Privacy notice

Who I am

I'm Amy Chambers. I teach Spanish and English online as a sole trader based in the UK. I decide how your personal details are used, which makes me the "controller" under UK data protection law.

If you have any questions about your details, email me at amy96.chambers@proton.me.

What I collect

When you get in touch by the contact form, email or WhatsApp:

• your name and email address, or your phone number if you use WhatsApp
• what you'd like to learn and anything you tell me in your message
• your level check result, if you choose to add it

When you book the free call on Cal.com: your name and email address, the time you choose, and anything you add to the booking form, such as your level check result.

If the lessons are for someone under 18: the parent or guardian's name and email address, and the student's first name and school year if you give it.

If you have lessons: lesson dates and times, notes on what we've covered and how you're getting on, and invoices and payments.

The level check is marked in your browser. Your answers aren't sent to me or anyone else, and your result only reaches me if you add it to a message.

When you visit the site: the companies that host it process your IP address and basic technical details to deliver the pages and protect the site from attacks. The site itself doesn't set cookies. The spam check on the contact form (hCaptcha, below) may set its own.

Why I use it

The law says I need a reason, or "lawful basis", for each use:

• Replying to you and arranging lessons: these are steps you've asked for before we agree lessons, and then part of our agreement (contract).
• Teaching you, keeping track of your progress and invoicing you: our agreement (contract).
• Keeping business and tax records: a legal obligation.
• Keeping the website running and secure: my legitimate interest in a site that works and is safe to use.

I don't use your details for marketing, and I never sell them or pass them on for anyone else's own use.

Who else handles your details

I use a few services to run the website and my lessons. They only handle your details to provide their service to me.

• Web3Forms (Web3Creative, India) delivers contact form messages to my email. Its servers are in the United States. It keeps a copy of each message for up to three years. Its spam check may share your IP address and email address with the spam filters CleanTalk and Akismet.
• hCaptcha (Intuition Machines, United States) checks that contact form messages come from a person. It only loads once you start filling in the form, and it looks at your IP address, your browser and device, and how you use the page. I use it because of my legitimate interest in keeping spam out of my inbox.
• Cal.com (Cal.com, Inc., United States) runs my booking calendar. When you book the free call, it handles your details on my behalf under its data processing agreement, adds the call to my Google Calendar and emails us both the time and the Google Meet link. The booking calendar is on Cal.com's own website, which may set its own cookies, for example to keep the page secure.
• Google Meet (Google), for lessons by video call. Google's own privacy policy covers how it handles the call.
• Proton Mail (Proton AG, Switzerland) is my email provider.
• WhatsApp (Meta), if you message me there. WhatsApp's own privacy policy covers how it handles your details.
• Cloudflare Web Analytics (Cloudflare, United States) counts visits to the site, such as which pages are read and roughly which country visitors are in, so I can see what's useful. It doesn't use cookies, doesn't follow you across other sites, and I only ever see totals, never who you are. I use it because of my legitimate interest in improving the site.
• Microsoft Azure hosts the website and Cloudflare manages its domain names.

If the law requires it, for example for HMRC, I may have to share some details with the authorities.

Transfers outside the UK

Some of these services are based outside the UK or store data there. The UK recognises Switzerland as protecting personal data to the same standard. For Web3Forms, in India and the United States, I rely on the Standard Contractual Clauses and UK Addendum in Web3Forms' data processing agreement. hCaptcha is certified under the UK Extension to the EU-US Data Privacy Framework.

For Cal.com, in the United States, I rely on the Standard Contractual Clauses and UK Addendum in Cal.com's data processing agreement.

Cloudflare is also certified under the UK Extension to the EU-US Data Privacy Framework.

How long I keep it

• Messages that don't lead to lessons: deleted within 6 months.
• Free call bookings that don't lead to lessons: deleted from Cal.com and my calendar within 3 months.
• Students' contact details and lesson notes: while we have lessons, and for 12 months after the last one in case you come back.
• Invoices and payment records: as long as HMRC requires, which is currently at least 5 years after the 31 January tax return deadline for that year.

Children and young people

I arrange lessons for anyone under 18 with a parent or guardian, who gets in touch or books the free call, and joins it. I only ask for the student's first name and school year, and what's needed for the lessons themselves.

Your rights

You can ask me to:

• give you a copy of the details I hold about you
• correct anything that's wrong
• delete your details
• stop using them, or limit how I use them
• send your details to you or someone else in a common format

Some rights depend on the reason I hold the details. For example, I can't delete invoices the law says I must keep. Email me at amy96.chambers@proton.me and I'll reply within one month.

If you're unhappy with how I've handled your details, please tell me first. You can also complain to the Information Commissioner's Office on 0303 123 1113. If you live in Spain, you can complain to the Agencia Española de Protección de Datos.

Changes to this notice

If I change how I use your details, I'll update this page and the date at the top.