How Physics Academy uses your information

1. What this policy covers

This policy applies to the public website, the A-level summer registration flow, the student dashboard, the 1:1 enquiry form, payment processing, email notifications, analytics, and cookies.

2. Information we collect

• Contact details: name, email address, and optional phone number.
• Tutoring details: year group, exam board, goals, message content, registration choices, and lesson preferences.
• Verification data: OTP challenges, verification sessions, and login or registration status.
• Payment data: payment status, payment processor references when online payments are enabled, registration totals, and accounting history. We do not store full card details.
• Technical data: IP address, browser information, device data, page visits, and cookie-related consent choices.
• Communications: enquiry emails, confirmation emails, internal teacher notifications, and support correspondence.

3. Why we use your information

• To respond to enquiries and arrange tutoring.
• To verify your email address and keep your account secure.
• To process registrations, payments, and refunds where applicable.
• To send registration, payment, and enquiry confirmation emails.
• To provide student dashboard access and payment history.
• To maintain audit logs, prevent abuse, and keep the service reliable.
• To comply with legal, accounting, and tax obligations.
• To improve the site and understand how visitors use it.

4. Legal bases

Where UK GDPR applies, we rely on the following lawful bases:

• Contract: to provide tutoring services, manage registrations, and process payments.
• Legitimate interests:to keep the service secure, prevent abuse, handle support, and improve the site.
• Consent: for optional cookies and analytics where required.
• Legal obligation: for accounting, tax, and regulatory records.

5. Who we share data with

We only share information where needed to run the service or comply with the law. This includes:

• Microsoft services used for authentication, storage, and email.
• SharePoint or Azure Tables for storage, depending on the active backend.
• Stripe or manual payment records for payment processing and payment event delivery, depending on the active payment mode.
• Google Analytics for site analytics, when you allow analytics cookies.
• Google AdSense for advertising scripts where enabled.
• Professional advisers, regulators, or authorities where required by law.

When you submit a 1:1 enquiry, the teacher notification address set in ENQUIRY_NOTIFICATION_TO is added as a BCC recipient on the confirmation email so the enquiry can be followed up.

6. Cookies and analytics

We use a small number of cookies and similar technologies to make the site function, remember consent choices, track bookings, and measure performance. Optional analytics only run if you accept them. You can change your choice in the cookie banner or your browser.

• Session and security cookies for login and dashboard flows.
• Consent cookies for remembering your tracking preference.
• Analytics cookies if you opt in.
• Marketing scripts where enabled by your consent settings.

7. Retention

We keep data only for as long as needed to run the service and meet legal obligations. OTP challenges and verification sessions are short-lived. Enquiries, registrations, payment records, and audit data are retained for follow-up, administration, and accounting purposes.

8. Security

We use reasonable technical and organisational safeguards, including access controls, hashed OTP storage, and restricted access to operational data. No system is perfectly secure, but we aim to keep your data protected.

9. Your rights

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate information.
• Request deletion where we are allowed to delete it.
• Object to or restrict certain processing.
• Withdraw consent where consent is the legal basis.

To make a request, contact us at contact@physics.academy. We may need to verify your identity before acting on a request.

10. Children and young people

Our services are designed for school-age learners, including minors. If the student is under 16, a parent or guardian should be involved in the registration and tutoring process. We take care to limit the data we collect to what is necessary for tutoring and administration.

11. International transfers

Some service providers may process data outside the UK. Where that happens, we rely on appropriate safeguards such as contractual protections or equivalent transfer mechanisms.

12. Changes to this policy

We may update this policy when the site, services, or legal requirements change. The latest version will always appear on this page.