CentreFlow stores student and family data on behalf of tuition centres. This statement explains how we handle that data, what responsibilities lie with the centre, and what parents and guardians can expect.
1. Who Is the Data Controller?
The tuition centre is the data controller for all student and parent data entered into CentreFlow. This means the centre decides:
- What data to collect from students and parents
- How long to retain that data
- Who within the centre can access it
- What communications are sent to parents
CentreFlow is the data processor — we store and process data only as instructed by the centre.
2. What Student Data Is Stored
Tuition centres may record the following types of data about students in CentreFlow:
- Full name and date of birth
- Contact details (email, phone)
- Parent or guardian names, emails, and phone numbers
- Subjects studied and learning type (e.g. Kumon Connect or paper-based)
- Attendance records including session dates, sign-in, and sign-out times
- Payment method and billing references
- Enrolment status, start date, and discontinuation details
- Communication history and notes
- ASHR event participation and achievement records
- Signed digital consent forms
3. Centre Obligations
Subscribing tuition centres are responsible for:
- Obtaining the necessary consents or establishing a lawful basis before entering personal data into CentreFlow
- Providing a clear privacy notice to parents and students explaining how their data will be used
- Ensuring that data entered into CentreFlow is accurate and kept up to date
- Responding to subject access requests or deletion requests from parents or students
- Ensuring that staff access to student records is appropriate and limited to those who need it
- Complying with all applicable UK GDPR requirements as the data controller
4. Parent and Guardian Rights
Parents and guardians of students whose data is held in CentreFlow have the following rights under UK GDPR:
- Access: Request a copy of the personal data held about your child
- Rectification: Ask the centre to correct any inaccurate data
- Erasure: Request deletion of your child's data in certain circumstances
- Objection: Object to certain types of processing
To exercise these rights, contact your tuition centre directly. They are responsible for responding to data subject requests within the timescales required by UK GDPR (typically one calendar month).
If you believe your child's data has been mishandled and the centre has not resolved your concern, you may contact the ICO at ico.org.uk.
5. Children's Ages and Consent
CentreFlow does not set an age threshold for student records — centres record data for students of all ages. For students under 13, parental consent is typically required before recording personal data and for any digital communications. Centres must ensure they follow UK GDPR rules on children's data and consent.
CentreFlow does not provide digital services directly to children. All platform access is restricted to authorised adult staff and managers.
6. Data We Do Not Collect
CentreFlow does not collect or store:
- Photographic images of children (unless uploaded by the centre as a document attachment)
- Biometric data
- Social media data or online identifiers relating to children
- Data about children's online behaviour outside the platform
7. Questions
For questions about this statement: privacy@centreflow.co.uk
For questions about a specific child's data, please contact your tuition centre directly.