Legal

Data Protection FAQ

TotalOnboarder FAQs

We at TutorOnboarder take the protection of data very seriously. We understand that Data Protection law can be very confusing, so in this section, we’re answering some of the most frequently asked questions about using TutorOnboarder and privacy obligations, as of April 2026. Privacy law changes, and we don’t know the full details of your individual business, so this information is intended as general guidance only. If you have any questions, please email hello@totalonboarder.com or seek personalised legal advice.

1. Can you tell me about Data Controllers and Data Processors and how this impacts on TutorOnboarder

(1) Can you explain the data responsibilities for the TutorOnboarder platform?

When tutors or tutoring agencies use a platform like TutorOnboarder, it’s important to understand who is responsible for what under UK data protection law. In a nutshell,

  • You (the Tutor Agency) control the data, so you are the Data Controller

and

  • We, TutorOnboarder processes that data for you, so we are the Data Processor.

(2) Tell me more about Data Controllers?

A Data Controller decides what personal data is collected and why. So, as the Data Controller, you, the Tutor Agency, decide:

  • What information you collect about tutors, but also about students, parents, suppliers etc
  • Why you collect it (e.g., delivering tutoring, safeguarding, invoicing and financial records)
  • How long you keep it
  • Who you share it with
  • What you upload or store on any platform.

So, since you are the one making decisions about the purpose and use of the data, you control the data and so you are the Data Controller.

(3) Tell me more about Data Processors?

TutorOnboarder (the platform) does not decide what data you, the Tutor Agency, collects or why you collect it (see above). TutorOnboarder processes data on your behalf, so is the Data Processor. As the Data Processor, the TutorOnboarder platform:

  • Securely stores the data/information you upload (for example, using encryption, restricted access and secure user authentication) or that you ask us to upload on your behalf
  • Organises it so your business can use it
  • Processes it only so the service works
  • Follows your instructions.

(4) Why is this important for Tutors & Tutor Agencies

As the Data Controller, you are responsible for:

  • Providing privacy information (usually a Privacy Notice/Policy) to tutors (and of course to parents and student etc)
  • Making sure you have a right (such as consent or a lawful basis) to collect and use data
  • Keeping data accurate and up to date
  • Responding to data protection requests (e.g., access or deletion)
  • Ensuring you only upload what you are allowed by law and, as applicable, with consent to upload
  • Making sure that you only keep data for as long as you need it.

TutorOnboarder, as the Data Processor, must:

  • Keep the data secure
  • Follow your instructions
  • Provide a compliant processing agreement
  • Support you with some of the technical and organisational safeguards.

2. Can I upload a DBS certificate to TutorOnboarder or ask you to do this on my behalf?

Yes. Tutors Agencies can upload DBS certificates to TutorOnboarder as part of their onboarding, safeguarding, or verification process. However, because DBS certificates contain sensitive personal data, there are a few responsibilities to be aware of.

(1) For Tutors Agencies (Users)

You are the Data Controller. This means you decide:

  • whether you collect DBS certificates
  • why you collect them (e.g., safeguarding, compliance, client reassurance)
  • how long you keep them
  • who can access them
  • when they should be deleted

You are responsible for complying with UK Data Protection laws when uploading or storing DBS information.

(2) For TutorOnboarder (the Platform)

TutorOnboarder is the Data Processor. This means that the platform:

  • stores the DBS certificate securely
  • processes it only so your business can use it
  • follows your instructions
  • does not decide what you collect or why or how long you keep it

So, TutorOnboarder provides the secure system but you, the Tutor Agency, control the data and decide the rules. You must ensure your own internal processes (e.g., staff access, downloads, exports) are secure.

(3) Important Compliance Notes for Tutors & Agencies

Since DBS certificates contain criminal offence data, you must:

  • have a lawful basis for collecting them (usually legitimate interests or legal obligation)
  • have an appropriate policy document (such as a Privacy Notice) explaining why and how you handle this type of data
  • only collect what and when you genuinely need
  • consider what information you need to retain from a DBS certificate. For example, you may wish to keep a digital copy of a DBS certificate, the certificate number, the date of issue. the level of check (Basic, Standard, Enhanced) and whether barred list checks were included but not retain unnecessary pages, unrelated documents or notes or comments that are not required for safeguarding purposes
  • restrict access to authorised people, for example, authorised staff, safeguarding leads, individuals responsible for onboarding or compliance and ensure those people understand confidentiality and safeguarding requirements
  • Only use certificate information for the specific purpose for which it was requested and for which the applicant’s full consent has been given.
  • keep DBS information accurate and up to date
  • delete the certificate when it’s no longer required

3. How long can or should I keep data on TutorOnboarder?

You should only keep personal data on TutorOnboarder for as long as you genuinely need it for the purpose you collected it. Once the data is no longer required, you should delete it from your TutorOnboarder account.

How long you keep data for depends on your own business needs, but, as a general rule, you should:

  • Keep data only for as long as it is necessary to deliver your services, meet your legal obligations, or manage any ongoing relationship with the individual.
  • Regularly review the data you hold and delete anything that is out of date, inaccurate, or no longer needed.
  • Avoid keeping data “just in case” because the law doesn’t allow this.

Remember that TutorOnboarder does not decide how long you keep your data. You are the Data Controller, so you are responsible for setting and following your own retention periods.

If you are unsure how long you should keep certain types of data, you may wish to seek personalised legal advice.

4. Does TutorOnboarder use my data for anything other than providing the service?

No. We only use your data to provide, maintain, and improve TutorOnboarder. We do not sell your data, share it for third-party marketing, or use it for unrelated purposes. All processing is limited to what is necessary to run the platform and meet our legal obligations.

5. Does TutorOnboarder verify the accuracy or lawfulness of the data I upload?

No. You remain the Data Controller, so you are responsible for ensuring that any data you upload is accurate, lawful, and appropriate to share. We process the data strictly on your instructions and do not check, validate, or verify it.

6. What happens to my data if I cancel my subscription?

Your account enters a 28-day reinstatement period. During this time, your data remains stored securely in case you choose to reactivate your subscription. After this period ends, we begin the deletion process in line with our Data Processing Agreement.

7. Can I permanently delete my data?

Yes. You can request permanent deletion at any time by emailing hello@totalonboarder.com. We will securely and irreversibly delete your data unless we are legally required to retain certain information for a specific period.

8. What happens to my data if I reinstate my account?

If you reinstate your subscription within 28 days of cancellation, your account and data will be fully restored. After 28 days, your data may already be scheduled for deletion and may not be recoverable.

9. How do I request a copy of all the data you hold about me?

You can make a Data Subject Access Request (DSAR) by emailing hello@totalonboarder.com. We will provide a copy of your personal data in a structured, commonly used format within the time limits set by Data Protection Law.

10. How do I make a complaint about data protection?

You can contact us at hello@totalonboarder.com with any concerns. If you are not satisfied with our response, you have the right to raise your complaint with the Information Commissioner’s Office (ICO).

11. Can TutorOnboarder check a teacher’s registration status for me?

Yes. As part of our optional Checking Services, we can check a teacher’s registration information on your behalf. You remain the Data Controller, so you must ensure you have a lawful basis or the teacher’s consent before asking us to perform this check.

Book a demo