Internal Data Protection Policy

Not in the Textbooks
Last updated: 30 October 2026
Document status: Internal business policy

1. Purpose

This policy explains how Not in the Textbooks manages, stores, uses and protects personal information.

It applies to all personal information collected through the website, booking system, lessons, communications and payment arrangements.

The purpose is to protect students, parents and customers and to ensure that personal information is handled responsibly and in accordance with applicable data protection requirements.

2. Data protection responsibility

The person responsible for data protection within the business is:

Charlotte Jones
Trading as Not in the Textbooks
Email: notinthetextbooks@gmail.com

As the business currently operates as a sole-operator service, Charlotte Jones is responsible for managing personal information and responding to data protection requests.

3. Personal information handled

The business may process:

• Student names and contact details.
• Parent and guardian contact details.
• Student ages and relevant educational information.
• Lesson notes and progress records.
• Assessment results and feedback.
• Booking and attendance information.
• Payment references and transaction records.
• Website and technical information.

Only information that is relevant and necessary for the provision and management of services should be collected.

4. Access and confidentiality

Access to student and customer information is restricted to Charlotte Jones.

Personal information must not be shared with unauthorised individuals.

Where a third-party provider needs access to information to deliver a service, access should be limited to what is necessary for that service.

Passwords must be kept secure and must not be shared. Devices used to access student information should be protected with appropriate security measures.

5. Storage and security

Personal information may be held through business systems and service providers, including:

• Hostinger website hosting.
• WordPress website administration.
• Amelia booking and scheduling functionality.
• Stripe payment processing.
• Business email and communication systems.

Reasonable steps must be taken to protect information, including:

• Using strong, unique passwords.
• Enabling multi-factor authentication where available.
• Keeping website software and plugins updated.
• Restricting access to administrative accounts.
• Avoiding unnecessary downloads or copies of student information.
• Storing records in secure locations.
• Removing information when it is no longer required.

6. Use of student information

Student information may be used to:

• Prepare and deliver lessons.
• Monitor learning progress.
• Provide educational feedback.
• Manage bookings and attendance.
• Communicate with students and parents or guardians.
• Process payments.
• Meet legal and administrative obligations.

Student information must not be used for unrelated purposes without an appropriate lawful basis.

Student work, photographs, testimonials or identifiable information must not be used for marketing or promotional purposes without obtaining appropriate permission.

7. Children’s information

Additional care must be taken when handling information about students under 18.

Only information necessary to provide the educational service should be collected.

Parent or guardian contact details should be maintained where appropriate. Requests concerning a child’s information must be considered in light of the child’s age, understanding, applicable law and the authority of the person making the request.

8. Retention and deletion

Information must not be retained indefinitely.

The following categories should be reviewed periodically:

• Student contact and account information.
• Lesson notes and educational progress records.
• Booking and attendance records.
• Parent and guardian communications.
• Financial and transaction records.
• Enquiry information.

Educational records should be retained only for a justifiable period after the student’s last lesson or the end of the service.

Financial records must be retained for the period required by applicable accounting and tax legislation.

When information is no longer required, it should be securely deleted or anonymised where appropriate.

9. Data protection requests

Requests to access, correct, delete or restrict personal information should be sent to:

notinthetextbooks@gmail.com

The business should:

1. Record the date the request was received.
2. Identify the person making the request.
3. Verify identity where reasonably necessary.
4. Establish what information is being requested.
5. Assess whether the request can be fulfilled and whether any legal exceptions apply.
6. Respond within the applicable legal deadline.
7. Keep a record of the request and the response.

The usual legal response period under UK and EU GDPR is one calendar month, where those laws apply. Certain requests may qualify for an extension, subject to the applicable requirements.

Internal service targets may be shorter, but must never replace the legal deadline.

10. Data breaches

A personal data breach may include:

• Sending student information to the wrong recipient.
• Losing a device containing personal information.
• Unauthorised access to student records.
• A compromised email or website account.
• Accidental disclosure of confidential information.
• Loss, alteration or destruction of personal information.

If a breach occurs:

1. Take immediate steps to contain the incident.
2. Secure affected accounts, devices or systems.
3. Establish what information may have been affected.
4. Record the incident and actions taken.
5. Assess the potential risk to affected individuals.
6. Notify affected individuals and the relevant supervisory authority where legally required.

Where UK or EU GDPR applies, a notifiable breach may need to be reported to the relevant authority within 72 hours of becoming aware of it. This requirement depends on the circumstances and applicable law.

11. Third-party providers

Before using a provider that processes personal information, the business should consider:

• What information the provider receives.
• Why the information is needed.
• Where it is stored or processed.
• What security measures are in place.
• Whether appropriate data processing terms are available.
• Whether international transfer safeguards are required.

Relevant provider documentation should be retained for reference.

12. Policy review

This policy should be reviewed at least annually and whenever there are significant changes to the business, website, booking systems, payment services or personal information collected.

Policy owner: Charlotte Jones
Business: Not in the Textbooks
Contact: notinthetextbooks@gmail.com