Privacy Policy — Parents

Effective date: 5 September 2026 Last updated: 5 September 2026

This policy explains how SMSO Education Ltd ("SMSO Education", "we", "us") handles personal data for parents, including data about your children. A separate policy applies to our tutors.

Please read the section on children's data carefully — most of the information we hold here describes a minor.

1. Who we are

SMSO Education Ltd is the data controller for the personal data described here.

2. What this policy covers

The same policy covers both ways you can reach your SMSO account. They share one account and one database, but they do not collect identical technical data, so the tables below mark which applies where.

Where a row is marked Both, it applies however you sign in.

Your child may also have a sign-in of their own to the mobile app. Section 8 explains what they can see and what we collect from their device.

3. What we collect

Account and identity — Both

• Your name, email address and phone number
• Login credentials for the parent account
• Where a family record has two parent logins, which of the two you signed in as
• Your language preference (English or Vietnamese)

About your children (students) — Both

• Name, student identifier, date of birth, and year or level
• Their school, and an email address and phone number for them where you have given us one
• Academic background where recorded: prior attainment, past exam results, awards, extra-curricular activities and study aims
• Class enrolment and assigned tutors
• Lesson schedules, attendance and lesson status
• Absence requests, reschedule and cancellation requests, and the reasons given
• Study reports and tutor feedback about their progress
• Homework records and lesson notes
• Where your child has their own sign-in: the password they set and their language preference

Billing — Both

• Invoices, invoice line items and payment status
• Billing periods and the lessons each invoice covers
• Invoice PDFs you open or download

We do not collect payment card numbers.

Technical data

Where your child signs in, the App rows also apply to their device: we hold a device identifier and a push notification token for it so we can send them lesson reminders. The Web rows do not apply to them — students use the mobile app only, so we collect no browser data, no cookies and no session replay from a child.

The mobile apps contain no analytics or tracking SDKs. We do not collect advertising identifiers, we do not track you across other apps or websites, and we do not use your data for advertising.

4. Why we use it, and our legal basis

Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal.

5. Who we share it with

We do not sell personal data. We share it only with service providers who process it on our behalf, under contract:

We may also disclose data where required by law, or to establish or defend legal claims.

Where your data is held: the United Kingdom — our application servers and database run in Vultr's London region. Microsoft Clarity and Google process data outside this location; those transfers rely on the UK Extension to the EU–US Data Privacy Framework, which both Microsoft and Google are certified under.

6. Analytics (web only)

The web dashboard uses Microsoft Clarity to understand how the site is used. Clarity records usage data and can replay a reconstruction of your session — pages viewed, clicks, scrolling and mouse movement.

Because those sessions show information about your children, we treat this as sensitive. You can opt out using your browser's Do Not Track setting or a tracker-blocking extension, and you may contact info@smsoeducation.com to ask us to exclude your account.

The mobile app has no analytics or session replay.

7. Cookies and on-device storage

Web — cookies

Strictly necessary cookies cannot be disabled without breaking sign-in. Cookies set by Microsoft Clarity are described in section 6.

App — on-device storage

The mobile app uses no cookies. It stores:

This data stays on your device and is removed when you sign out or uninstall the app. Push notifications require permission, which you grant when asked and can revoke at any time in your device settings.

8. Children's data

Our parent services exist to give you visibility of your own child's tutoring, so most records here describe a minor.

• We collect most children's data from you and from their tutors. Where a child has their own sign-in we also collect some data from them directly: the password they set, their language preference, and the identifier and push token of the device they use.
• Your child may have a sign-in of their own to the mobile app. We create these accounts — a child cannot register themselves. The account is read-only: your child can see their own lessons, attendance, absence requests and schedule changes, and receive lesson reminders. They cannot change any record, submit a request, or see anything about another student.
• We use it only to deliver and evidence tutoring: scheduling, attendance, progress reporting and billing.
• We do not use children's data for marketing, advertising, profiling or automated decision-making, and the mobile app contains no advertising or tracking SDKs.
• Access is limited to the child's assigned tutors, the parents on the family record, the child themselves where they have a sign-in, and SMSO administrative staff who need it.
• You may exercise the rights in section 10 on your child's behalf.

If you believe we hold a child's data without a proper basis, contact info@smsoeducation.com and we will investigate promptly.

9. How long we keep it

We keep financial records for the period required by tax law even after an account closes.

10. Your rights

Subject to UK data protection law (the UK GDPR and the Data Protection Act 2018), you may:

• Access the personal data we hold about you and your children
• Correct data that is inaccurate or incomplete
• Delete data where we no longer have grounds to keep it
• Restrict or object to certain processing
• Port your data to another provider in a machine-readable format
• Withdraw consent where processing relies on it
• Complain to a supervisory authority — the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113

To exercise any of these, email info@smsoeducation.com. We respond within one month; for complex requests we may extend this by up to two further months and will tell you if we do. We may need to verify your identity, and your relationship to the child, before acting.

11. Security

We protect data with encrypted connections, authenticated sessions, role-based access controls that limit tutors to their own students, and restricted administrative access. On mobile, sign-in tokens are held in the device's hardware-backed secure storage. No system is perfectly secure, but we review these controls regularly. If a breach affects your data, we will notify you and the relevant authority as the law requires.

12. Changes

We may update this policy. Material changes will be notified in the app, on the web dashboard, or by email before they take effect. The date at the top always reflects the current version.

13. Contact

Questions, requests or complaints: info@smsoeducation.com SMSO Education Ltd, Suite 66, The Wenta Business Centre, 1A Electric Ave, Enfield, Middlesex, EN3 7XU