Action Tutoring privacy notice for pupils, parents and guardians participating in the AI tutoring action research in 2026-27

This version of this notice is effective from 1st September 2026.

1. About Action Tutoring

Action Tutoring (we, us, our) is a registered education charity, supporting pupils from disadvantaged backgrounds to achieve a meaningful level of academic attainment, with a view to helping them progress to further education, employment or training. In secondary schools, Action Tutoring particularly focuses on supporting pupils on the grade 3-4-5 borderline in English and maths. We aim to help them achieve a grade 4 and above in maths and English GCSEs. 

2. Purpose of this privacy notice

The current version of this notice is effective from 1st September 2026.

This notice intends to make the following points clear to pupils, parents and guardians the information (data) we ask partner schools to share with us about pupils participating in a tutoring programme as well as the data we gather during the programme:

  • why we ask our partner schools to share information about pupils (section 3.)
  • what information we ask partner schools to share with us (section 4.)
  • where we store the information and who can access it (section 5.)
  • how long we keep the information (section 6.)
  • what information we share with other parties (section 7.)
  • our legal basis for processing the information (section 8.)
  • security of personal information (section 9.)
  • transfers outside of the EEA (section 10.)
  • how to control your information and rights (section 11.)
  • how to contact us (section 12.)

3. Data purpose (why we gather data)

Action Tutoring asks our partner schools to provide information about the pupils they put forward for participation in our tutoring programme, and we collect some additional information independently for the following reasons:

  • to effectively coordinate the delivery of our programme both in school and online;
  • to meet safeguarding responsibilities;
  • to enable the evaluation of our impact and improve future programme delivery;
  • to demonstrate our programme reaches the pupils who need it as defined by our charity’s mission;
  • to grow the delivery capability of our charitable activity.

For pupils participating in our AI tutoring programme, we also process data:

  • to deliver personalised AI-supported tutoring sessions;
  • to generate and review session transcripts for safeguarding and quality assurance purposes;
  • to evaluate the effectiveness of AI tutoring as part of our programme development.

4. Data collection (what data we gather)

Before a pupil officially joins our programme, we ask our partner schools to provide us with the following information about all pupils selected to take part, via a secure online form, password-protected spreadsheet or email encryption software: full name, school, school year, gender, date of birth, unique pupil number, subject ability, Pupil Premium status, indication of if the pupil could access private tutoring (for non-Pupil Premium eligible pupils). We also gather pupil ethnicity and SEND data from our schools, which is special category data. This helps us evaluate the effectiveness of our programmes across different demographic groups. All of the information we collect helps us understand the reach of our programmes and whether our tutoring is impacting all of our pupils equally.

During the programme, we will independently record: pupil attendance and engagement, pupil assessment results, pupil survey responses.

For pupils taking part in our AI tutoring programme, we collect the following additional data:

  • session transcripts — a complete record of the messages exchanged between the pupil and the AI tutor during each session;
  • performance data — progress, scores and engagement recorded within sessions.

Pupils type their messages directly into the AI tutoring tool. We ask pupils not to share personal information about themselves or others during sessions. However, transcripts may sometimes contain personal information shared incidentally by a pupil, or in some cases a safeguarding disclosure. Where this occurs, the information is handled securely in line with our safeguarding procedures.

5. Data storage and access (where we store the information and who can access it)

We operate a central database, Salesforce, to help us securely store pupil information. The database is password-protected and access to the database is limited to Action Tutoring staff.

Schools submit data online, and their responses are stored on the web platform FormAssembly. Additionally, when pupils complete assessments or surveys online, their names, results, and responses are also stored in FormAssembly. Occasional use is made of other transmission mechanisms, but only where appropriate security measures are in place.

Information about pupils may also be recorded in other formats, such as in emails, word processing and spreadsheet applications. Information in these formats may be stored on Action Tutoring devices or in Google Workspace applications such as our Google Drive cloud storage. Access to these devices and cloud applications is password-protected and restricted to Action Tutoring staff.

Where special category data is collected, access is limited to those who need to use that data for its intended purpose. For example, when ethnicity is collected, access to identifiable data is highly restricted to the evaluation team only.

For the AI tutoring programme, all model inference is served through Amazon Bedrock using EU-hosted model endpoints, so that pupil input is processed within the UK and EEA only and is not transferred to the United States. Amazon Bedrock does not use customer input or output to train or improve any model, and does not share it with the model provider.

Access to session transcripts is restricted to designated staff only, on a least-privilege basis – meaning each person can access only the data they need for their role. Access is managed through a formal process. Staff and contractors who may access pupil transcripts are subject to appropriate DBS and safer recruitment checks.

When the AI tutor generates a response during a session, pupil data is sent via a secure connection to the AI model provider to produce that response. This is described further in section 10.

6. Retention (how long we keep the information)

We work to ensure that your personal data is only retained for the period that Action Tutoring needs it for, or in accordance with laws, regulations and professional obligations that we are subject to.

Pupil records on our central database, Salesforce, containing information provided by our partner schools, alongside additional information we have captured independently, are pseudonymised approximately two academic years after a pupil graduates from the Action Tutoring programme. This involves removal of all information from a record which could be used to identify an individual pupil or their parent/guardian. This process can only be reversed by specific members of the Action Tutoring team and only under reasonable circumstances, such as to facilitate a safeguarding enquiry.

Video/audio recordings, transcriptions, digital records and logs of online tutoring sessions may be kept for up to twelve months after the session took place.

Session transcripts and performance data from the AI tutoring programme are retained by Build Education (the AI tool provider) for up to 12 months after the end of the programme, and then securely deleted. Pupils or their parents/guardians may request deletion of their data at any point before this by contacting us using the details in section 12.

The names, results and responses of pupils who completed assessments or surveys using the webform platform, FormAssembly, will be archived approximately two academic years after a pupil graduates from the Action Tutoring programme.

Our best practice for any pupil and parent/guardian information temporarily stored in other formats, such as word processing or spreadsheet applications, is to delete this information as soon as the purpose for processing the information in the alternative format is complete.

Pupil records on our central database and any related parent/guardian information are deleted or permanently anonymised 10 years after they graduate from the Action Tutoring programme. The anonymisation process cannot be reversed.

If you would like to find out how long any other information is being retained, please contact us via the details provided in section 12 of this policy.

7. Data sharing (what information we share with other parties)

Anonymous and aggregated data relating to pupils may be published on the Action Tutoring website and used in published materials, such as Action Tutoring’s annual report for funders.

For the AI tutoring programme, we share pupil data with the following third parties:

  • Build Education (Build Innovations Ltd) – our technology partner, who operates the AI tutoring platform on our behalf. Build Education processes pupil data only on our instruction, handles only information necessary for the management of the programme (which doesn’t include any special category data) and is bound by a data processing agreement;
  • AI model providers – when the AI tutor generates a response, the pupil’s message is sent to the AI model provider (Anthropic) to produce that response. Anthropic is contractually prohibited from using pupil data to train their models and does not retain it beyond what is needed to generate the tutor’s response;
  • Amazon Web Services (AWS) – provide the hosting and storage infrastructure for the platform.

8. Legal basis (our basis for processing the information)

To lawfully process the information outlined in this notice, we rely on legitimate interests as our lawful basis for processing pupil data. We have a legitimate interest in processing pupil data to deliver effective, personalised tutoring that directly benefits the pupils taking part. This processing is necessary to provide the service – there is no less intrusive way to deliver AI tutoring – and the data collected is limited to what is needed for that purpose.

To lawfully process special category data (ethnicity and SEND data) we rely on substantial public interest (9.2.g): equality of opportunity or treatment under GDPR. This basis is valid as the data is used only for monitoring and evaluation at a population or group level and not for making decisions about an individual pupil. For example, we do not adapt the AI tutoring content differently according to SEND status. Access to this data is limited to staff working on evaluation of the programme.

We have considered the impact of this processing on pupils and their parents/guardians. Because pupils are children, we have applied heightened care, including: restricting data to UK/ EU-based storage; ensuring sessions are monitored; limiting access to transcripts to designated staff; and requiring our technology partner and AI model providers to be contractually bound not to use pupil data for any commercial purpose or model training.

Pupils and their parents/guardians are informed of the processing before the programme begins and may withdraw and request deletion of data at any time.

9. Security of personal information

We take the responsibility for protecting your privacy very seriously and we will ensure your data is secured in accordance with our obligations under the Data Protection laws. We have in place technical and organisational measures to ensure personal information is secured and to prevent your personal data from being accessed in an unauthorised way, altered or disclosed. We have in place a robust access control policy which limits access to your personal data to those employees, contractors and other third parties who only have a business need to know. The processing of your personal data will only take place subject to our instruction.

We have procedures to handle any potential data security breaches. Data subjects, third parties and any applicable regulators will be notified where we are legally required to do so. If you become aware of a potential data breach involving your personal data, please contact us immediately using the details provided at the end of this notice.

For the AI tutoring programme, additional security measures are in place, including:

  • data encrypted in transit (TLS 1.2 or above) and at rest (AES-256);
  • storage in a dedicated, single-tenant environment on AWS infrastructure certified to ISO 27001 and SOC 2;
  • role-based access controls with access logging;
  • Enhanced DBS and safer recruitment checks for any staff who may access pupil transcripts.

In the event of a data breach, Build Education is required to notify us without undue delay and in any event within 72 hours of becoming aware of it. We will in turn notify affected individuals and the ICO where required by law.

10. Transfers outside of the EEA

In this section, we provide information about the circumstances in which your personal data may be transferred and stored in countries outside the European Economic Area (EEA).

We may share personal information to third parties outside of the European Economic Area (EEA). Any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the Data Protection laws.

Where personal data is transferred outside of the EEA to a country without an adequacy decision, we will ensure appropriate safeguards are in place prior to the transfer. These could include Standard Contractual Clauses.

For more information about transfers and safeguarding measures, please contact us using the information in section 12.

Pupil data from the AI tutoring programme is stored in the UK in all cases, model providers are contractually bound not to use pupil data to train their AI models, and not to retain it beyond what is needed to generate the tutor’s response.

11. How to control your information and your rights

Action Tutoring is committed to accommodating your rights under the General Data Protection Regulation, which include:

  • Your right to be fully informed on how the information we ask you to share with us and the information we collect independently is processed by Action Tutoring. If you have any questions about the guidance provided in this policy notice, or would like further detail on specific sections, then please address your query to the contact details provided below.
  • Your right to access the information we have asked you to share with us and the information we collected independently. If you require a copy of this information, please make this request using the contact details provided in this notice and the information will be provided to you in an electronic format as soon as possible, within one month at the latest. We will need to confirm your identity to provide this information.
  • Your right to rectify the information we have asked you to share with us and the information we collected independently if it is inaccurate or incomplete. If you believe that any of the information is inaccurate or incomplete, please contact us as soon as possible using the contact details provided below. We will promptly correct any information found to be incorrect.
  • Your right to erase the information we have asked you to share with us and the information we collected independently. You may request that this information be placed under restricted access, pseudonymised or deleted where there is no compelling reason for it to be kept. However, we may need to retain some information as stated in section 6. Retention – how long we keep the information.
  • Your right to restrict or object to the further processing of the information we have asked you to share with us and the information we collected independently. Please use the contact details provided to inform us of any wish to restrict or object to the further processing of this information. Note that we may need to retain some key information in order to respect your restriction or objection in future.

You may also withdraw participation in the AI tutoring programme at any time without giving a reason. If a pupil withdraws, we will stop processing their data for the purposes of the programme.

Your personal data is not used in any automated decision making (a decision made solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).

12. How to contact us

To contact us in relation to any of the information contained in this policy notice, to make a complaint, to pursue any rights under the General Data Protection Regulation and to contact our DPO, please email: hello@actiontutoring.org.uk

Or write to us at: Action Tutoring, Fivefields, 8-10 Grosvenor Gardens, Victoria, SW1W 0DH

Telephone: 0300 102 0094

If you are unhappy with the way that we have handled your Personal Information, you can make a complaint to the Information Commissioner’s Office (ICO) which is the UK authority responsible for data protection.