CentreFlow takes data privacy seriously. This policy explains how we collect and use personal data when you use our platform. We act as a data processor on behalf of tuition centres, who are the data controllers for their students, parents, and staff.
1. Who We Are
CentreFlow is a SaaS platform designed for tuition and learning centres operating in the United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, CentreFlow acts as a data processor, processing data on behalf of the tuition centres that subscribe to our service.
Contact: privacy@centreflow.co.uk
2. Data We Collect
Account Holders (Centre Managers)
- Name, email address, and login credentials
- Billing information (processed securely via payment providers)
- Centre name, address, and contact details
- Usage data and access logs
Staff Users
- First name, last name, and username
- Role within the centre (staff or manager)
- Login timestamps and audit activity
- DBS certificate numbers and compliance records (entered by the centre)
Students and Parents
This data is entered by the tuition centre. CentreFlow stores it on their behalf. Categories include:
- Student name, date of birth, and contact details
- Parent or guardian names, emails, and phone numbers
- Subjects enrolled, attendance records, and learning type
- Payment method and GoCardless billing references
- ASHR levels and event attendance
- Communication notes and onboarding checklist items
3. Lawful Basis for Processing
- Contract: Processing is necessary to deliver the CentreFlow service to subscribing centres.
- Legitimate Interests: For platform security, fraud prevention, and service improvement.
- Legal Obligation: Where required by law, for example in response to a regulatory request.
Tuition centres are responsible for establishing their own lawful basis for processing student and parent data.
4. How We Use Data
- To provide and maintain the CentreFlow platform
- To authenticate users and manage sessions securely
- To generate reports, registers, and operational records for the centre
- To process payments and manage billing through GoCardless
- To send system notifications and service communications
- To investigate and respond to security incidents
5. Cookies
We use essential session cookies to maintain user authentication. Analytics cookies may be used to understand usage patterns. Please see our Cookie Policy for full details.
6. Data Retention
We retain data for as long as a centre subscription is active, plus a 90-day grace period following cancellation. See our Data Retention Policy for detail on specific record categories.
7. Subprocessors
We share data with a limited number of trusted third-party providers. A full list is available on our Subprocessors page.
8. International Transfers
We endeavour to store all data within the UK or European Economic Area. Where any transfer outside this area is required, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.
9. Your Rights Under UK GDPR
Individuals whose data is held within CentreFlow have the following rights:
- Right of access – request a copy of your personal data
- Right to rectification – request correction of inaccurate data
- Right to erasure – request deletion of your data in certain circumstances
- Right to restrict processing – request that we limit how we use your data
- Right to data portability – receive your data in a structured, machine-readable format
- Right to object – object to processing based on legitimate interests
To exercise your rights, contact the tuition centre who manages your records, or reach us at privacy@centreflow.co.uk.
10. Complaints
If you are unhappy with how your data has been handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to account holders by email. Continued use of CentreFlow constitutes acceptance of any updated policy.