Privacy Policy

Last updated: 8 September 2026.

This policy explains what personal information Pemberton Academy collects when you use this website, when you message us on WhatsApp and when a student takes a lesson with us; why we hold it; who else sees it; how long we keep it; and what you can ask us to do about it. It is written to describe what our systems actually do, and it names the companies that handle your information on our behalf.

Most of our students are children. If you are a parent or guardian, section 2 is the one to read first. If all you want is your data deleted, go straight to our Delete Your Data page.

Contents

1. Who we are
2. Children's information
3. What we collect
4. Why we use it, and our legal bases
5. Signing in and account security
6. Payments
7. Lessons, Google Calendar and Google Meet
8. WhatsApp
9. The AI assistant
10. Email we send you
11. Hosting, analytics and logs
12. Cookies
13. Who else sees your information
14. International transfers
15. How long we keep information
16. How we protect information
17. Your rights, and how to use them
18. Contact and complaints

1. Who we are

Pemberton Academy ("the Academy", "we", "us") provides one-to-one online tutoring and, through confirmed Premium places, personalised handwritten lesson notes. We decide what personal information is collected through this website, our WhatsApp Business account and our lesson delivery, and why. Under UK and EU data protection law that makes us the data controller; under Malaysia's Personal Data Protection Act 2010 it makes us the data user.

Our published prices are set per market. The Academy currently maintains price books for the United Kingdom, Malaysia, the euro area, the United States, Singapore, Hong Kong and Australia, and families in those markets buy tuition from us directly.

All the ways to reach us are in section 18. We do not publish a postal address on this page; if you need one for a formal request, ask on any of those routes and we will give it to you.

2. Children's information

Our students are usually children. This section is written for the parent or guardian, and it comes before everything else because it is the part of this policy that matters most.

The account belongs to the adult, not the child

A student does not create an account and does not hold their own sign-in. The account belongs to the parent or guardian, who registers the student, arranges and pays for tuition, and manages the timetable. A student profile exists only underneath a parent's account. That means we do not collect personal information directly from a child through this website.

What we hold about a student

• The student's full name, and their date of birth where it has been given to us.
• Their school, the qualification they are taking, the exam board and their target grade.
• The lessons requested, confirmed, completed or cancelled for them, the recurring timetable behind a tuition plan, and the topics asked for.
• The tutor's post-lesson summary and handover notes, and any lesson-note document prepared and released to the student.
• A reference pointing to a safeguarding record, where one has had to be raised. The reference sits on the student profile; the underlying record does not.
• Where lesson transcription is switched on, a transcript of the lesson, which will include the child's speech attributed to them by name. Transcription is off unless the Academy has explicitly enabled it, and transcripts expire automatically — see section 7.

Consent

Consent is captured at the point of purchase. Before a tuition plan or a lesson can be bought, the account holder must confirm both that they accept how their information will be used and that they are authorised to arrange this tuition for the student. The platform refuses to create the order or the invoice without that confirmation, and it timestamps the confirmation against the parent's account record and against the student's record. Those timestamps are the Academy's evidence of parental consent.

What we never do with a child's information

We do not sell it. We do not use it for advertising, profiling or audience building, and this platform runs no advertising or cross-site tracking technology of any kind. We do not make automated decisions about a child that produce legal or similarly significant effects.

A parent or guardian can ask for a child's information at any time, and can ask us to delete it. Deletion is handled through our Delete Your Data page.

3. What we collect

Grouped by what it is for. Some of it you give us, some is created as you use the service, and some comes from the providers listed later in this policy.

• Account and identity. Your sign-in identifier from our authentication provider, your email address, your role on the platform, the display name you chose and, where they have been recorded, a contact phone number in international format and your language, currency and timezone preferences, together with the date your privacy consent was recorded.
• Premium waiting list. When a parent joins the Premium waiting list, we collect the parent email, market, level, exam board and subjects selected, together with the source of the request and when the waiting-list record was created or updated.
• Premium offers and access. Where a place is offered, we record the waiting-list preference and consent version used, the administrator and explanation, and the offer items that identify each exact class, plan and market. We also record the verified primary email used for delivery, the provider message reference, deadlines and whether the offer was accepted, declined, expired or revoked, together with any booking and agreement created from it. That evidence records acceptance, decline, expiry or revocation where applicable.
• Student profiles. As set out in section 2.
• Bookings and lesson records. Requested, confirmed, completed and cancelled lessons, the recurring timetable behind a tuition plan, rescheduling and amendment requests, what you asked the lesson to cover, the tutor's summary and notes afterwards, the calendar and video-meeting references for the lesson, and what you are entitled to access.
• Payment records. Orders, invoices, refunds, amounts, currency and status, and the references that link your account to our payment processor. See section 6 — we never hold your card number.
• How you came to us. Where an Academy representative introduced you, we record which representative it was and, if they put a timetable together with you before you booked, that draft timetable and anything you asked us to note alongside it.
• Messages. Your WhatsApp conversation with us, the emails and notifications we have issued to you, and conversations with our AI assistant. Sections 8, 9 and 10 describe each of these in detail.
• Files. Documents held in private storage for your account, such as released lesson-note PDFs.
• Operational records. An audit trail of administrative and security-relevant actions, and a keyed hash of the network address a public form was submitted from, used only to stop abuse. See section 11.
• Free-trial eligibility and security. When trial booking is available, we record the account and a keyed hash of its verified email, the trial booking and whether the one-time offer has been used or restored following an Academy cancellation. We also use a signed first-party browser cookie and keyed hashes of a browser identifier and network address to detect repeated requests. The raw browser identifier and raw network address are not written to our database. These checks concern the adult account holder, not a profile of the child.
• Tutors and applicants. If you apply to teach with us: your private account details; the separate name, biography, education, achievements, skills and optional contact details you choose for a public profile; your application, your CV, the subjects and levels you can teach, supporting credentials (which can include identity documents, degree certificates and background-check status), your availability, interview records, and — if you are engaged — the payout destination details needed to pay you, which are stored encrypted. If you request a new profile portrait, we also hold the source photograph privately, the review request and the separately generated, operator-approved portrait. A source photograph is never used as the public image merely because it was uploaded.

4. Why we use it, and our legal bases

UK GDPR references are given for readers in the United Kingdom and the EEA. Under Malaysia's PDPA the equivalent grounds are your consent and processing necessary for a transaction you have entered into, for our legal obligations, or for our legitimate interests.

• Providing tuition. Matching a tutor, scheduling and rescheduling lessons, creating the video meeting, preparing and releasing materials, and running your account. Performance of our contract with you (Article 6(1)(b)).
• Taking payment. Quoting, invoicing, collecting payment, refunding and handling disputes. Performance of our contract, and our legal obligation to keep accounting records (Articles 6(1)(b) and 6(1)(c)).
• Paying someone who introduced you. Where an Academy representative introduced you to us, recording that so we can pay them for the introduction and keep the accounting record of what was paid. Our legitimate interest in paying the people who work with us (Article 6(1)(f)), together with our legal obligation to keep accounting records (Article 6(1)(c)).
• A child's information. Handled on the basis of the parental consent recorded at purchase and described in section 2, alongside the contract for the tuition itself.
• Answering you. Replying to enquiries on WhatsApp, by email or through the contact page, including with the help of the AI assistant. Our legitimate interest in responding to people who choose to contact us (Article 6(1)(f)); on WhatsApp, your act of messaging us is also your consent under the PDPA.
• Premium waiting-list and availability updates. Recording a parent's place on the Premium waiting list and sending the requested waiting-list and availability updates for the selected market, level, exam board and subjects. We do this at the parent's request and with their consent. It is not permission for general marketing unless the parent separately opts in.
• Premium offer review. The decision is not automated: an Academy administrator reviews capacity and decides whether to offer the requested classes, a subset or a consented suitable alternative. This is not automated decision-making. We use the parent's request and consent to send and administer the offer, and contract steps if the parent accepts and proceeds to booking.
• Lesson transcription. Optional, off unless the Academy has enabled it and recorded the required privacy acknowledgement. See section 7.
• Safeguarding. Recording and acting on a child-protection concern. Our legal obligations and the substantial public interest in protecting children.
• Security, abuse prevention and audit. Verifying webhook signatures, limiting abusive traffic, controlling access to private files and keeping an audit trail of administrative actions. Our legitimate interest in operating the service safely and being able to show that we did (Article 6(1)(f)).
• Tutor profiles and portrait review. Preparing a factual tutor profile, reviewing requested teaching-scope changes and, where the tutor asks us to, using their private source photograph to prepare a consistent portrait for human review. We do this to administer the tutor engagement and present the Academy's teaching team, with the tutor's participation and our legitimate interest in accurate, consistent public information. Public email, LinkedIn and WhatsApp details are optional and are never copied automatically from the tutor's private account. An operator decides whether a portrait or capability request is approved; the image generation step does not make that decision.
• Website traffic analytics. Measuring how the website is used and how it performs, for analytics purposes only and never for advertising or profiling. Our legitimate interest in understanding and improving our own website (Article 6(1)(f)). See section 11.

Automated decisions

Free-trial checks enforce the one-time offer and may pause a request for review. A shared browser or network does not, by itself, establish that a person has already used a trial. If a check prevents you booking, you can ask the Academy to review it. We do not claim to identify every person uniquely or to detect every VPN.

Nothing on this platform makes a decision about you by automated means that produces legal effects or similarly significantly affects you. The AI assistant can look things up and can prepare a draft tuition plan and a payment link from what you tell it, but it cannot take payment, confirm a lesson, change your account or see your records. A person at the Academy remains responsible for every decision that affects you.

5. Signing in and account security

Accounts and sign-in are handled for us by Clerk. Depending on how you set your account up you can sign in with an email address and password, with a one-time code sent to your email address, with a one-time code sent by SMS to your phone number, or with your Google account. If you turn on two-step verification, Clerk supports an authenticator app, backup codes, or a code by email or SMS.

Clerk holds the credentials. Your password and your one-time codes are never sent to or stored in the Academy's own database. If you sign in with Google, Google confirms your identity to Clerk and we receive your basic profile details and email address — we never see your Google password. When you create an account, Clerk also runs an automated bot-protection check on the form.

What the Academy's own database stores from all of this is your Clerk user identifier, your email address, your role and your display name, kept in step each time you sign in.

6. Payments

Payments are processed by Stripe. When you buy tuition you are taken to a payment page hosted by Stripe, or to a Stripe-hosted invoice. Card details are entered there, on Stripe's own pages.

The Academy's systems never receive and never store your card number. There is no card field anywhere in this service. What we store is Stripe's own references — the customer, checkout session, payment intent and invoice identifiers — together with the amount, the currency, the status of the payment, any refund and any hold placed on an order.

To let Stripe raise a receipt or invoice we send it your name and email address and our internal order reference. Stripe processes payments under its own terms and privacy notice, and keeps its own transaction records to meet its own legal obligations.

If you teach for the Academy, payouts also run through Stripe, and any manual payout destination you give us is stored encrypted. Access to those decrypted details is restricted, rate-limited and recorded.

7. Lessons, Google Calendar and Google Meet

Lessons are delivered over Google Meet, scheduled through Google Calendar.

When a lesson is confirmed we create a calendar event carrying a Meet link. The event title contains the student's first name and the tutor's name; the description does not contain the subject or the topic you asked for. Only the tutor is added to the event. A family's email address is deliberately never disclosed to a tutor through a calendar invite — your Meet link reaches you in your own confirmation email instead.

Lesson transcripts

Transcription of lessons is an optional feature and it is off by default. It requires two separate switches to be set by the Academy: the feature itself, and a recorded acknowledgement that the Academy has approved its participant notice and retention process. Unless both are set, no transcript is captured and no transcript can be opened by anyone.

Where it is on, Google generates the transcript and the Academy keeps a copy: the transcript text, and a speaker-by-speaker list of what was said, with speaker names and timestamps. For a tuition lesson that means a record of a child speaking, attributed to them.

Stored transcripts expire on their own. Each one is given an expiry when it is captured — 30 days unless the Academy has configured a different window, which the platform will only accept between 1 and 365 days. An automated purge then erases the transcript text and the speaker-by-speaker entries and marks the record expired; the database itself refuses to hold an expired record that still contains content. What remains afterwards is a short lifecycle record showing which lesson it belonged to, when it was captured and when it was purged. None of the conversation survives in it.

Two things to be clear about. Google may separately retain its own generated transcript document inside the Academy's Google Workspace, under that Workspace administrator's own retention settings, which is outside this platform's purge. And there is no per-family switch: transcription is either on for the Academy or off. If it is on and you do not want your lessons transcribed, tell us and we will make arrangements with you.

8. WhatsApp

The Academy runs a WhatsApp Business account through Meta's WhatsApp Business Cloud API. If you message us there, both Meta and the Academy handle that conversation.

What Meta receives

Meta carries the conversation, so Meta handles your phone number, your WhatsApp profile name, the content of every message you send us and every message we send you, and the delivery and read information for those messages. Meta processes all of that under its own terms and privacy policy, which we do not control. If you would rather not use WhatsApp, every other route in section 18 reaches the same team.

What the Academy stores

Message content is retained. It is not deleted on a timer. Specifically we store:

• A contact record for you, including the WhatsApp profile name Meta supplies.
• Your phone number in international format, and the history of the phone numbers and WhatsApp identifiers we have seen for that contact.
• Every inbound and outbound message: its direction, its type and its text. For inbound messages, we also store the full message object Meta delivers to us. That object is stored as Meta sends it, so for a location message it includes the coordinates you shared, and for a shared contact card it includes that person's details.
• The delivery and read status events Meta reports back to us, as Meta sends them.
• Internal processing and dispatch records raised for each message.

An older WhatsApp booking assistant also stores, keyed to your phone number, a plain-text transcript of your chat with it and any draft booking taken from that chat.

Where the WhatsApp assistant is enabled, messages you send us may be read by our AI assistant — see section 9. To have your WhatsApp data removed, use our Delete Your Data page.

9. The AI assistant

The Academy operates an AI assistant for authorised staff on this website and may also enable it for messages sent to our WhatsApp Business account. This section applies wherever the assistant is enabled.

What happens to your words

To produce a reply, the content of the conversation is sent to a large language model — Anthropic's Claude, reached through the Vercel AI Gateway. That provider processes the content as a service provider acting on the Academy's behalf, for the purpose of generating the response. There is no way to use the assistant without your words reaching it.

Where the assistant is enabled on WhatsApp, what we send the model may include recent text messages in your conversation with us, both your messages and our replies. We do not intentionally include your phone number or your WhatsApp profile name in the model prompt, and the assistant has no ability to look up an account from your number — it does not know who it is talking to. Pictures, voice notes, documents and other non-text messages are not uploaded to the model; it is told only that a message of that type arrived and asked to request a text description.

Please keep in mind that the text of your message is passed on exactly as you wrote it. Nothing scans it or strips things out. If you type a name, an address, a child's school or any other detail into a message, that detail goes to the model with the rest of the message, so please send only what you need to.

What the assistant can do

Depending on the channel and the settings enabled there, it can look up subjects, levels, prices and quotes, and may prepare a draft tuition plan with a payment link. It cannot take a payment, confirm a lesson, change anything on your account, or read your records. When it uses one of those lookups, the fact that it did so is written to our audit trail.

What is stored

Where the assistant runs on the website, the conversation is stored in the Academy's database — the messages on both sides, the lookups the assistant performed and what they returned, the model used and the number of tokens processed. Where the assistant is enabled on WhatsApp, the conversation is stored as WhatsApp messages instead, exactly as described in section 8; the assistant's reply is stored as an outbound message on your conversation.

Training

We want to be precise here rather than reassuring. Pemberton Academy does not train any AI model on your data, and builds none — we use a third-party model to generate replies and nothing more. What the model provider does with the content it receives, including whether and for how long it retains it, is governed by that provider's own terms rather than by anything configured in this service. This policy therefore makes no promise on the provider's behalf, and you should not read one into it. If you want to know which provider terms apply, ask us and we will tell you.

10. Email we send you

Email is delivered for us by Resend. The messages it sends are transactional: order confirmations, lessons scheduled, rescheduled or cancelled, amendment and coverage notices, tuition continuation and monthly-period confirmations, tutor interview invitations, and payout-destination change alerts. A parent who joins the Premium waiting list may also receive the requested availability updates for the market, level, exam board and subjects they selected. Where an administrator issues a place, the parent may receive a private Premium offer and deadline notice at the account's current verified primary email. These messages contain your email address, the learner's and tutor's names, lesson dates and times, and links back to this site.

They are sent from the Academy's notifications address, which is a sending address only. We keep a log of which notification went to which account, when, and the provider's message reference. Premium waiting-list and availability updates are limited to the service the parent asked to hear about. They are not general marketing unless the parent separately opts in, and the parent can withdraw the request through the contact or data-deletion routes.

11. Hosting, analytics and logs

The website and its interfaces run on Vercel. Our database is a managed PostgreSQL service (Neon). Private files are held in Vercel's private file storage, and some WhatsApp processing is handed to Vercel's queue service.

Performance and page-usage measurement

Vercel Speed Insights is loaded on the site. It measures how quickly pages load and respond and reports those measurements against the page's route.

Vercel Web Analytics gives us aggregate page-usage reports. A pageview may include a sanitised page path and route template, a pageview timestamp, referrer information where the browser supplies it, approximate geographic information, the browser and its version, the operating system and its version, and the device category.

We collect this traffic data for analytics purposes only. We use it to see how many people reach the site, which pages they read and how well those pages perform, so we can improve the service. We do not use it for advertising, ad targeting, profiling, automated decision-making or price setting, we do not use it to build a picture of an individual visitor, and we neither sell it nor share it with an advertising network or data broker. Our lawful basis is our legitimate interest in understanding and improving our own website (Article 6(1)(f)).

Vercel reports aggregate analytics, and those reports are not associated with an Academy customer profile. Dynamic customer identifiers in page paths are replaced with route templates, and query strings and URL fragments are removed before pageviews are sent. The analytics must not receive payment references, invoice IDs, booking IDs, email addresses or tokens from URLs.

We run no Google Analytics, advertising pixel, conversion pixel or session-recording tool, and there are no third-party analytics cookies.

Your approximate country for pricing

For pricing, our host tells us a coarse country for your request so the site can show prices in the right currency; we use it to choose which price book to display and do not store it. That pricing operation is separate from Vercel Web Analytics' aggregate geographic reporting. If you pick a currency yourself, that choice is remembered in a cookie instead — see section 12.

Audit trail

We keep an audit trail of administrative and security-relevant actions. Where applicable, it records who acted, what they did, which record it affected, when, and a before-and-after snapshot of that record. It is how we can show the service was operated correctly. It records no raw network address or raw browser fingerprint. Trial security evidence is held separately, as described below.

Network addresses

The public tuition-planning form is rate-limited so it cannot be abused. To do that we read the network address the request came from and immediately convert it into a keyed hash. The address itself is never written to our database.

Free-trial security checks

The trial form uses the open-source FingerprintJS library in your browser to produce a browser identifier. Library telemetry is disabled; we do not send its component measurements or identifier to Fingerprint's commercial service. The identifier sent to the Academy is immediately converted to a keyed hash. It is an imperfect similarity signal: browsers can change, several people can share a device, and these signals can be altered.

Where the Academy has configured Cloudflare Turnstile on the trial form, Cloudflare also processes the browser and network information needed to carry out its security challenge. We send the resulting token to Cloudflare for server verification, without adding your account identifier, email address or network address to that verification request. We do not store the token or provider response in the trial record. These checks are used to protect the one-time offer, not for advertising or cross-site audience building.

12. Cookies

The Academy sets first-party, functional cookies. There are no advertising cookies and no cross-site tracking cookies.

• Clerk session cookies. Set by our authentication provider to keep you signed in and to protect the sign-in process. Strictly necessary: without them you cannot use an account.
• pa_price_book. Remembers the market and currency you chose so prices stay in it. Server-side only, not readable by scripts in your browser, and it lasts up to a year.
• pemberton_academy_browse. Records that you deliberately chose to browse the public site from inside your dashboard, so you are not sent straight back. Server-side only and it lasts for the browser session.
• sidebar_state. Remembers whether the dashboard sidebar is open or closed. It is readable by the site's own interface code and lasts for up to seven days.
• pa_trial_device. Set when you submit an enabled trial form. A signed random identifier helps recognise repeated trial requests from the same browser. It is server-side only, is not readable by browser scripts and expires after 90 days. It is not proof that two requests came from the same person.
• pemberton_ref. Set only if you reached us through a link from an Academy representative. It records which representative introduced you, so that we can pay them for the introduction. Server-side only, not readable by scripts in your browser, and it expires with the link that set it, which is usually about a month.

Clerk's bot-protection check on the sign-up form may also store data in your browser; that is set and controlled by Clerk.

If Cloudflare Turnstile is configured for trial booking, its security challenge also processes browser information under Cloudflare's Turnstile privacy terms.

13. Who else sees your information

We do not sell personal information, and we do not share it for advertising. It reaches other parties only in the ways below.

• Service providers we rely on to run the platform: Clerk (accounts and sign-in), Stripe (payments and payouts), Google (calendar, video lessons and, where enabled, transcripts), Meta (WhatsApp messaging), Anthropic reached through the Vercel AI Gateway (AI replies), Resend (email delivery), Vercel (hosting, private file storage, queues, performance measurement and aggregate page-usage analytics) and Neon (the database). Where configured, Cloudflare provides the Turnstile security challenge for trial booking.
• Your tutor, who sees what is needed to teach the lesson: the student's first name, level and subject, the topics requested and the timetable. When you book you may also choose to give a contact email address and a WhatsApp number so the tutor can reach you before or between lessons and prepare accordingly. Both fields are optional and may be left blank, and we show them only to the tutor actually assigned to your lessons — never to a tutor considering whether to take them, and never in a calendar invitation, which still carries no family contact details at all.
• The Academy representative who introduced you, where one did. So that we can pay them for the introduction, they can see your name, what has been booked, the amounts, whether an invoice has been paid, and what they are owed for it. They are never shown your child's name, date of birth or school, and they are never given your email address or your phone number.
• Professional advisers such as our accountants, where they need it for the purpose they are advising on.
• Authorities and other organisations where the law requires it, where we must act on a safeguarding concern, or where we need to establish or defend a legal claim.

14. International transfers

The providers listed above are established in, or operate infrastructure in, the United States and other countries. Your information may therefore be processed outside the United Kingdom, outside the European Economic Area and outside Malaysia.

Transfers of that kind rely on the transfer terms in each provider's own data processing agreement, such as standard contractual clauses and the equivalent UK addendum. We would rather point you at the actual document than summarise it inaccurately here: ask us which terms apply to a particular provider and we will tell you.

15. How long we keep information

Where the platform itself enforces a period, we state that. Other records are reviewed by the Academy team:

• Lesson transcripts expire automatically, 30 days after capture unless the Academy has configured a different window of between 1 and 365 days (section 7).
• Unclaimed pre-purchase tuition plans, created when someone configures a timetable but does not complete a purchase, carry their own expiry.
• Trial security evidence. Device, browser and network hashes expire for matching after 90 days and are removed by scheduled cleanup. The minimum account, verified-email hash and redemption history are kept for as long as needed to administer the one-time offer and deal with a dispute. A deletion request includes a review of what minimum entitlement evidence remains necessary; removing an account does not automatically restore the offer.
• Premium waiting-list records are reviewed after 12 months without an update and deleted or anonymised when no longer needed. Withdrawal stops waiting-list and availability updates immediately; a verified deletion request can remove the record sooner.
• Premium offer records that did not lead to a purchase are reviewed with the waiting-list relationship and removed or anonymised when no longer needed. An offer item tied to a commercial agreement is retained with the minimum delivery, acceptance and access evidence needed for accounting, disputes and to prove that the invitation was not reused.
• Tutor profile and portrait records are kept while the profile or tutor relationship is active and while the associated human review evidence is needed. Raw source photographs remain private and are not reused as public portraits; superseded curated files are removed only after the service confirms that no profile still references them. A verified deletion request can remove profile files sooner, subject to the review, dispute and audit evidence we must retain.

Everything else is kept for as long as you have a relationship with the Academy and then for as long as we need it for the purpose it was collected for. In practice that means: accounting and tax records for the statutory period that applies to us; safeguarding records for as long as our child-protection obligations require; audit and security logs for as long as they are needed as evidence that the service was run correctly; and records tied to an open payment dispute, complaint or legal claim until it is resolved.

We have not fixed a single retention period for every other category, and this policy does not pretend otherwise. If you want your information removed sooner, ask — our Delete Your Data page sets out exactly what we can remove, what we have to keep and why, and how long it takes. Information that has been deleted may persist in encrypted system backups until those backups expire on their normal cycle; it is not restored into the live service.

16. How we protect information

The measures below are the ones actually in place in this service.

• The site is served only over HTTPS, with strict transport security, a content security policy, clickjacking protection and MIME-sniffing and referrer protections applied to responses.
• Sign-in is handled by a specialist provider; we never store your password. The family, tutor and administrator areas are separated by hostname so one area cannot serve another's pages, and protected areas fail closed rather than opening up if authentication is not configured.
• Incoming notifications from Stripe and from Meta are rejected unless their cryptographic signature verifies, and their size is capped.
• Private files — lesson notes, CVs, credentials — are never given a public address. They are streamed through access-controlled routes, and each read is recorded in the audit trail.
• Tutor payout destinations are stored with authenticated encryption, and access to the decrypted values is restricted, rate-limited and recorded.
• Network addresses used for abuse limiting are hashed before storage.
• Access to personal information inside the Academy is limited by role.

No online service can be guaranteed completely secure, and we do not claim to be. We keep an internal security record, re-audit the code, and act on what it finds.

17. Your rights, and how to use them

If you are in the United Kingdom or the EEA

Under the UK GDPR and the EU GDPR you have the right to be told how your information is used, to get a copy of it, to have it corrected, to have it erased, to restrict how it is used, to receive it in a portable form, to object to processing we carry out on the basis of our legitimate interests, to withdraw a consent you have given (which does not undo what was done beforehand), and not to be subject to a decision made solely by automated means that has legal or similarly significant effects.

If you are in Malaysia

Under the Personal Data Protection Act 2010 you have the right to be informed about how your personal data is processed, to access it, to correct it, to withdraw a consent you have given, to limit how your data is processed, and to require us not to process it for direct marketing. Premium waiting-list and availability updates are sent only when requested; they are not general marketing unless you separately opt in, and you may withdraw the request at any time.

If you are somewhere else

The Academy also serves families in the euro area, the United States, Singapore, Hong Kong and Australia. Local law may give you comparable rights. Wherever you are, we will handle your request to the standard set out above.

How to use them

Ask us on any of the routes in section 18. To protect your family we will ask you to confirm who you are before we act, and a request about a student should come from the parent or guardian who holds the account. There is no charge in ordinary circumstances.

For deletion, use our Delete Your Data page. It is written specifically for that request, and it sets out what a deletion covers, what has to be retained and why, and the timescales we work to.

18. Contact and complaints

Questions about this policy, about what we hold, or about a request already in progress all go to the same team.

• WhatsApp. Open the Academy's WhatsApp conversation.
• Email. Write to support@pembertonacademy.com. This is also the address that receives your replies to any email the Academy has sent you, so replying to an existing message works just as well.
• Contact page. Every route on our contact page reaches us.
• Postal address. Not published here. Ask on any route above if you need one for a formal request.

Complaints

If you are unhappy with how we have handled your information or your request, please tell us first so we have the chance to put it right. You also have the right to complain to a regulator: in the United Kingdom that is the Information Commissioner's Office; in Malaysia it is the Personal Data Protection Commissioner; elsewhere it is your local data protection authority.

Changes to this policy

If our practices change we will update this page and change the date at the top. Where a change materially affects how your information is used, we will say so clearly on this page.