Privacy policy
AB Tutor Privacy Policy
Last updated: 9 October 2026
AB Tutor Limited (“AB Tutor Limited”, “we”, “us”), is committed to protecting your personal data. This policy explains what personal data we collect, why, and your rights. It is written to meet the requirements of the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Looking for information about student data? When schools use the AB Tutor product, the school is the data controller for student data. Which documents apply depends on how AB Tutor is deployed — see section 2 below. Cloud service: Student Privacy Notice - Cloud Service and Data Processing Agreement - Cloud Service. On-premise installations: Student Privacy Notice - On-Premise and Data Processing Agreement - On-Premise. US schools should also see our Children’s Privacy Notice (COPPA) for the relevant deployment: (cloud / on-premise).
1. Who we are
AB Tutor Limited
Unit E, Argent Court, Hook Rise South, Surbiton, KT6 7NL
Company number: 05414558
ICO registration number: Z9479530
We have appointed a Data Protection Officer, Jayne James, who can be contacted at support@abtutor.com (mark your message FAO: Data Protection Officer) or by post at the address above. All privacy queries, requests and complaints are handled through support@abtutor.com.
This policy covers the personal data for which we are the controller: data about our customers, website visitors, trial users and people who contact us. It does not cover student data processed on behalf of schools (see the note above and section 2).
2. How AB Tutor is deployed - and why it matters
AB Tutor is sold in two forms, and they are very different from a data protection point of view.
Cloud service. We host the service for the school in our regional infrastructure. Student and class data passes through, and is stored on, systems we operate. For that data the school is the controller and we are the school’s processor; our obligations to the school are set out in the Data Processing Agreement - Cloud Service.
On-premise installations. The school runs AB Tutor on infrastructure it controls, within its own local network - that is the supported configuration. Monitoring data is written to storage the school controls, and stays there. We do not receive, store or have access to it, and we cannot reach into an installation; the on-premise product also does not integrate with Google Workspace or Microsoft Entra ID, so no directory data is exchanged. The only things the software sends us are the feature-usage telemetry described in section 3 and licence checks.
In normal operation we are therefore not a processor (as defined under UK data protection legislation) of student data at all - we are a software supplier. However, if a school’s staff disclose material to us in connection with a support request, that material may contain a student’s personal data (we ask that it is not sent), and we would be a processor in that situation. Feature-usage telemetry is a further example of information we receive; because it does not identify any individual, we are not a processor in respect of it either.
Where a school chooses to have a third party host or remotely manage its installation, that provider acts for the school under the school’s own arrangements, not for us. See the Data Processing Agreement - On-Premise.
For both on-premise and cloud deployments, where we act as a processor, the school is the controller and you should consult the school’s privacy notice for more information about how they use your data. This policy covers the personal data for which we are the controller - our customers, website visitors, trial users and people who contact us.
3. Service telemetry
Both the cloud service and the on-premise software report usage telemetry to us: counts of which product features are used, sent with the licence key or school name so that a count can be attributed to an installation.
Telemetry contains no personal data. It records that a feature was used, not who used it - there are no user names, user identifiers, device identifiers, IP-based identifiers retained at the endpoint, or content of any kind. Because it identifies an organisation rather than an individual, it is not personal data under the UK GDPR; it is not “anonymised personal data” either, since personal data is never collected in the first place. We use it only to understand which features are worth maintaining, and we do not sell it, share it or combine it with anything else. No IP address is retained at the telemetry endpoint. Schools that would prefer the software not to report feature usage can have it switched off - contact support@abtutor.com.
4. What personal data we collect
| Category | Examples | Source |
|---|---|---|
| Contact and account details | Name, work email address, phone number, organisation, job role | You, when you create an account, request a trial or contact us |
| Licensing and purchase information | Products licensed, licence keys, order history, billing details | You / generated when you purchase |
| Payment data | Card details are collected and processed by our payment provider, Worldpay — we do not store full card numbers | You, via Worldpay’s checkout |
| Technical data | IP address, browser type and language, access times, referring URLs, device information | Automatically, when you use our website or cloud service |
| Account activity | Registrations, activations, licence verifications, admin console logins | Automatically, when you use the service |
| Support communications | Emails, support tickets, chat transcripts | You, when you contact support |
| Marketing preferences | Opt-in/opt-out status | You |
We do not collect special category data about customers or website visitors, and we do not use personal data for automated decision-making with legal or similarly significant effects.
5. Why we process it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing the AB Tutor software and cloud service, managing licences and accounts | Contract (Art. 6(1)(b)) |
| Processing payments and maintaining financial records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Responding to support requests and enquiries | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for pre-sales enquiries |
| Service security, fraud prevention, debugging and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Sending service and licensing notices (renewals, security updates) | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails about our products | Consent (Art. 6(1)(a)); you can withdraw at any time via the unsubscribe link or support@abtutor.com |
| Complying with legal obligations and requests from authorities | Legal obligation (Art. 6(1)(c)) |
6. Who we share it with
We never sell personal data. We share it only with:
- Amazon Web Services (AWS) - hosting for our website and licensing system (abtutor.com), in the AWS Ireland (eu-west-1) region.
- Linode (Akamai) - hosting for the AB Tutor cloud service, in three regional clusters: EU, US and Australia. School and student data is held in the cluster serving the school’s region (see our Data Processing Agreement).
- Microsoft 365 - our business email, through which service and support correspondence flows. Tenant data residency: UK.
- Mailchimp (Intuit) - marketing email delivery, only where you have consented to marketing. Mailchimp is US-based; see section 7.
- Worldpay - payment processing. See Worldpay’s privacy policy.
- Crisp (Crisp IM SAS, France) - our helpdesk and support chat. Support conversation data is hosted in the EU (Netherlands/Germany). See Crisp’s privacy policy.
- Professional advisers and authorities - where required by law or to protect our legal rights.
A current list of sub-processors used for school/student data is maintained in our Data Processing Agreement.
7. International transfers
We are a UK company. Cloud service data is hosted in the Linode cluster for the school’s region (EU for UK/EU schools, US for US schools, Australia for Australian schools), so most customers’ data stays in or near their own jurisdiction. Transfers from the UK to the EU are covered by the UK’s adequacy regulations for the EEA. Where personal data is otherwise transferred outside the UK or EEA (for example to a US-based email or support provider), we rely on:
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
- the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified.
In practice: our licensing system (AWS Ireland), helpdesk (Crisp, EU) and cloud service hosting for UK/EU customers (Linode EU) keep data in the UK/EEA. Marketing data is processed by Mailchimp (Intuit Inc.) in the US. Intuit participates in the EU–US Data Privacy Framework and its UK Extension for non-HR data - that is, personal data other than its own employees’ - which is the category our marketing contact data falls into, so we rely on that certification for this transfer.
8. How long we keep it
| Data | Retention |
|---|---|
| Customer account and licensing data | For the life of the account, then deleted after 4 years of inactivity |
| Financial and tax records | 6 years, as required by law |
| Support tickets | 3 years from ticket closure |
| Website technical logs | 12 months |
| Marketing data | Until you withdraw consent. We ask you to re-confirm your consent every 24 months and stop sending marketing if you do not |
Deletion requests are actioned within 30 days. Deleted data may persist in encrypted backups for up to 20 further days before being overwritten.
9. Security
We maintain appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, and a written information security programme with regular review. AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials.
10. Cookies
We use cookies only where necessary to operate our services. We use no advertising, analytics or tracking cookies of any kind, and we do not show a cookie consent banner because none of our cookies require consent under the Privacy and Electronic Communications Regulations (PECR):
- Authentication and session cookies on abtutor.com (licence management) and on the AB Tutor cloud service - strictly necessary; they keep you signed in and secure your session, and expire when you sign out or your session ends.
- Support chat cookies (Crisp) - our website support chat is provided by Crisp. Chat session cookies are set only when you open or interact with the chat, so that your conversation continues between pages. They exist solely to provide the chat you have requested. See Crisp's privacy policy.
11. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict processing in certain circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability - receive data you provided to us in a structured, machine-readable format;
- withdraw consent at any time, where processing is based on consent;
- make a complaint at any time (for more information see below under section 12).
To exercise any right, email support@abtutor.com. We will respond within one month. We may need to verify your identity first. These rights are not absolute and exemptions may apply; if we refuse a request we will explain why.
If you are a student, parent or school staff member and your data is processed through a school’s use of AB Tutor, please contact your school in the first instance - the school is the controller and we will support them in responding.
12. Complaints
You have the right to complain to us about how we use your personal data.
How to complain: email support@abtutor.com with the word "complaint" in the subject line if possible - though we will treat any expression of dissatisfaction about our use of your personal data as a complaint, however you raise it. You can also write to us at the address in section 1.
We will acknowledge your complaint within 30 days of receipt, investigate it without undue delay, keep you informed of progress, and tell you the outcome.
You also have the right to complain at any time to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113. You do not need to complain to us first, though we would welcome the chance to resolve your concerns.
13. Additional information by region
EU/EEA: If you are in the EU, the EU GDPR applies alongside this policy and you may complain to your local supervisory authority as well as the ICO. We are appointing a representative in the EU under EU GDPR Art. 27; their details will be published here once engaged.
Australia: If the Privacy Act 1988 (Cth) applies to your data, we handle it in accordance with the Australian Privacy Principles. Data for Australian customers of the cloud service is hosted in Australia; limited personal data is disclosed overseas to our service providers in the UK (business email, Microsoft 365, UK tenant residency) and the EU (helpdesk, Crisp; licensing, AWS Ireland) as described in section 6. You may complain to us at support@abtutor.com and to the Office of the Australian Information Commissioner (oaic.gov.au).
United States: Student data is covered by our Children's Privacy Notice (COPPA) - Cloud Service and Children's Privacy Notice (COPPA) - On-Premise. Where a state law imposes specific requirements on our contracts with schools, we agree those terms with the school.
14. Changes to this policy
We will post any changes on this page and update the “Last updated” date. Material changes will be notified to account holders by email.
15. Contact
Email support@abtutor.com - for all privacy queries, rights requests and complaints.
Data Processing Agreement - Cloud Service: AB Tutor - Data Processing Agreement Cloud Service
Data Processing Agreement - On-Premise: AB Tutor - Data Processing Agreement - On-Premise Installations
Student Privacy Notice - Cloud Service: AB Tutor - Student Privacy Notice - Cloud Service
Student Privacy Notice - On-Premise: AB Tutor - Student Privacy Notice - On-Premise Installations
Children's Privacy Notice (COPPA) - Cloud Service: AB Tutor - Children's Privacy Notice (COPPA) - United States - Cloud Service
Children's Privacy Notice (COPPA) - On-Premise: AB Tutor - Children's Privacy Notice (COPPA) - United States - On-Premise Installations