Last updated: 9 October 2026
AB Tutor Limited (“AB Tutor Limited”, “we”, “us”), is committed to protecting your personal data. This policy explains what personal data we collect, why, and your rights. It is written to meet the requirements of the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Looking for information about student data? When schools use the AB Tutor product, the school is the data controller for student data. Which documents apply depends on how AB Tutor is deployed — see section 2 below. Cloud service: Student Privacy Notice — Cloud Service and Data Processing Agreement — Cloud Service. On-premise installations: Student Privacy Notice — On-Premise and Data Processing Agreement — On-Premise. US schools should also see our Children’s Privacy Notice (COPPA) for the relevant deployment (cloud / on-premise).
AB Tutor Limited
Unit E, Argent Court, Hook Rise South, Surbiton, KT6 7NL
Company number: 05414558
ICO registration number: Z9479530
We have appointed a Data Protection Officer, Jayne James, who can be contacted at support@abtutor.com (mark your message FAO: Data Protection Officer) or by post at the address above. All privacy queries, requests and complaints are handled through support@abtutor.com.
This policy covers the personal data for which we are the controller: data about our customers, website visitors, trial users and people who contact us. It does not cover student data processed on behalf of schools (see the note above and section 2).
AB Tutor is sold in two forms, and they are very different from a data protection point of view.
Cloud service. We host the service for the school in our regional infrastructure. Student and class data passes through, and is stored on, systems we operate. For that data the school is the controller and we are the school’s processor; our obligations to the school are set out in the Data Processing Agreement — Cloud Service.
On-premise installations. The school runs AB Tutor on infrastructure it controls, within its own local network — that is the supported configuration. Monitoring data is written to storage the school controls, and stays there. We do not receive, store or have access to it, and we cannot reach into an installation; the on-premise product also does not integrate with Google Workspace or Microsoft Entra ID, so no directory data is exchanged. The only things the software sends us are the feature-usage telemetry described in section 3 and licence checks.
In normal operation we are therefore not a processor (as defined under UK data protection legislation) of student data at all — we are a software supplier. However, if a school’s staff disclose material to us in connection with a support request, that material may contain a student’s personal data (we ask that it is not sent), and we would be a processor in that situation. Feature-usage telemetry is a further example of information we receive; because it does not identify any individual, we are not a processor in respect of it either.
Where a school chooses to have a third party host or remotely manage its installation, that provider acts for the school under the school’s own arrangements, not for us. See the Data Processing Agreement — On-Premise.
For both on-premise and cloud deployments, where we act as a processor, the school is the controller and you should consult the school’s privacy notice for more information about how they use your data. This policy covers the personal data for which we are the controller — our customers, website visitors, trial users and people who contact us.
Both the cloud service and the on-premise software report usage telemetry to us: counts of which product features are used, sent with the licence key or school name so that a count can be attributed to an installation.
Telemetry contains no personal data. It records that a feature was used, not who used it — there are no user names, user identifiers, device identifiers, IP-based identifiers retained at the endpoint, or content of any kind. Because it identifies an organisation rather than an individual, it is not personal data under the UK GDPR; it is not “anonymised personal data” either, since personal data is never collected in the first place. We use it only to understand which features are worth maintaining, and we do not sell it, share it or combine it with anything else. No IP address is retained at the telemetry endpoint. Schools that would prefer the software not to report feature usage can have it switched off — contact support@abtutor.com.
| Category | Examples | Source |
|---|---|---|
| Contact and account details | Name, work email address, phone number, organisation, job role | You, when you create an account, request a trial or contact us |
| Licensing and purchase information | Products licensed, licence keys, order history, billing details | You / generated when you purchase |
| Payment data | Card details are collected and processed by our payment provider, Worldpay — we do not store full card numbers | You, via Worldpay’s checkout |
| Technical data | IP address, browser type and language, access times, referring URLs, device information | Automatically, when you use our website or cloud service |
| Account activity | Registrations, activations, licence verifications, admin console logins | Automatically, when you use the service |
| Support communications | Emails, support tickets, chat transcripts | You, when you contact support |
| Marketing preferences | Opt-in/opt-out status | You |
We do not collect special category data about customers or website visitors, and we do not use personal data for automated decision-making with legal or similarly significant effects.
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing the AB Tutor software and cloud service, managing licences and accounts | Contract (Art. 6(1)(b)) |
| Processing payments and maintaining financial records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Responding to support requests and enquiries | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for pre-sales enquiries |
| Service security, fraud prevention, debugging and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Sending service and licensing notices (renewals, security updates) | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails about our products | Consent (Art. 6(1)(a)); you can withdraw at any time via the unsubscribe link or support@abtutor.com |
| Complying with legal obligations and requests from authorities | Legal obligation (Art. 6(1)(c)) |
We never sell personal data. We share it only with:
A current list of sub-processors used for school/student data is maintained in our Data Processing Agreement.
We are a UK company. Cloud service data is hosted in the Linode cluster for the school’s region (EU for UK/EU schools, US for US schools, Australia for Australian schools), so most customers’ data stays in or near their own jurisdiction. Transfers from the UK to the EU are covered by the UK’s adequacy regulations for the EEA. Where personal data is otherwise transferred outside the UK or EEA (for example to a US-based email or support provider), we rely on:
In practice: our licensing system (AWS Ireland), helpdesk (Crisp, EU) and cloud service hosting for UK/EU customers (Linode EU) keep data in the UK/EEA. Marketing data is processed by Mailchimp (Intuit Inc.) in the US. Intuit participates in the EU–US Data Privacy Framework and its UK Extension for non-HR data — that is, personal data other than its own employees’ — which is the category our marketing contact data falls into, so we rely on that certification for this transfer.
| Data | Retention |
|---|---|
| Customer account and licensing data | For the life of the account, then deleted after 4 years of inactivity |
| Financial and tax records | 6 years, as required by law |
| Support tickets | 3 years from ticket closure |
| Website technical logs | 12 months |
| Marketing data | Until you withdraw consent. We ask you to re-confirm your consent every 24 months and stop sending marketing if you do not |
Deletion requests are actioned within 30 days. Deleted data may persist in encrypted backups for up to 20 further days before being overwritten.
We maintain appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, and a written information security programme with regular review. AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials.
We use cookies only where necessary to operate our services. We use no advertising, analytics or tracking cookies of any kind, and we do not show a cookie consent banner because none of our cookies require consent under the Privacy and Electronic Communications Regulations (PECR):
Under the UK GDPR you have the right to:
To exercise any right, email support@abtutor.com. We will respond within one month. We may need to verify your identity first. These rights are not absolute and exemptions may apply; if we refuse a request we will explain why.
If you are a student, parent or school staff member and your data is processed through a school’s use of AB Tutor, please contact your school in the first instance — the school is the controller and we will support them in responding.
You have the right to complain to us about how we use your personal data.
How to complain: email support@abtutor.com with the word “complaint” in the subject line if possible — though we will treat any expression of dissatisfaction about our use of your personal data as a complaint, however you raise it. You can also write to us at the address in section 1.
We will acknowledge your complaint within 30 days of receipt, investigate it without undue delay, keep you informed of progress, and tell you the outcome.
You also have the right to complain at any time to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113. You do not need to complain to us first, though we would welcome the chance to resolve your concerns.
EU/EEA: If you are in the EU, the EU GDPR applies alongside this policy and you may complain to your local supervisory authority as well as the ICO. We are appointing a representative in the EU under EU GDPR Art. 27; their details will be published here once engaged.
Australia: If the Privacy Act 1988 (Cth) applies to your data, we handle it in accordance with the Australian Privacy Principles. Data for Australian customers of the cloud service is hosted in Australia; limited personal data is disclosed overseas to our service providers in the UK (business email, Microsoft 365, UK tenant residency) and the EU (helpdesk, Crisp; licensing, AWS Ireland) as described in section 6. You may complain to us at support@abtutor.com and to the Office of the Australian Information Commissioner (oaic.gov.au).
United States: Student data is covered by our Children’s Privacy Notice (COPPA) — Cloud Service and Children’s Privacy Notice (COPPA) — On-Premise. Where a state law imposes specific requirements on our contracts with schools, we agree those terms with the school.
We will post any changes on this page and update the “Last updated” date. Material changes will be notified to account holders by email.
support@abtutor.com — for all privacy queries, rights requests and complaints.
