Privacy & Data Protection Policy

Last updated: 18 September 2026

This policy explains how Hanna JP ("I", "me") collects, uses, stores, and protects personal data belonging to students and enquirers, in connection with online English tuition services.

It's written to address the frameworks relevant to students based in the UK, Switzerland, or the EU:

• UK GDPR and the Data Protection Act 2018, enforced by the ICO
• EU GDPR, which applies to EU-based students
• Swiss FADP (revised Federal Act on Data Protection), enforced by the FDPIC

Where the three differ, this policy follows the strictest applicable standard.

What data I collect

• Contact details: name, email, phone number
• Booking and scheduling information
• Payment details (paid by bank transfer; I don't store card or full account numbers)
• Lesson materials, notes, and progress records
• Communications by email, messaging, or platform chat

I don't knowingly collect special category data unless a student volunteers it for a legitimate teaching-related reason.

Why I collect it

• Contract: to deliver the tuition service you've booked
• Legitimate interest: to manage bookings, invoicing, and improve teaching materials
• Consent: for marketing emails or testimonials — always opt-in, always withdrawable

Where data is stored

Booking and scheduling are managed through Google Calendar, and lessons are held over Google Meet. Data is stored on Google's servers, which operate under EU/UK-approved data transfer safeguards, with access limited to me.

How long I keep it

• Active student records: for the duration of tuition plus 12 months
• Financial records: 5 years, per UK tax requirements for sole traders
• Enquiry data from people who don't become students: deleted after 6 months

Your rights

Depending on where you're based, you have the right to access, correct, or request deletion of your data, object to or restrict certain processing, request a portable copy, withdraw consent, or complain to your local supervisory authority (the ICO in the UK, your EU member state's DPA, or the FDPIC in Switzerland).

To exercise any of these, email [email protected]. I aim to respond within 30 days.

Data security

I use password-protected devices and two-factor authentication to protect your data, and don't share it with third parties except where necessary to deliver the service (e.g. Google Calendar, Google Meet).

Contact

Questions about this policy or your data: [email protected].