1. Who we are and who controls your data
The data controller is FUTURE SKILLS ACADEMY ONLINE LTD
Registered in England and Wales, company number 12841661
Registered office 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom
We operate the website futureskill.online
Arabic at the root, English at futureskill.online/en/
UK registered trade mark UK00003917995
2. How to contact us about privacy
Email info@futureskill.online
Phone and WhatsApp, the same number +44 20 8187 0212
Direct WhatsApp link https://wa.me/442081870212
Contact hours: Monday to Friday, 09:00 to 16:00 UK time.
Any request about your data or your child's data reaches the person responsible for data protection through the same email. Putting the word "privacy" in the subject line is enough.
Our acknowledgement times are fixed and published:
- A safeguarding concern is acknowledged within one working day
- Any other complaint, including a privacy complaint, is acknowledged within two working days
An acknowledgement is not a substantive reply. The deadline for a substantive reply to a rights request is in section 12.
3. Our registration with the supervisory authority
We are registered with the UK Information Commissioner's Office, which is the supervisory authority for data protection and the authority you may complain to if you are unhappy with how we handle your data Information Commissioner's Office (ICO)
Registration reference ZB210326
Registration tier Tier 1
Date of registration: 21 September 2021.
Registration current until: 20 September 2027.
How to complain is set out in section 13.
4. The law that applies to us
Two regimes apply to your data at the same time:
- The UK General Data Protection Regulation and the Data Protection Act 2018, because the controller is established in the United Kingdom:
UK GDPR / Data Protection Act 2018
- The EU General Data Protection Regulation, which applies separately because we offer our services to families resident in the European Union:
EU GDPR, Article 3(2)
We also design the service with the UK children's code in mind, because our service is likely to be accessed by children ICO Age Appropriate Design Code (Children's Code)
In practice that means we collect as little data about a child as we can, we default to the most protective settings, and we never use a child's data for advertising.
5. What we actually collect
We split this in two, so you can see exactly what is yours and what is your child's.
5.1 Parent data
- Name
- Email address
- WhatsApp number
- Country of residence
- Your website account and your booking and lesson history
- Purchase and receipt records: the amount, the currency shown to you, the date, and a reference from the payment processor
- Your messages to us by email, WhatsApp or website forms
- Limited technical data about your visit to the site:
your internet protocol (IP) address, login data, browser type and version, time zone setting and location, operating system and device type.
Your card details never reach us and we do not store them. The card is entered directly on the payment processor's page, and all we receive back is confirmation that the payment succeeded and its reference. The card is not stored for later charges, and nothing renews automatically. An email receipt carrying the company name and company number is sent to you as soon as the purchase completes.
We operate no credit or balance system, and no validity period attaches to anything. An unused part of a package is refunded to the original payment method under the refund policy, so there is no balance data for us to hold.
5.2 Child data
This list is identical to the one in the safeguarding policy, word for word:
- First name
- School grade and curriculum
- Notes the parent writes for the teacher
- Attendance and progress records
- Audio and video during the live lesson only, with no copy of either retained, under section 14
Please do not put health information or a medical diagnosis in the notes field unless it is genuinely needed to help your child. If you choose to, we rely on your explicit consent, and you can withdraw it and ask us to delete it at any time.
A child does not open an account, does not buy anything, and is never asked for payment details. The account is yours, and it can hold several child profiles. If we find an account that a child opened without a parent, we suspend it and delete the data.
5.3 Teacher applicant data
If you apply to teach with us, we collect what you enter in the application form: your name, email and WhatsApp number; your country, city and time zone; the subjects, curricula, stages and languages you teach; your experience and qualification; your expected hours and introduction; your intro video link if you send one; and the CV and certificate you attach. We use them only to assess your application and to contact you about it.
6. Why we collect each category, and the lawful basis for each one
Each category has its own specific lawful basis, not a single shared one. This table gives the basis category by category.
| What we collect | Why | Lawful basis |
|---|---|---|
| Parent name, email, country | To open the account and identify the contracting party, who must be 18 or over | Performance of your contract, Article 6(1)(b) |
| WhatsApp number | To confirm slots, send the lesson link, remind you before it, and notify you when a daylight saving shift changes the lesson time in your own time zone | Performance of your contract, Article 6(1)(b) |
| Child's first name, school grade and curriculum | To assign the right teacher, pitch the lesson to the child's grade and curriculum, and tell your children apart for their teacher when your account has more than one child | Performance of the contract we hold with you for your child, Article 6(1)(b). The child is not a party to the contract, and the basis here is your contract, not the child's consent |
| Notes the parent writes for the teacher | To adapt the lesson to the child's needs | Performance of the contract, Article 6(1)(b). If a note contains health information, the basis is your own explicit consent, Article 6(1)(a) together with Article 9(2)(a) |
| Attendance and progress records | To count the lessons used from the package and to show you your child's progress | Performance of the contract, Article 6(1)(b) |
| Audio and video during the live lesson | To deliver the lesson itself, which cannot be given live without them | Performance of the contract, Article 6(1)(b). None of this stream is recorded or retained |
| Purchase and receipt records | To complete the purchase and issue the receipt | Performance of the contract, Article 6(1)(b) |
| Keeping accounting records after the relationship ends | Our duty to keep books under UK obligations | Legal obligation, Article 6(1)(c) |
| Your messages to us | To answer you, to record what was agreed, and to handle complaints | Legitimate interests in providing documented support, Article 6(1)(f) |
| Technical and login logs | Security of the site, prevention of fraud and account misuse | Legitimate interests in protecting the service and your accounts, Article 6(1)(f) |
| A copy of the order receipt for a review platform | Inviting you once to review our service on an independent platform | Legitimate interests in gathering genuine feedback on our service, Article 6(1)(f); you can object to it |
| Analytics data, if any | To see which pages help and improve the site | Your consent through the cookie banner, Article 6(1)(a) |
| Teacher applications and their attachments | To assess the application and contact you about it | Steps taken at your request before entering into a contract, Article 6(1)(b) |
| Disclosure to authorities on a binding legal request | To comply with a legal obligation | Legal obligation, Article 6(1)(c) |
"Legitimate interests" means we have a genuine business reason, that we weighed it against your privacy before relying on it, and that you may object as set out in the rights section.
Whether we send marketing emails about new courses at all No. We do not send marketing emails and we do not keep a marketing list.
If that list exists, its only basis is your consent, Article 6(1)(a), you may withdraw it at any time, and no child is ever added to it.
7. Children's data, and why the consent is the parent's and not the child's
The purchaser must be 18 or over and contracts on behalf of the child. The child is not a party to the contract, holds no account, buys nothing, and is never asked for payment details.
So we say it plainly:
- The consent we rely on is yours as the parent. The child is not asked to consent to anything, and we do not treat a child's silence or attendance at a lesson as consent
- You provide the data about your child, and you give consent where consent is the basis
- You exercise your child's rights on their behalf while they are young, bearing in mind that as the child grows their own view about their data carries weight
- You can withdraw any consent at any time. Withdrawal does not interrupt your child's lessons, and it does not make earlier processing unlawful
We do not show children advertising, do not sell their data, do not profile them for marketing, and do not ask the child for extra information during the lesson.
8. How long we keep each category
We keep each category for as long as the purpose needs, then delete it or strip it of anything identifying. The concern-record period is the same as the one in the safeguarding policy.
| Category | Retention |
|---|---|
| Parent account and child profiles | For as long as you use the service, then only as long as necessary for the purposes we collected it for |
| Purchase records, receipts and accounting books | Six years after you stop being a customer, because the law requires us to keep them for tax purposes |
| Parent notes for the teacher, attendance and progress records | For as long as necessary for the purpose it was collected for |
| Support messages and WhatsApp threads | For as long as necessary for the purpose it was collected for |
| Analytics data, if any | We do not collect analytics data at present |
| Marketing list data, if any | Until you withdraw consent, after which we keep a minimal record proving you opted out |
| Teacher applications and their attachments | An application we do not accept is deleted with its attachments three months after our decision |
| Security and access logs | For as long as necessary for the purpose it was collected for |
The live audio and video of a lesson is not retained at all. Nothing survives a lesson once it ends.
9. Who we share your data with
We do not sell your data or your child's data, we do not rent it, and we do not share it with advertisers. We share it only with the following categories, and only as far as needed:
- The payment processor, to take the payment and issue the receipt. Your card details reach it directly from you, not from us
- The video platform, Google Meet, to hold the lesson itself. The participant name, audio and video pass through it during the lesson
- The email service provider, to send booking confirmations, receipts, reminders and time change notices
- The website and database hosting provider, to run the site and store your account
- The teacher assigned to your child, who sees the child's first name, school grade and curriculum, your notes, and the attendance and progress record. The teacher sees no payment data, is bound by confidentiality, and may not use the child's data outside the lesson
- An independent review platform (Trustpilot), to send you one invitation to review our service after a purchase. It receives a copy of the order receipt (your name, email and order details), never your child's name or your card number, and you are free not to leave a review
- Public authorities, where there is a legal obligation or a binding order, and only to the extent required
The categories of third parties we may share your data with service providers acting as processors, based in the EEA and elsewhere, who provide IT and system administration services; professional advisers based in the United Kingdom, including lawyers, bankers, auditors, insurers and accountants; and HM Revenue & Customs, regulators and other authorities where the law requires it.
Each of these processes data on our behalf under a written contract that limits it to our purpose and requires it to protect the data.
10. International transfers
Our families live in the Gulf and in Europe. Our teachers are based in Egypt, Saudi Arabia, Syria, Lebanon, Kuwait and the United Arab Emirates. Some of our technical providers hold data on servers outside the United Kingdom. So some of your data crosses borders.
When it does, we rely on one of these safeguards:
- A UK adequacy decision recognising that the receiving country protects data adequately
- Or the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses:
UK IDTA / UK Addendum to the EU SCCs
- And, for transfers governed by the EU regulation, the EU Standard Contractual Clauses:
EU Standard Contractual Clauses
For every transfer we assess the risk in the destination country and add measures such as encryption where needed. Write to us and we will give you a copy of the safeguard relied on for a transfer that concerns you.
11. Cookies
Cookies are small files the site places on your device so it can remember certain things. We use these categories:
- Strictly necessary: the site does not work without them. They keep you logged in, hold your booking, and protect forms against fraud. No consent is needed for these
- Preferences: they remember whether you view the site in Arabic or English, and the currency your prices are shown in
- Analytics: we do not use any at present.
- Marketing and advertising:
We do not use any marketing or advertising cookies.
We currently use only strictly necessary cookies, so no consent banner is shown. If we ever add a cookie that is not necessary, we will ask for your consent before it runs. You can delete or block cookies at any time in your browser settings. The list of cookies actually in use and how long each lasts the sign-in cookie for your account (until you sign out, or 14 days if you choose “Keep me signed in”); a check that your browser accepts cookies when you sign in (until you close the browser); booking basket cookies during purchase (2 days); and two cookies set by our payment processor on the payment page only, to prevent fraud (one year and 30 minutes).
12. Your rights
You have the following rights over your data and your child's data:
- Right of access: to know what we hold about you and your child, and to receive a copy
- Right to rectification: to have anything wrong or incomplete corrected, such as a name, a grade or a curriculum
- Right to erasure: to have data deleted when it is no longer needed, or when you withdraw the consent that was its only basis. It does not cover financial records the law requires us to keep
- Right to restrict processing: to have use of your data frozen while we check an objection or verify a correction
- Right to data portability: to receive the data you gave us in a common electronic format, or to have it sent to another provider where that is technically possible
- Right to object: to processing based on legitimate interests. If you object to direct marketing we stop immediately, with no questions asked
- Right to withdraw consent: at any time, wherever consent is the basis, such as marketing emails. Withdrawal does not undo what came before
- Rights around automated decisions: not to be subject, and not to have your child subject, to a significant decision taken by automated processing alone without human involvement:
we make no automated decisions about you or your child and do not profile anyone.
- Right to complain to the supervisory authority, as set out below
How to exercise any of them
Write to info@futureskill.online
Tell us which right you are using, and give the child's name if the request concerns them. We may ask you to confirm your identity, to protect the account. We acknowledge your message within one working day and give a substantive reply within one month. If a request is complex or there are several, we tell you within that same month and may extend by up to two further months. Exercising your rights is free and has no effect whatsoever on your child's lessons.
13. Your right to complain
If our answer does not satisfy you, you may complain to the UK supervisory authority, the same authority we are registered with under reference ZB210326
The authority Information Commissioner's Office (ICO)
Website ico.org.uk
If you live in the European Union, you may also complain to the data protection supervisory authority in your country of residence.
We would rather you came to us first. We acknowledge a complaint within two working days, and within one working day where it concerns safeguarding.
14. We do not record lessons
The rule is the same on every one of our pages: lessons are not recorded. No audio, no video, no screen capture.
Audio and video pass directly between student and teacher during the lesson and no copy of either is kept. Once the lesson ends there is no file for us to store, to share, or to be asked to hand over.
This is why there is no data category called "recordings" anywhere in this policy, no retention period for them, and no lawful basis for processing them.
- A teacher may not record a lesson, screen-record, or capture camera stills
- Students and parents may not record the lesson, photograph the teacher, stream it, or publish any clip of it, without our written consent, to protect the privacy of the teacher and of other students
15. Data security
We limit access so that no member of staff and no teacher sees more than their work requires, and the connection to the site and to your account is protected by technical measures applied by our host and site platform we have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, and we limit access to employees, agents and contractors who have a business need to know; they process it only on our instructions and under a duty of confidentiality.
No system is perfectly secure, so we commit to notifying the supervisory authority within 72 hours of a breach that threatens your rights, and to telling you directly where the risk to you is high.
16. Changes to this policy
We may update this page when our services change or when the rules that bind us change. Each update changes the "Last updated" date at the top.
If a change is material, such as a new purpose or a new category of recipient, we email you before it takes effect.
If a change needs fresh consent, we ask for it explicitly. Silence is never treated as agreement.
17. Governing law
This policy is governed by the law of England and Wales. Where the Arabic and English texts differ, the English text prevails. This does not reduce your mandatory consumer rights in your country of residence.