Privacy Policy

Legacy Academy Ltd ("we", "us") is the data controller for the personal information processed in connection with the Legacy Diagnostic Package and any ongoing tutoring services. Our registered address is Suite 603 Crown House North Circular Road, London, England, NW10 7PN.

For privacy questions please contact admin@legacyacademy.org.uk.

1. What we collect

From parents:

• Name, email, billing address, payment metadata (via Stripe).
• Email if you choose to contact us directly.
• Booking metadata via Cal.com (call time, time zone).
• Marketing attribution (UTM tags, referrer, fbclid/gclid).
• If you explicitly enable Analytics in Cookie preferences: safe public page paths, timestamps, random browser/visit references and booking milestones. Our team can view the observed pre-booking journey. We do not record form contents, child details, private link queries, or payment secrets in these events. Individual journey records expire after 90 days; visits end after 30 minutes of inactivity. You may stop new collection at any time using Cookie preferences. This first-party browsing timeline is not forwarded to Meta.

From your child (with your consent), through the diagnostic:

• First name, school year, exam board, target subjects.
• Diagnostic responses and resulting written report.

2. Children's data & lawful basis

We process your child's data only with your active consent as the parent or legal guardian. Where the child is 13 or older, we additionally invite their assent before any diagnostic is administered. We rely on Article 6(1)(b) UK GDPR (performance of a contract) and, for children's data specifically, your explicit consent under Article 9 where relevant.

Diagnostic responses are used solely to produce your child's report and to help us match an appropriate specialist tutor. They are never used for advertising, sold, or shared outside the named processors below.

3. Why we process your data

• To deliver the diagnostic, the report, and the strategy call.
• To send transactional emails about your purchase and call (these are essential and you cannot opt out without cancelling the service).
• To send a small number of follow-up emails after your call, which you can opt out of at any time using the unsubscribe link in those emails.
• To meet our legal accounting and tax obligations.
• With your explicit Analytics choice, to understand website journeys leading to trial bookings. Anonymous social short-link request counts are separate from individual journeys and cannot identify who saw an ad.

4. Who we share data with (processors)

• Stripe — payment processing (UK / EU / US).
• Resend — transactional email delivery (US).
• Cal.com — call scheduling (US).
• Sentry — error monitoring (US, EU residency).
• Google Analytics 4 & Meta — analytics and advertising measurement. Meta tracking is enabled by default unless you opt out through Cookie preferences in the footer. Other optional tracking follows your saved choices.
• Replit / Neon — hosting and our application database (US).

Where data is transferred outside the UK we rely on the UK International Data Transfer Agreement and standard contractual clauses with each processor.

5. How long we keep it

• Diagnostic responses and reports: 24 months from your call, then deleted unless you become an ongoing tutoring client.
• Purchase and accounting records: 7 years (UK statutory requirement).
• Marketing follow-up logs: 12 months from last interaction.

6. Your rights

You have the right to access, correct, export, restrict, or delete your and your child's personal data. You can also withdraw consent at any time. Email admin@legacyacademy.org.uk and we will respond within 30 days. You can also complain to the UK Information Commissioner's Office at ico.org.uk.