Privacy Policy

1. Introduction

MSA Educational Services ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website msaeducationalservices.com and use our educational services.

We operate in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information You Provide

When you register for our services, we may collect:

• Student Information: Name, age/year group, school information
• Parent/Guardian Information: Name, email address, phone number, postal address
• Registration Details: Programme selections, session preferences, educational needs
• Payment Information: Processed securely through Stripe (we do not store complete card details)
• Communications: Messages sent through contact forms or email

2.2 Information Collected Automatically

• Usage Data: Pages visited, time spent, click patterns
• Device Information: Browser type, device type, IP address
• Cookies: Essential cookies for site functionality and analytics (see Section 8)
• Location Data: General geographic location (country/region) for service delivery

2.3 Information About Children

As an educational services provider, we collect limited information about children (students) only with parental consent and solely for the purpose of delivering our educational services. We take extra care to protect children's data in accordance with UK GDPR requirements.

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Registering students for programmes, tutoring sessions, mock exams, and academic olympiads
• Communication: Sending confirmation emails, session reminders, progress updates, and important notices
• Payment Processing: Processing payments through our secure payment provider (Stripe)
• Matching Services: Pairing students with appropriate tutors based on needs and preferences
• Educational Support: Providing personalised learning plans, resources, and feedback
• Service Improvement: Analysing usage patterns to improve our website and services
• Legal Compliance: Meeting regulatory requirements and safeguarding obligations
• Marketing: Sending newsletters and service updates (only with your consent, and you can opt out anytime)

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contract: Processing necessary to fulfill our service contract with you
• Consent: Where you have given explicit consent (e.g., marketing emails)
• Legitimate Interests: For business operations and service improvement, where not overridden by your rights
• Legal Obligation: Where required by law (e.g., safeguarding, tax records)

5. Sharing Your Information

We do not sell your personal data. We may share information with:

5.1 Service Providers

• Stripe: Payment processing (PCI-DSS compliant)
• Google Analytics: Website analytics and usage measurement
• Resend: Email delivery services
• Sanity: Content management system
• Cloudflare R2: Secure file storage
• Web Hosting Providers: For website infrastructure

5.2 Educational Partners

We may share necessary student information with tutors, olympiad organizers, and examination boards to deliver our services.

5.3 Legal Requirements

We may disclose information if required by law, court order, or to protect the safety of students (safeguarding obligations).

6. Data Security

We implement appropriate technical and organizational measures to protect your data:

• SSL/TLS encryption for data transmission
• Secure payment processing through PCI-DSS compliant providers
• Regular security audits and updates
• Access controls and staff training
• Encrypted backups and secure data storage

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your personal data only as long as necessary:

• Active Services: While you use our services and for a reasonable period afterward
• Financial Records: 6 years (UK tax law requirement)
• Safeguarding Records: As required by statutory guidance
• Marketing Consent: Until you withdraw consent or 2 years of inactivity

After retention periods expire, we securely delete or anonymize your data.

8. Cookies and Tracking Technologies

We use cookies to improve your experience:

8.1 Essential Cookies

Required for basic site functionality (e.g., session management, security). These cannot be disabled.

8.2 Analytics Cookies

Help us understand how visitors use our site. You can opt out via our cookie banner.

8.3 Managing Cookies

You can control cookies through our cookie consent banner and your browser settings. Note that disabling certain cookies may affect site functionality.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing or other consent-based processing

To exercise these rights, contact us at msa@msaeducationalservices.com

10. Third-Party Links

Our website may contain links to third-party websites (e.g., olympiad organizers, educational resources). We are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

11. International Data Transfers

Some of our service providers (e.g., Stripe, cloud hosting) may process data outside the UK/EEA. We ensure appropriate safeguards are in place through Standard Contractual Clauses or adequacy decisions.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

14. Right to Complain

You have the right to lodge a complaint with the UK supervisory authority: