.

How this policy relates to your Agreement

If you have signed our Terms of Service and a Schedule, that Agreement governs your engagement. This policy gives the detail behind clause 12 of those Terms and is written to match them. Where a signed Agreement sets a shorter retention period or a narrower use than this policy allows, the Agreement wins for that engagement.

Back to contents

We collect what is needed for the purpose described and no more.

Contact and identity data. Name, email address, phone number, postal or billing address where an invoice requires one. For students under 18, the parent or guardian named as Client under clause 2.3 of our Terms.

Educational data. Year group, curriculum (GCSE, A-level, IB, Scottish Highers, Pre-U, undergraduate or other), school or college, subjects, predicted and achieved grades, target universities, admissions route (Oxbridge, UK, US, or undecided), prior applications, admissions tests being sat, and deadlines set by a school or referee.

Information you type into a free text field. The nature of your enquiry, the optional context box on the booking form, and anything written to us in an email or a message. Please only include what you want us to hold.

Application and session material. Drafts of personal statements, essays, coursework extracts, admissions test practice, session notes, written feedback, and research prepared for the engagement.

Health and learning support information. Clause 9.2 of our Terms asks you to tell us about a learning difference, disability or health condition that may affect the Services. That information is a special category of data and section 3 sets out how we treat it.

Consultant and applicant data. For tutors and consultants: university attended, degree type and subject, graduation year, teaching and admissions experience, CV, LinkedIn profile, availability, right to work, and the record of a background check.

Criminal records information. For consultants working with students under 18 only. See section 3.

Communication data. Emails, WhatsApp messages, Instagram and LinkedIn messages, call notes, and internal notes about your engagement.

Session data. Attendance, joining and leaving times on Google Meet, and recordings where the Client has agreed to them in writing.

Payment and billing data. Invoice records, payment stages, amounts, dates and bank transfer references. Invoices are issued by email through Stripe, which processes your name, email address and billing details, and handles any card payment. There is no checkout on this website. We do not see or store full card numbers.

Technical data. IP address, device and browser type, pages viewed, and how you arrived at the site. Analytics is not collected unless you accept it through the cookie banner.

Feedback and testimonials. What you send us through the feedback page, by email, or in a review, and any consent you give for us to publish it.

We do not knowingly collect data from children under 13 without verifiable parental consent. If you believe a child has given us data without appropriate consent, contact us and we will delete it.

Back to contents

Some of what we hold carries extra protection under the law. This section sets out what it is and how we handle it.

Health and learning support information

This covers a learning difference such as dyslexia, dyspraxia, ADHD or autism, a physical or mental health condition, a disability, exam access arrangements, and the circumstances behind an extenuating circumstances declaration or a deferred application.

We ask for it because we cannot make reasonable adjustments to a session, or advise properly on a UCAS or Common App declaration, without knowing. You are not obliged to tell us. If you choose not to, we will still deliver the Services, but we may not be able to adjust them.

Our lawful basis is your explicit consent under Article 9(2)(a) of the UK GDPR, given when you provide the information for that purpose. Where a safeguarding concern arises, we rely instead on the substantial public interest condition for safeguarding children and individuals at risk in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018.

We hold an Appropriate Policy Document as Schedule 1 of the Act requires. A copy is available on request.

Access is limited to the consultant delivering your sessions and to our founder. It is not shared with other clients, other consultants, or anyone outside Aspire, and it is not used for marketing or included in any published testimonial or case study. You may withdraw consent at any time by writing to us, and we will delete the information unless we are required to keep it for a safeguarding or legal reason.

Criminal records information

Consultants working with students under 18 hold a current enhanced Disclosure and Barring Service certificate, or the equivalent check in their jurisdiction, as clause 10.2 of our Terms requires.

We record the certificate number, the date of issue, the level of the check and the outcome. We do not keep a copy of the certificate itself for longer than six months, in line with the DBS code of practice. This processing relies on the employment condition in Schedule 1, Part 1, paragraph 1 and the safeguarding condition in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018, and it is covered by the same Appropriate Policy Document.

Back to contents

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Every judgement about a student is made by a person.

Back to contents

Most of our contact with families and nearly all of our record keeping runs through two providers. Rather than list them in a table with everything else, we have set out what each one does.

WhatsApp

We use WhatsApp for enquiries, scheduling and day-to-day contact. There are two numbers. The UK company uses +44 7896 482873 and the US company uses +1 (843) 300-9123, so a UK client's messages stay with the UK company. WhatsApp is provided by WhatsApp Ireland Limited for users in the UK and the EEA, and by WhatsApp LLC elsewhere. Both are part of Meta.

When you message us there, Meta processes your phone number, your profile name and photo if you have one, the content of your messages, and metadata including when you message, how often, and whether a message was delivered and read.

Message content is end to end encrypted in transit, so Meta cannot read what you send us. The metadata is a different matter. Meta holds it and uses it under its own terms, which we do not control and cannot vary. If that concerns you, email is available and works just as well. Tell us and we will move the conversation.

How we use it:

• We do not send marketing on WhatsApp without your consent, and we do not add anyone to a broadcast list or a group without asking first.
• Anything that belongs in your record, such as an agreed change of date or a decision about the engagement, is copied into your client file in Google Workspace so it does not live only in a chat.
• Chats are cleared from the device twelve months after the end of an engagement.
• Where a student is under 18, written messaging happens in a group that includes a parent or guardian, or is copied to them, as clause 10.3 of our Terms requires. We do not open a one to one chat with a student under 18, and we do not use personal social media accounts to reach them.
• We do not use WhatsApp to send health information, safeguarding notes or anything else from section 3. Those go by email or are discussed on a call.

Meta's privacy terms for WhatsApp are published at whatsapp.com/legal.

Google Workspace

Aspire runs on Google Workspace. The two companies run separate Workspace tenants. UK client records sit in the UK company's Workspace and US client records sit in the US company's Workspace. Neither company has routine access to the other's.

Google Ireland Limited acts as processor for the UK Workspace under the Google Workspace Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Google LLC acts as processor for the US Workspace. Google does not use the content of either Workspace for advertising and does not act as a controller for it.

Every Aspire account has two factor authentication switched on. Access follows least privilege, so a consultant sees the material for the students they teach and nothing else. Client records are held in Workspace rather than on personal devices or local drives.

Google Meet

All tutoring and consulting sessions are held on Google Meet, whatever the subject or format. Google logs the name, email address and joining and leaving times of everyone in the call.

Sessions are recorded only where the Client has agreed in writing and the Schedule records it, as clause 11.1 of our Terms requires. Where the student is under 18, we will not record without explicit written agreement from the parent or guardian beforehand. Recordings are made for the benefit of the student and for safeguarding and quality, they are shared with the Client and the Student, and they are stored in our Google Drive.

We will never publish a recording or use one in marketing. You may withdraw consent to recording at any time in writing, and sessions continue unrecorded from that point. Recordings are deleted twelve months after the end of the engagement unless we are required to keep them longer. You and the Student agree not to share recordings, session notes or our written feedback outside your household without our written consent, which is clause 11.5 of the Terms.

Back to contents

We do not sell personal data. We do not share it with anyone for their own marketing. We share it in these circumstances only.

The other Aspire company. If you enquire through this website and you live in the United States, the UK company passes your enquiry to the US company, which then becomes the controller. That is the only routine flow between the two. A written agreement between them governs it, and section 7 sets out what protects the transfer. We do not move a UK client's file to the US company, or a US client's file to the UK company, for any other reason.

Consultants. Tutors and consultants engaged to deliver your Services receive what they need to prepare and teach, and nothing more. They are bound by contract and by confidentiality obligations, and they process data on our instructions.

Service providers. Google Ireland Limited (Workspace, Meet, Calendar, Drive, Gmail, Analytics), WhatsApp Ireland Limited and Meta (messaging, as described in section 5), Squarespace Ireland Limited and Squarespace Inc (website hosting), Stripe Payments Europe Limited (card payments where offered), Sender (Sender.net, which sends the Aspire Newsletter and stores subscriber details in the European Union), our bank, our accountant, and the provider that administers background checks. Each processes data under a written contract.

Instagram and LinkedIn. If you message us on either platform, that message sits on Meta's or Microsoft's systems under their terms. We move anything substantive to email.

Professional advisers and insurers, where we need advice or need to notify a claim.

Legal and regulatory authorities, where the law, a court order or a safeguarding obligation requires it.

We will not tell a school, university, examination board or any other third party that a student is working with us without your consent. The only exception is a safeguarding concern under clause 10.5 of our Terms, where we may report without telling you first if telling you would increase the risk to a child.

Back to contents

Personal data leaves the UK in two situations. The first is our providers, several of which are US companies. The second is the handover of a US client's enquiry from the UK company to the US company.

For providers, we rely on an adequacy decision where one exists, or on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework and its UK Extension where the recipient is certified under it. Google, Stripe and Squarespace are covered by these arrangements. Newsletter subscriber details held by Sender are stored in the European Union, and transfers from the UK rely on the UK’s adequacy regulations for the European Economic Area. We assess the risk before making a transfer and apply additional measures where they are needed.

For the handover between the two Aspire companies, there is a written data sharing agreement between them which includes the UK International Data Transfer Agreement. Aspire Education Services LLC is also certified under the EU-US Data Privacy Framework and its UK Extension. Both routes are in place, so a transfer is covered whichever is relied on.

The UK company does not send a UK client's data to the US company, and the arrangement does not allow the US company to use anything it receives for its own purposes beyond serving the client who enquired.

Back to contents

We keep data for as long as the purpose requires, or for as long as the law requires, and then delete or anonymise it.

Where a complaint, dispute or legal claim is live, we keep the relevant records until it is resolved and any appeal period has passed.

Back to contents

Where a student is under 18, our Agreement is with a parent or legal guardian, who is the Client, is responsible for payment, and consents on the student's behalf. That is clause 2.3 of our Terms.

• We do not send marketing to anyone under 18.
• Written communication with a student under 18 happens in a group that includes a parent or guardian, or is copied to them.
• We do not communicate with a student under 18 through personal social media accounts, and we do not arrange contact outside the agreed channels.
• A parent or guardian is welcome to be present at any session.
• A parent or guardian may access, correct or request deletion of their child's data by writing to us.

Our website is written for parents, but we know that students of 13 and over read it. We do not profile visitors, run behavioural advertising, or use design techniques that push anyone towards giving us more data than they intended. We have written this policy with the ICO's Age Appropriate Design Code in mind.

As a student gets older they may be capable of exercising their own data rights. Where we judge that to be the case, and particularly where a student is 16 or over, we will deal with them directly on a request about their own data and will tell the parent that we have done so unless there is a safeguarding reason not to.

Back to contents

We maintain a safeguarding policy, which is available on request.

Consultants working with students under 18 hold a current enhanced DBS certificate or the equivalent check in their jurisdiction. Sessions take place on Google Meet, on the agreed platform and in the agreed way.

If we have a concern about the welfare of a student, we will raise it with you. If we believe a child is at risk of significant harm, we may report the concern to the appropriate authority without telling you first, where telling you would increase the risk. This is clause 10.5 of our Terms.

Safeguarding records may be kept beyond the periods in section 8 where the law or statutory guidance requires it.

Back to contents

We publish testimonials, student outcomes and case studies on our website, on Instagram and on LinkedIn. Social proof is central to how families judge us, so we are specific about how we handle it.

We publish only with written consent. Where the student is under 18, consent comes from the parent or guardian named as Client, and we ask the student as well.

We tell you exactly what will appear before you agree: whether we use a first name, initials or nothing at all, whether we name the school, the year group, the subject, the university, the offer, the wording of any quotation, and whether a photograph is included.

Our default is minimal. First name or initials, no school named, no photograph. Naming a school, publishing a full name, or using a photograph of a student under 18 requires separate written consent for that specific use.

Consent is specific. If you agree to a quotation on the website, we do not then use it in an advertisement or a different context without asking again.

Results are not published on the day without asking on the day. A grade or an offer is yours to announce first.

You can withdraw at any time. Write to us and we will remove the material from anything we control within 14 days. We cannot recover a screenshot someone else has taken or a post someone else has shared, and we will say so honestly rather than promise otherwise.

Session recordings are never used in marketing under any circumstances, and health or learning support information never appears in a testimonial or case study.

Back to contents

Only strictly necessary cookies are set when you arrive. Everything else is blocked until you accept it through the cookie banner. If you decline, or if you ignore the banner, no analytics cookie is set and no analytics data is collected.

Google Analytics is configured without advertising features, without demographic reporting, and with data retention set to 14 months.

We run no advertising or retargeting pixels. There is no Meta pixel and no LinkedIn Insight Tag on this site. If we introduce one, we will update this policy and ask through the banner before it fires.

You can change or withdraw your choice at any time by clearing cookies for this site in your browser, which will bring the banner back on your next visit. You can also block or delete cookies through your browser settings.

We honour the Global Privacy Control signal. If your browser sends one, we treat it as an opt-out of any sale or sharing of personal data for visitors in US states that recognise it, though we do not sell or share personal data in the first place.

Back to contents

We take technical and organisational steps proportionate to the data we hold:

• The site runs over HTTPS.
• Two factor authentication is on every Aspire account.
• Access follows least privilege. A consultant sees the students they work with and nothing more.
• Client records live in Google Workspace under our admin controls, not on personal devices or local drives. UK and US client records sit in separate Workspace tenants.
• Health and safeguarding information is held separately with narrower access.
• We do not store card details. Stripe handles invoicing and any card payment.

One warning worth repeating from clause 6.2 of our Terms. We invoice from info@aspireeducationservices.com and we never change our payment details by email. If you receive a message that appears to come from us giving different bank details, do not act on it. Call us on the number above.

No system is completely secure. If we suffer a personal data breach that is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk is high. If you think your data has been compromised, contact us immediately.

Back to contents

If you are in the UK or the EU

You have the right to be told what we hold, to get a copy of it, to have inaccurate data corrected, to have data deleted, to restrict how we use it, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time. You have an absolute right to object to direct marketing, and we will stop straight away.

Some of these rights have exceptions. We may not be able to delete records we are required to keep for tax, safeguarding or the defence of a legal claim, and we will explain the reason if we refuse.

If you are in the United States

Wherever you live in the US, we will honour a request to know what we hold, to receive a copy, to correct it, to delete it, and to limit our use of sensitive personal information. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not run targeted advertising, so there is nothing to opt out of, but you may ask us to confirm that in writing. We will not treat you differently for exercising a right.

Appeals. If we refuse a request, we will tell you why and how to appeal. Write to us and we will respond to the appeal within 45 days. If we refuse again, we will give you the contact details for your state Attorney General, and California residents may also contact the California Privacy Protection Agency.

You may use an authorised agent to make a request. We will ask for written proof of their authority.

Making a request

Write to info@aspireeducationservices.com. Requests are free.

You do not need to work out which company holds your data. Both are reachable at that address, and whichever one holds your record will answer. If we have to pass a request between the companies, we will tell you and the clock does not restart.

We will ask you to confirm your identity before we release anything. Usually that means replying from the email address we already hold for you. If we cannot match a request to a record, we may ask for one further piece of information, and we will not ask for more than we need.

For a request about a student under 18, we deal with the parent or guardian named as Client. Where a student is old enough to make their own request, section 9 applies. Where parents are separated and only one is the Client, we will deal with the Client and will tell the other parent that we hold a record if they ask, without releasing its contents unless we are satisfied it is appropriate.

We respond within one month for UK and EU requests, extendable by a further two months for complex requests, and within 45 days for US requests, extendable by a further 45 days. We will always tell you if we need longer.

Complaining

If you are unhappy with how we have handled your data, tell us first at info@aspireeducationservices.com. We will acknowledge within two working days and respond substantively within five working days, matching clause 16 of our Terms.

You can also complain to a regulator without coming to us first:

• UK: the Information Commissioner's Office at ico.org.uk, or 0303 123 1113.
• EU: your local supervisory authority.
• California: the California Privacy Protection Agency, or the Attorney General.
• Other US states: your state Attorney General.

Back to contents

If you are a prospective client, we send marketing only with your consent.

If you are an existing or recent client, we may send you information about services similar to the ones we have already provided, relying on the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations. Every message carries a one-click way to stop.

The Aspire Newsletter. We send a newsletter every other Tuesday. The UK edition comes from Aspire Education Services Ltd and the US edition from Aspire Education Services LLC, and the two lists are kept separate. We add you only if you are 18 or over and either ask to join through our website and confirm by email, or are an existing or recent client who was given the chance to opt out. We hold your name, email address, which edition you receive, whether you are a parent, a student or school staff, and when and how you joined. Our email provider records whether each issue is opened and which links are clicked. We use this only to see which issues and pieces are useful, and we do not use it for advertising or profiling. Every issue has a one-click unsubscribe link.

We never market to anyone under 18. We do not send marketing on WhatsApp without asking first. We do not pass your details to anyone else to market to you.

Back to contents

We may update this policy. The version number and date at the top always reflect the current version. Where a change materially affects how we use data about a live engagement, we will email active clients before it takes effect. Earlier versions are available on request.

Back to contents

For a data request, an appeal, a safeguarding concern or a complaint, use the email address above and say in the subject line what the message is about, so it reaches the right person quickly.

Back to contents