Privacy Policy

Wonders of Maths Limited ("Wonders of Maths", "we", "us", "our") is a tutoring provider for children, specialising in tutoring tailored to each child's optimum learning strategy. We deliver our services through our website at https://www.wondersofmaths.com and through Educai, our online platform for scheduling, bookings, payments and reporting, which can be accessed at https://educai.io.

This Privacy Notice applies to both https://www.wondersofmaths.com and https://educai.io.

Educai is the central system through which we, our tutors, parents/carers and students interact with one another. It is through Educai that sessions are booked and scheduled, that payment details are taken (using our payment processor, Stripe), and that progress reports are sent to students and their parents/carers.

This Privacy Notice explains, in plain language and in a question-and-answer form, how we collect, use, share and protect your personal data when you interact with us – whether you are a visitor to our websites, a parent or student receiving tutoring, a tutor working with us, a supplier providing services to us, or a candidate applying for a role with us. We have written it this way so that you can go straight to the questions that matter to you, rather than having to read the whole Privacy Notice.

This Privacy Notice is kept regularly under review and was last updated on 25 September 2026.

1. What have we done to help you navigate this Privacy Notice?

We know that legal terms can feel complex, so we've explained some of the key terms used throughout this Privacy Notice below.

Data protection law refers to the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, together with any other applicable laws and regulations regarding privacy. These laws set out the principles for how we must handle your personal data, and the rights you have in relation to it.
Personal data refers to any information identifying you, or information relating to you that we can identify (directly or indirectly) from that data alone or in combination with other information we hold. It excludes data that has been anonymised so that it can no longer be linked back to you.
Special category data refers to personal data that is more sensitive, such as information revealing health conditions, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or biometric or genetic data.
Criminal records data refers to personal data relating to criminal convictions, offences, or checks carried out to assess an individual's suitability to work with children (such as a Disclosure and Barring Service, or "DBS", check).
Consent refers to agreement that is freely given, specific, informed, and an unambiguous indication of your wishes, given by a clear statement or positive action. You can withdraw your consent at any time.
Data controller refers to an organisation that decides why and how personal data is processed and is responsible for complying with data protection law in respect of that data.
Data processor refers to an organisation that processes personal data only on the instructions of, and on behalf of, a data controller (for example, a supplier who hosts our data for us).
Legitimate interests refer to a lawful basis that allows us to process personal data where we have a genuine business reason to do so, and that reason is not outweighed by any risk or harm to your rights and interests.
Processing refers to anything we do with personal data – collecting, recording, storing, using, sharing, or deleting it, for example.
Aggregated data refers to data that has been combined or summarised so that it no longer identifies any individual.
Anonymised data refers to data that has been processed so that it can no longer be used, directly or indirectly, to identify you.

2. What is our categorisation under data protection law?

Wonders of Maths is the data controller for the personal data described in this Privacy Notice. This means that, whether you interact with us through https://www.wondersofmaths.com, through https://educai.io, by email, by phone or in person, we decide why your personal data is collected and how it is used, and we are responsible for ensuring that it is handled in accordance with data protection law.

We remain the data controller even where a third-party supplier stores or processes personal data on our behalf (for example, where our data is hosted on cloud infrastructure) – those suppliers act only on our instructions, as explained further in section 9.

We are registered with the Information Commissioner's Office ("ICO") as a data controller for the purposes of data protection law. Our ICO registration reference is ZC204913.

What does this mean for you? If you have a question, concern or request about how your personal data is used, you should direct it to us (via our Data Privacy Team, see section 18) – we are the organisation responsible for answering it, not any of our suppliers or the tutors who use our platform.

3. Do we have a Data Protection Officer (“DPO”)?

Organisations are only required to appoint a formal DPO in specific circumstances – for example, where their core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category data. We have considered our processing activities and do not consider that a statutory DPO is required.

However, because we take the protection of your personal data seriously – particularly given that many of our students are children – we have established a dedicated Data Privacy Team. Our Data Privacy Team is responsible for:

overseeing our data protection compliance programme;
advising our staff and tutors on data protection matters;
monitoring our data protection practices and this Privacy Notice; and
acting as the first point of contact for you, and for regulators such as the ICO, on any data protection question or
request.

You can contact our Data Privacy Team using the details in section 18. We keep this arrangement under review and will appoint a statutory DPO if our processing activities ever require it.

4. What data protection principles do we follow?

We follow the data protection principles set out in data protection law in everything we do with your personal data.

These principles are:

Lawfulness, fairness and transparency – we only process personal data where we have a valid lawful basis to do so, and we aim to be open and honest with you about how and why we use it.
Purpose limitation – we collect personal data for specified, explicit and legitimate purposes, and we do not use it in ways that are incompatible with those purposes.
Data minimisation – we only collect and use the personal data that is adequate, relevant and necessary for the purposes we have described in this Privacy Notice.
Accuracy – we take reasonable steps to keep personal data accurate and up to date, and to correct or erase it where it is inaccurate.
Storage limitation – we do not keep personal data for longer than is necessary for the purposes we collected it for (see section 12).
Integrity and confidentiality (security) – we process personal data securely, using appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, and against accidental loss, destruction or damage (see section 13).
Accountability – we take responsibility for complying with these principles, and we are able to demonstrate that compliance including through our external and internal documentation on data protection compliance.

5. Do we carry out risk assessments and keep appropriate policies, procedures and plans in place?

Where necessary, we carry out Data Protection Impact Assessments (“DPIAs”) before starting any processing activity that is likely to result in a high risk to your rights and freedoms – for example, before introducing a new feature on Educai that involves significant use of children’s personal data. A DPIA helps us identify and reduce privacy risks at an early stage.

Where we rely on legitimate interests as our lawful basis for processing (see section 7), we carry out a Legitimate Interests Assessment (“LIA”) where necessary, to check that our interest in processing your personal data is genuine and lawful, that the processing is necessary, and that it does not unfairly override your own interests, rights and freedoms.

We also maintain appropriate policy documents governing how we process special category data and criminal records data – for example, in relation to the DBS checks we carry out on our tutors (see section 7(c)) – and other internal policies, procedures and plans covering information security, data retention, and how we respond to a data breach or a request to exercise your rights.

6. What types of personal data do we collect?

The personal data we collect depends on our relationship with you – for example, whether you are a website visitor, a parent or student, a tutor, another type of supplier, or a job candidate. Section 7 below explains in detail what we collect from each of these groups, how we collect it, why we use it, and who we share it with.

To give you an overview first, here are the general categories of personal data we may collect:

Identity data – such as your first name, last name, username or similar identifier, date of birth, school and year group.
Contact data – such as your postal address, email address and telephone number.
Profile data – such as your account details on Educai, your login credentials, your learning profile assessment answers, tutoring preferences, hobbies and interests, availability, and any preferences you set (such as your marketing preferences).
Special category data – such as health, allergy or additional/Special Educational Needs (“SEN”) information voluntarily shared with us, or, for tutors and certain job candidates, information disclosed as part of a DBS check.
Criminal records data – for tutors, and certain job candidates, the results of DBS checks carried out to assess suitability to work with children.
Financial data – such as bank account or payment card details, processed on our behalf via our payment provider, Stripe, or, for suppliers and tutors, bank details used to pay invoices.
Transaction data – details of payments made to or from you, and the services you have received from us or provided to us (for example, records of tutoring sessions booked and delivered, or invoices raised).
Technical data – such as your Internet Protocol (“IP”) address, browser type and version, device information, operating system, and time zone setting.
Usage data – such as how you use our websites and the Educai platform, including pages visited, session length, click patterns and login history.
Communications and marketing data – records of correspondence with you (including emails, messages and calls), and your marketing preferences.

We may also create aggregated data from the personal data we hold (for example, statistics on the number of tutoring sessions delivered in a month) – see section 17 for more on this.

7. What categories of data subjects do we interact with, and how do we use your data?

Under data protection law, we must have a valid lawful basis to process your personal data. We rely on different lawful bases depending on the context and purpose, and sometimes more than one basis applies at the same time.

The sections below set out, for each category of individual we interact with, what we collect, how we collect it, why we use it and what our legal basis is, and who we share it with.

(a) Are you a website visitor?

If you're here to explore and learn more about Wonders of Maths and Educai – without yet becoming a student, parent, tutor or supplier – here's an overview of the information we collect, how we use it and why.

We collect the following from you:

Technical and usage data – collected automatically through cookies and similar technologies, including your browser type, device, IP address, time zone, and how you navigate our websites (which pages you visit, how long you spend on them, and what you click).
Identity and contact data – if you fill out a contact form, sign up for a newsletter, or otherwise communicate with us, such as your name, email address and phone number.
Communications data – the content of any messages or enquiries you send us, and any response we give.

The way in which we collect this personal data is:

Automatically – using cookies and similar technologies as you browse our websites (see section 16 and our separate Cookie Notice for details and your choices).
Directly from you – when you fill out a form, sign up for a newsletter, or otherwise get in touch.

Our legal basis for processing this personal data is:

Consent – for non-essential cookies, or when you voluntarily submit information to us that we then use to respond to you.
Legitimate interests – in understanding how our websites are used, keeping them secure and running, improving our services, and following up on enquiries you send us.
Legal obligation – in rare cases, such as where you exercise a data protection right and we need to record and act on that.

We share your personal data with the service providers who help us host, run, secure and maintain our websites and the Educai platform (see section 9).

We do not share website visitor data with any third party for their own marketing purposes.

‍
(b) Are you a parent or a student?

Whether you found us through our website, a referral or directly, here's an overview of the information we collect, how we use it and why. Where a student is under 18, references to "you" in the "what we collect" and "how we collect it" sub-sections below cover both the student and their parent/carer, and the parent/carer is responsible for
consenting on the student's behalf where consent is our legal basis (see section 8).

We collect the following from you:

Identity and contact data – the student's name, date of birth, school and year group; and the name, address, email address and phone number of the student and, where applicable, their parent or carer.
Learning profile assessment data – how you heard about us, favourite subject, how much you read, whether you like the sciences, your maths set/group, your hobbies, your answers to a behaviours questionnaire, and your answers and working to a maths assessment. We use this to work out your level, build a learning profile, match you with the right tutor, and inform our recommendations for tutoring materials and methods.
Special category data – health, allergy or SEN information, only where a parent/carer or student voluntarily shares it with us, so that we can support the student safely and appropriately.
Photos and video – of students, only where the student (and their parent/carer, if the student is under 18) has consented, used for marketing and promoting our services.
Booking, session and progress data – collected through Educai, including which sessions are booked and attended, tutor notes made during and after each session, materials and homework shared, assessment scores, and progress reports sent to the student and/or their parent/carer.
Financial data – the parent/carer's payment details (such as card details), processed via our payment provider, Stripe, through Educai.
Technical and usage data – collected automatically when you use our website or the Educai platform, including login history and how you navigate the platform.
Communications and marketing data – records of correspondence, any feedback you give us, and your marketing preferences.

The way in which we collect this personal data is:

Directly from you – through our online learning profile assessment, sign-up forms on Educai, or correspondence by phone or email.
Through Educai, during and after tutoring – tutors add session notes, record the service provided, and note any
follow-up needed.
Automatically – technical and usage data collected when you use our website or the Educai platform.

Our legal basis for processing this personal data is:

Performance of our contract with you – most of the data we collect is used to provide our services to you: booking and delivering tutoring, matching you with a suitable tutor, sending progress reports, and processing payment. When you (or your parent/carer) sign up and accept our terms and conditions, you enter into a contract with us, and we need this data to perform it.
Consent – for special category data (such as health or SEN information), for marketing communications, for optional cookies, and for the use of photos/video. Where we rely on consent, you can withdraw it at any time, though withdrawing consent for a service in progress may mean we cannot continue to provide that part of the service.
Legitimate interests – in building a rounded picture of the student to provide the best possible tutoring and to match them with the most suitable tutor; in improving and developing our services (for example, by analysing anonymised or aggregated usage data to see which materials work best); and in inviting feedback to improve our offering.
Legal obligation – in limited circumstances, such as where we need to keep records to comply with our legal or safeguarding obligations, or to respond to a legal reques

We share your personal data with:

The tutor(s) delivering the student's sessions – so they can prepare for and deliver appropriate tutoring.
Stripe – to process payments.
The other service providers – who support the Educai platform and our wider operations, such as our hosting, database and communications providers (see section 9).
Regulators or authorities – where we are legally required to share information, or where necessary to protect a child's welfare (see section 8).

As our tutors work directly with children, we carry out more in-depth checks before and during a tutor's engagement with us than we do for our other suppliers.

We collect the following from you:

Identity and contact data – your name, address, postcode, email address, phone number, and emergency contact details.
Criminal records data – your DBS number and certificate details, obtained as part of our safeguarding checks.
Profile data – your qualifications, experience, interests and hobbies, your availability, and your answers to tutor/student matching questionnaires. This profile information (excluding sensitive details) may be visible to parents and students to help them choose a tutor.
Photos and video – for your tutor profile and for marketing, where you have consented.
Financial data – your bank details, so that we can pay you for tutoring delivered, and any tax/self-employment information relevant to that payment.
Usage and performance data – such as the sessions you deliver, session notes you record, and platform usage, which we may review for quality assurance and safeguarding purposes.

The way in which we collect this personal data is:

Directly from you – when you apply to become a tutor and throughout your engagement with us.
Through third parties – such as for the DBS check and through references or safer-recruitment checks you
consent to.
Automatically – through your use of the Educai platform.

Our legal basis for processing this personal data is:

Performance of our contract with you – to engage you as a tutor, schedule and administer sessions, and pay you for tutoring delivered.
Legitimate interests – in engaging suitable, qualified tutors and matching them appropriately with students, and in maintaining the quality and safety of the tutoring we provide.
Safeguarding obligations – your criminal records data is processed only to assess your fitness and propriety to work with children, under the conditions permitted by law. We maintain an internal policy governing this processing, which is available on request from our Data Privacy Team.
Legal obligation – such as verifying your right to work in the UK and complying with our safeguarding and safer-recruitment obligations.
Consent – for your profile photo/video and any marketing use of your image.

We share your personal data with:

The Educai platform (and, through it, parents and students) – so that you can be matched, scheduled and booked with students.
Our payment and accounting providers – to pay you (see section 9).
Other service providers who support our operations (see section 9).
Where a safeguarding concern arises – the relevant authorities, a student's school, or their parent/carer, as necessary to protect a child.

(d) Are you one of our other suppliers?

This section covers suppliers other than tutors and explains how we handle your (or your employees') personal data.

We collect the following from you:

Identity and contact data – names of your contact persons, their work email addresses, phone numbers and job titles.
Profile data – information about the services you provide, your qualifications or company's service history, and the contracts between us, including the names of signatories.
Financial and transaction data – bank details for payments, tax or VAT identification (if applicable), and records of invoices and payments.
Communications data – emails or correspondence between us, which may be stored in our email systems or project management tools.

The way in which we collect this personal data is:

Primarily directly from you – when we negotiate, execute or fulfil a contract with you.
Occasionally from public sources – such as when checking a company's registration.
Automatically – if you use our website (technical and usage data).

Our legal basis for processing this personal data is:

Performance of our contract with you – to manage the contract, including communicating about the work and paying invoices.
Legitimate interests – in effectively managing our suppliers, keeping records of supplier contacts, and maintaining good working relationships.
Legal obligation – such as retaining financial records for tax purposes, or complying with a legal or regulatory
request.

We share your personal data with:

Internal teams who manage the supplier relationship.
Our payment and accounting providers (see section 9), to process payments to you.
Our professional advisers and, where legally required, regulators or tax authorities.

(e) Are you a job candidate?‍
‍

If you apply for a role or enquire about opportunities, here's an overview of the information we collect, how we use
it and why.

We collect the following from you:

Identity and contact data – your name, email address, phone number and postal address.
Profile data – your employment history, education, qualifications, and any references or cover letter information provided in your CV or application.
Special category data – with your consent, such as health data if you need reasonable accommodations for an interview, or, where we run equal opportunities monitoring, anonymised and optional diversity information.
Criminal records data – for roles that involve working with children, a DBS check, always carried out lawfully, transparently, and with your knowledge and consent.

The way in which we collect this personal data is:

Directly from you – through your application, CV, cover letter, or during an interview.
From third parties – such as referees, recruitment agencies, or background-screening providers, always with your knowledge and consent.

Our legal basis for processing this personal data is:

Consent – by sending us your application, you consent to us using your data for the recruitment process; for any special category data, we rely specifically on your consent.
Contract – to take steps towards a potential employment contract with you, such as evaluating your qualifications and communicating with you about the role.
Legitimate interests – in hiring suitable candidates to grow our business, and in retaining evidence of our recruitment process.
Legal obligation – such as verifying your right to work in the UK.

We share your personal data with:

Recruitment platforms or agencies, where used, which may hold a copy of your application.
Background-screening providers, where a DBS check or similar is required for the role — we will always tell you beforehand.
Our professional advisers – such as when seeking HR or legal guidance.

We treat candidate data with care and only use it for purposes related to recruitment or future employment. If you
are unsuccessful, we will not keep your data for longer than necessary (see section 12). If you become an employee,
your data will form part of your employee record and we will provide you with a separate Employee Privacy Notice.

8. How do we look after children's personal data?

As our services are provided to and used by children, we take particular care with children's personal data, in line with the ICO’s Age Appropriate Design Code (the "Children's Code").

In practice this means:

We only collect the personal data we need to deliver tutoring safely and effectively – we do not ask a child for more information than is necessary.
Where reasonably possible, we present information about how we use children's data in clear, age-appropriate language, rather than dense legal text.
Privacy settings on the Educai platform are set to a high level of protection by default for student profiles.
We do not use children's personal data for behavioural advertising.
We do not carry out profiling of children for commercial purposes – any personalisation (for example, matching a student with a tutor, or recommending tutoring materials) is carried out solely to deliver and improve our tutoring services.

If a tutor or a member of our team becomes concerned about a child's safety or welfare based on information shared with us, we may need to share relevant information with the child's parent/carer, their school, or the appropriate authorities, in order to protect that child's wellbeing. We would only do this where necessary and in accordance with our safeguarding obligations and data protection laws.

9. Who do we share your personal data with?

We only share your personal data when necessary, and we require all third parties to respect its security and to treat it in accordance with data protection law. We put contracts in place with our service providers requiring them to protect your data and to act only on our instructions. We do not sell your personal data, and we do not have any affiliated or group companies with whom we share personal data. Depending on the context, we may share personal data with the following categories of third party:

Accounting and payment providers – our accountants, our banks, our payment processing software (Stripe), and our accounting software (Xero), to manage payments, fees, charges and refunds, and to keep accurate financial records.
Data, hosting and technology providers – Data, hosting and technology providers - Airtable (our spreadsheet/database software), Amazon Web Services (our database and log hosting), Retool (software used internally to view parts of our database), and Sentry (log management software), so that we can run, secure and maintain our systems, the Educai platform, and our websites.
Communication and customer management providers – Communication and customer management providers – such as our CRM, email and messaging tools (for example, Attio, Google and Slack), which support how we manage and communicate about our relationship with you
Educational tools providers – Notability, an annotation application some of our tutors use to support tutoring sessions.
Artificial Intelligence (“AI”) tools – we may use AI assistants, such as Claude (provided by Anthropic), for internal administrative and technical tasks. We take care to limit what personal data, if any, is shared with these tools to what is necessary for that limited purpose, and we do not use AI tools to make decisions about you that have a legal or similarly significant effect.
Employee-related service providers – for our own staff only, providers who support HR administration, healthcare benefits, office space, pensions, and payroll.
Professional advisers – lawyers, accountants and auditors, to obtain advice and ensure compliance with our legal and regulatory obligations. These advisers are bound by confidentiality and data protection obligations.
Regulators and governmental authorities – where we are legally required to provide information, such as to the ICO, HM Revenue & Customs, or, in a safeguarding context, local authorities or the police.

We keep this list of third-party categories under review as our operations evolve.

10. What happens if there is a change to our business?

If Wonders of Maths is ever involved in a merger, acquisition, investment, or sale of the company or its assets, we may need to disclose relevant personal data to prospective buyers, investors or partners as part of the evaluation process (known as due diligence). Any such disclosure would be made under strict confidentiality agreements, and
only to the extent necessary to facilitate the transaction. If another company were to acquire Wonders of Maths, information about our students, parents/carers, tutors and other stakeholders may be transferred so that our services can continue without interruption. In all such scenarios, we would ensure your personal data remains
protected and is only used in accordance with the purposes set out in this Privacy Notice.

11. How do we protect personal data when it is transferred internationally?

Wonders of Maths is based in the United Kingdom (“UK”). However, some of our service providers – for example,
those providing cloud hosting, communications, or payment services – are based outside the UK, or use
infrastructure based outside the UK (including in the United States of America), to provide their services to us.
Whenever we transfer your personal data outside the UK, we ensure it is protected by at least one of the following
safeguards:

Adequacy decisions – we may transfer data to countries that the UK government has officially decided offer an adequate level of data protection, meaning those countries' laws are considered strong enough to protect your rights in a similar way to UK law.
Data transfer agreements – for transfers to countries without an adequacy decision, we use approved data transfer mechanisms, such as the UK International Data Transfer Agreement or the International Data Transfer Addendum to the European Union’s Standard Contractual Clauses, and we carry out a Transfer Risk Assessment where required.
Explicit consent or other permitted grounds – if neither of the above is available for a specific transfer, we would only transfer your data with your explicit consent, or in a situation strictly permitted by law. This is rare, and we would tell you if it applied to you.

We remain responsible for your personal data even when it is transferred abroad, and we only work with third
parties who are also committed to protecting it appropriately.

12. How long do we keep your data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period for different categories of data, we consider the amount, nature and sensitivity of the data; the purposes for which we process it, and whether we can achieve those purposes through other means; and any applicable legal requirements.

In practice, this means:

Student and parent/carer data – we generally keep this for the duration of our relationship with you and for a period afterwards (generally up to 7 years), in case you return to us, to respond to any queries, or to meet our legal and accounting obligations.
Tutor data (including DBS information) – we keep this for the duration of your engagement with us and for as long as necessary afterwards to meet our safeguarding and legal obligations only, after which we securely delete or anonymise it.
Supplier data – we keep contracts and payment records for at least 6 years after the end of the contract, for tax and accounting purposes. General correspondence may be deleted sooner unless needed for business reference.
Job applicant data – if you are unsuccessful, we typically retain your application data for up to 6 months after the recruitment process, in case of any questions or if another suitable role opens up. If we want to keep it for longer, we will ask your permission. Successful applicants will have their data transferred into their employee file and kept in line with our employee data retention standards.
Website enquiry and marketing data – if you contact us through the website but don't go on to engage with our services, we may keep that enquiry for around 1–2 years in case you reach out again, but we can delete it sooner on request. If you've opted in to marketing, we keep your details until you opt out or unsubscribe.

Where we have no ongoing legitimate need or legal requirement to process your personal data, we will ensure it is securely deleted or anonymised. Data that has been fully anonymised is no longer personal data, and we may keep and use it indefinitely for analysis or business planning purposes (see section 17).

13. How do we protect your personal data?

We take information security seriously and have put in place a range of technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include:

Access controls – we limit access to personal data to those staff, tutors, contractors and third-party processors who have a genuine business need to access it, using individual login credentials and role-based access.
Secure infrastructure – we work with reputable hosting providers and take reasonable steps to ensure our systems are configured securely and monitored for suspicious activity.
Organisational measures – our staff and tutors receive guidance on data protection and information security and are bound by confidentiality obligations. Tutors are subject to DBS and other safeguarding checks before they can work with students.
Incident response – despite our best efforts, no system is completely secure. We have a data breach response plan in place, covering how we contain and investigate an incident, mitigate any harm, and notify affected individuals and/or the ICO where we are legally required to do so.

We regularly review and update these measures in line with how our services and the risks we face develop over time.

14. What rights do you have in respect of your personal data?

Under data protection law, you have a number of rights in relation to the personal data we hold about you. Some of these rights apply in all circumstances, while others are qualified and may be subject to conditions or exemptions.

Where a student is under 18, a parent or carer may exercise any of these rights on the student's behalf.

Right to be informed – this Privacy Notice is part of our effort to tell you how we handle your data. If you have any questions about a specific use of your data, please ask us.
Right of access – you can ask us for a copy of the personal data we hold about you, and information about how we process it. We will provide this free of charge, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline.
Right to rectification – if any personal data we hold about you is incorrect or incomplete, you can ask us to correct it. Many basic account details can also be updated by you directly through Educai.
Right to erasure – you can ask us to delete personal data we hold about you. This right is not absolute – for example, if you are a tutor, we may need to retain certain safeguarding records for a set period even if you ask us to delete them, because we have a legal obligation to do so. We will explain what we can and cannot erase at the time of your request.
Right to restrict processing – you can ask us to pause or suppress our use of certain data – for example, while we verify its accuracy, or while we consider an objection you've raised.
Right to data portability – in certain circumstances, you can ask to receive the personal data you provided to us in a structured, commonly used, machine-readable format, or ask us to transfer it to another organisation. This right applies only where our processing is automated and based on your consent or a contract with you.
Right to object – you can object to our processing of your personal data in certain circumstances, including objecting to direct marketing at any time, which we will always act on immediately. You can also object to processing based on our legitimate interests; we will then reconsider our grounds and stop processing unless we
can demonstrate a compelling reason that overrides your rights.
Rights related to automated decision-making – you have the right not to be subject to decisions based solely on automated processing (including profiling) that have a legal or similarly significant effect on you. We do not currently make any such decisions about you.
‍

To exercise any of these rights, please contact our Data Privacy Team (see section 18). We may need to ask you for some information to confirm your identity before fulfilling your request, to make sure we don't disclose data to the wrong person – for example, confirming basic details we hold on file, or asking for ID where appropriate.

We will respond to your request as soon as possible and in any event within one month of receiving it, as required by law. If your request is complex or you've made multiple requests, we may extend this by up to two further months, and we will tell you if that's the case within the first month. There is generally no fee to exercise your rights, unless your request is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline (and we will
explain why).

If you have any concerns about how we handle your data, please contact our Data Privacy Team first, so we have the chance to resolve things directly with you. Under the Data (Use and Access) Act 2025, you are encouraged to raise your complaint with us in this way before contacting the ICO. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office at www.ico.org.uk.

15. How do we use your personal data in our marketing practices?

We may send you marketing communications by email if:

you have specifically requested information from us, or consented to receive marketing (for example, by ticking a box when signing up on our website); or
you are an existing student, parent/carer, or tutor who has engaged with us, and you have not opted out of marketing – in this context, we may rely on a "soft opt-in" or our legitimate interests to tell you about similar services, but we will always give you a clear and easy way to opt out in every communication.

We will not send you third-party marketing, or share your contact details with third parties for their own marketing
purposes, without your explicit consent.

You can ask us to stop sending you marketing at any time, free of charge, by clicking the "unsubscribe" link in any marketing email we send, or by contacting us directly.

16. Do we use cookies and similar technologies?

We, and third parties who provide content or functionality for our websites, use cookies, web beacons and similar technologies to understand how our services are used and to improve them.

Strictly necessary cookies – these are always active, as they are essential for our websites and the Educai platform to function (for example, keeping you logged in).
Analytics and performance cookies – these help us understand how our websites and platform are used, such as which pages are visited and how, so we can improve them.
Functionality cookies – these remember your preferences to give you a more personalised experience.

We only set analytics and other non-essential cookies with your consent, obtained through our cookie banner, which lets you reject non-essential cookies as easily as you can accept them, and you can change your choice at any time.

You can also manage or block cookies through your browser settings, though this may affect how our websites and the Educai platform work.

17. Do we use aggregated or anonymised data?

If we ever combine aggregated data with your personal data in a way that could identify you, we treat the combined data as personal data and protect it in line with this Privacy Notice.

18. How can you get in touch with us?

If there's anything you are unclear about in this Privacy Notice, or you would like to exercise any of your rights, please get in touch with our Data Privacy Team. We genuinely welcome questions, comments and requests regarding our data practices, and we are here to help you feel comfortable with how your information is handled.

Email – info@wondersofmaths.com
Postal address – Data Privacy Team, Wonders of Maths Limited, Kings House, 174 Hammersmith Road, Hammersmith, London, W6 7JP

We take legal compliance seriously and continually strive to maintain the highest standards of privacy protection.

19. How will we notify you of changes to this Privacy Notice?

We regularly review and update this Privacy Notice to reflect changes in our services or legal requirements, and we encourage you to check back from time to time. Where we make significant changes, we will also notify you directly – for example, via email or a prominent notice on our website – before those changes take effect.

We may create and use aggregated data (for example, statistics on the number of tutoring sessions delivered in a month, or average student progress for a particular subject) to help us understand trends and improve our services. Aggregated and anonymised data is not personal data, because it can no longer identify you.