Privacy Policy

The data controller for personal data processed in connection with the Services is the sole trader trading as Next Level Learning. We provide Maths and Science tutoring and related academic support fully online across Ireland (based in Blessington, Wicklow).

Controller identity and contact details (GDPR Articles 13 and 14): We operate as a sole trader trading as Next Level Learning. Legal name: to be confirmed. Geographic address: to be confirmed. VAT registration to be confirmed; we will publish a VAT number if and when we are VAT-registered. Public place of business for the brand: Blessington, Wicklow, Ireland. Website: https://nextlevellearning.ie. Primary privacy contact email info@nextlevellearning.ie. Until the legal name, geographic address, and VAT status are published here, you can always reach us at info@nextlevellearning.ie or via our contact page.

For all data protection requests, email info@nextlevellearning.ie and mark the subject clearly (for example, "Data protection request") so we can prioritise and verify your request. You may also reach us via our contact page.

We have not appointed a statutory Data Protection Officer where that is not required. Privacy queries are handled at the contact details above.

This policy applies to students, parents and guardians, tutors and staff, website visitors, and anyone who contacts us, requests a free first grind, or interacts with our platform.

It covers personal data processed through our website, student and parent portals, tutor tools, booking and enrolment flows, email and notification systems, and integrations used to deliver lessons and support (including video lessons and messaging tools described below).

We collect personal data that you provide directly, data generated through your use of the Services, and limited data from third parties who help us operate the platform (for example payment confirmation from our payment processor). The categories below describe the main types of data we process.

We use personal data for the following purposes:

• To create and manage accounts, verify identity where needed, approve or decline registrations, and administer roles and permissions.
• To review free first grind requests and lead-magnet downloads, manage school capacity, admit or decline requests, schedule complimentary lessons, and invite families to create free-access accounts.
• To deliver tutoring, assessments, quizzes, class tests, mock exams, progress tracking, lesson preparation (for paying students), intake surveys, school scores, year plans, question banks, and related educational features (including limited free-dashboard access before paid enrolment).
• To schedule lessons, provide join links, store and share lesson recordings with authorised entitled users (and staff), and send operational notifications.
• To enable parent and guardian dashboards so linked adults can view progress, homework titles and status, feedback appropriate to their role, and other information made available for that linked student (visibility depends on whether the child is entitled).
• To process payments through Stripe-hosted Payment Links, grant access once Stripe confirms payment, reflect cancellations and payment-method updates you make in the Stripe customer portal, reflect plan changes we make in Stripe after you email us, and keep billing records.
• To measure website use and advertising performance where you have consented to analytics or advertising cookies (for example Google Analytics 4, Google Ads, and Meta).
• To respond to enquiries, bookings, and support requests.
• To maintain security, prevent abuse, enforce our Terms of Service, and protect students, families, tutors, and the integrity of the platform.
• To improve the Services, diagnose technical issues, and maintain reliable operations.
• To comply with legal, accounting, tax, and regulatory obligations, and to establish, exercise, or defend legal claims.

Under the GDPR, we process personal data only where a lawful basis applies. Depending on the activity, we rely on one or more of the following:

• Contract (Article 6(1)(b)): to provide Services you request or enter into with us, including free first grind requests you submit, accounts, tutoring delivery, parent portal access for linked accounts, and paid plans.
• Legitimate interests (Article 6(1)(f)): to operate a secure educational platform, manage capacity and admissions fairly, improve features, prevent misuse, communicate service updates, and keep appropriate business records, where those interests are not overridden by your rights and interests (especially children's rights). You may object to processing based on legitimate interests as described in section 12.
• Consent (Article 6(1)(a)): where we ask for consent, for example publishing anonymised questions and answers in a community or group question bank, or for non-essential analytics and advertising cookies. You may withdraw consent at any time without affecting processing that lawfully occurred before withdrawal.
• Legal obligation (Article 6(1)(c)): where we must retain or disclose information to meet accounting, tax, regulatory, or other legal requirements.
• Vital interests (Article 6(1)(d)): in rare cases where processing is necessary to protect someone's life or physical safety.

Linked parents and guardians may access information about their connected student through the parent dashboard. What they see depends on enrolment status. For a paying (entitled) child this may include progress indicators, homework title/due/status (not written answers), tutor feedback, session recaps, parent-only notes, recordings, intake results, and billing tools where they manage payment. For an unpaid child, visibility is more limited (for example compact free-grind and survey summaries where offered) and does not include lesson recordings.

Anonymous group questions are designed so tutors do not see the submitting student's identity for that question type. Parent dashboards are not intended to reveal anonymous question authorship counts or identities. Community question bank entries display question and answer content without student names.

If a parent–student link ends or an account is revoked, parent access to that student's data is removed or restricted in line with our access controls.

We do not sell personal data. We share personal data only as described in this policy or where required by law.

We are based in Ireland. Some providers may process personal data in countries outside Ireland or the European Economic Area (EEA), including the United States.

Where personal data is transferred outside the EEA, we take steps designed to ensure an adequate level of protection, such as relying on an adequacy decision where available (including, where applicable, the EU-US Data Privacy Framework for certified organisations), or using appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

You may email info@nextlevellearning.ie for more information about transfer safeguards applicable to your data.

We retain personal data only for as long as necessary for the purposes described in this policy, including to provide the Services, maintain educational and billing records, resolve disputes, enforce agreements, and meet legal obligations. Retention periods vary by data type:

• Free first grind and contact leads: retained while we manage your request and for a reasonable period afterwards for follow-up, capacity planning, and dispute handling, then deleted or anonymised where practicable.
• Account and profile data: generally kept while the account remains active and for a reasonable period afterwards needed for support, security, and record-keeping, unless earlier deletion is required or granted.
• Educational records (assessments, progress, questions, notes): typically retained for the duration of the tutoring relationship and a subsequent period needed for continuity, complaints handling, and legitimate educational administration, then deleted or anonymised where reasonably practicable.
• Lesson recordings: retained according to our video provider's retention settings and operational needs (cloud recordings may expire after a limited period, commonly around 90 days depending on provider settings).
• Billing and transaction records: retained for the periods required under Irish tax and accounting rules (often up to seven years) and for dispute resolution.
• Inactive accounts may be reviewed and closed as part of ordinary administration and data minimisation; we do not currently run an automatic timed purge of never-paid accounts after a fixed number of weeks.
• Security and server logs: retained for shorter operational periods unless needed longer for investigations.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, taking into account the nature of educational and children's data. These measures include role-based access controls, authentication protections, encrypted transport (HTTPS/TLS), least-privilege database policies where applicable, and staff access limited to what is needed to operate the Services.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission and, where required, affected individuals, in accordance with GDPR Articles 33 and 34.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential and for using a strong unique password. Please email us promptly at info@nextlevellearning.ie if you suspect unauthorised access to your account.

We use cookies and similar technologies that are necessary to provide the Services, including authentication session cookies, Cloudflare Turnstile on public forms (a spam challenge that may set provider cookies), and preferences required for core functionality. These are used on the basis of our legitimate interests in providing a secure signed-in service, and where applicable because they are strictly necessary to provide a service you request under ePrivacy rules.

Non-essential analytics and advertising cookies are used only after you choose them on our cookie banner. The Google Analytics tag may load with Consent Mode denying analytics and ads storage until you accept; Meta Pixel and Google Ads-related tags load only after you accept ads (Accept analytics and ads). You can change your mind at any time using Cookie settings in the website footer. Necessary-only means we do not grant analytics or advertising storage. Categories, named technologies where known, and how to withdraw consent are in our Cookies Policy.

Google Analytics, Google Ads, and Meta are independent services with their own privacy policies. Where you consent to advertising, they may process usage data (such as pages visited, conversion or lead events, technical identifiers, and approximate location derived from IP) to help us measure and optimise ads. Where we use Google Enhanced Conversions, hashed customer parameters (for example SHA-256 hashed email or phone) may be sent to Google for matching. We do not use educational records, student portal activity, or logged-in app learning data for advertising profiling, audience building, or behavioural ad targeting.

Subject to the GDPR and applicable Irish law, you may have the following rights in relation to your personal data:

• Access: to obtain confirmation of whether we process your personal data and to receive a copy (Article 15).
• Rectification: to correct inaccurate personal data and complete incomplete data (Article 16).
• Erasure: to request deletion in certain circumstances (the "right to be forgotten", Article 17).
• Restriction: to request that we restrict processing in certain circumstances (Article 18).
• Portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible and where the legal basis is contract or consent (Article 20).
• Objection: to object to processing based on legitimate interests, including profiling based on those grounds (Article 21).
• Withdraw consent: where processing is based on consent, to withdraw consent at any time (Article 7).
• Complaint: to lodge a complaint with a supervisory authority without prejudice to any other administrative or judicial remedy.

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects about you within the meaning of Article 22 GDPR. Account approval, free first grind admission, tutoring decisions, and support responses involve human review. Portal access for paid features is granted when Stripe confirms payment to us over a signed webhook (staff may also unlock or adjust access in exceptional cases). Visiting a checkout success page does not by itself unlock paid access.

The Services may link to or integrate third-party tools (including Zoom, Stripe Payment Links, WhatsApp, and social media profiles). Those services are governed by their own privacy policies and terms. We are not responsible for third-party privacy practices outside our instructions as a controller or processor relationship described in this policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Services. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice (for example by email to info@nextlevellearning.ie recipients on file or an in-product notice).

We encourage you to review this page periodically. Where required by law, we will seek fresh consent or take other steps before relying on a change that needs it.

For any privacy question or request, email info@nextlevellearning.ie or contact us via our contact page.

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Data Protection Commission (Ireland) or, if you live elsewhere in the EEA, your local supervisory authority, as described in section 12.2.