The short version
We do not sell your data and we do not share it with anyone for their own purposes. A handful of companies process some of it on our behalf so that payments, email and monitoring can work at all — every one of them is listed below, with what they get and why.
Who is responsible
Alterora OÜ, a company registered in Estonia, operates tutor.gr. Write to privacy@tutor.gr about anything on this page.
Two different roles
This matters, because it decides who you should ask about what.
- For your own account — your name, your email address, what you pay us — we are the controller. We decide why we hold it, and this policy explains it.
- For a school's records — its students, their grades, their attendance, their parents' phone numbers — the school is the controller and we are its processor. We hold that data only to run the service for them and only on their instructions. If you are a student or a parent asking about your records, ask the school first: they decide what is held and they can correct or remove it. If they need us, we help them.
What we hold, and why
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, password (hashed) | To have an account at all, and to sign you in | Performance of a contract |
| School name, plan, student count, storage used | To run the service and work out what to charge | Performance of a contract |
| Billing name, address, invoice history | To take payment and keep the accounts | Contract, and legal obligation for the records |
| Records a school enters about students and parents | Because that is what the software is for | The school's basis, not ours — we process on their behalf |
| Support requests, and what we knew when you sent one | To answer, and to see the history of a recurring problem | Contract, and our legitimate interest in improving the service |
| Contact form messages | To reply to you | Legitimate interests — answering someone who wrote to us |
| Server logs, IP address, browser | Security, debugging, and spotting abuse | Legitimate interests — keeping the service available and secure |
Who else touches it
We do not sell personal data, we do not rent it, and we do not hand it to anyone for their own marketing. The companies below process some of it strictly so that we can run the service, each under a contract that limits them to that purpose.
Verifone (2Checkout) — Payments and billing
Takes the payment for a paid membership and issues the invoice. They act as the merchant of record, which means the sale is legally theirs and the invoice comes from them rather than from us.
What reaches them: Name, billing address, email address and the payment itself. Card numbers are entered on their systems and never reach ours.
Lawful basis: Performance of a contract
Their policy:
https://www.verifone.com/en/privacy-policy
Uptime and error monitoring — Keeping the service running
Tells us when the site is down or throwing errors, usually before anyone has to report it.
What reaches them: Technical details of a failed request: the address, the error, and the account id if somebody was signed in.
Lawful basis: Legitimate interests — keeping the service available and secure
Email delivery — Sending email
Delivers the email the service sends: password resets, help desk replies, invoice notices, and the messages a school chooses to send its own parents and students.
What reaches them: Recipient address, subject and content of the message.
Lawful basis: Performance of a contract
Beyond these, we would only disclose data if the law required it — a court order, or a binding request from an authority — or to establish or defend a legal claim. If we are ever compelled to hand over a school's records, we will tell that school unless we are forbidden from doing so.
Where it is held
The service and its backups run on servers in the European Union. Some of the companies above are based outside the EU; where data reaches them, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
| Account | For as long as the account is open. |
|---|---|
| School data | For as long as the school is using the service. Deleted within 30 days of the school asking us to close it, except where we are required to keep it. |
| Invoices | Seven years, because tax law says so. |
| Support | Three years after the request is closed, so we can see the history of a recurring problem. |
| Contact form | Two years, then deleted. |
| Logs | 90 days. |
| Backups | Rolling 30 days, after which a deleted record is gone from those too. |
Your rights
Under the GDPR you can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, or send it to you in a portable format. You can object to processing we do on the basis of legitimate interests, and where we rely on your consent you can withdraw it at any time, without that affecting what was done before.
Write to privacy@tutor.gr. We answer within 30 days and we do not charge for it.
Again: if your request is about records a school holds about you or your child, the school decides. Ask them first, and tell us if they will not help.
If you think we have handled your data badly you can complain to a supervisory authority — in Estonia the Andmekaitse Inspektsioon, in Greece the Hellenic Data Protection Authority, or the authority where you live. We would rather you told us first, but it is your right either way.
Security
Traffic is encrypted in transit. Passwords are hashed and cannot be read by us or recovered — only reset. Access to production data is limited to the people who need it to keep the service running, and support staff see support requests, not student records. Backups are encrypted and kept for 30 days.
No system is perfect. If a breach happens that puts your rights at risk, we will notify the relevant authority within 72 hours and tell the people affected without undue delay.
Children
Students in a tutoring school are often minors. Those records are entered by the school, on the school's authority, and the school is responsible for having whatever consent the law requires. We do not market to children, we do not profile them, and we do not use their records for anything other than providing the service to their school.
Automated decisions
We do not make automated decisions that produce legal effects about anybody, and we do not profile people.
Changes
If we change this policy in a way that materially affects you, we will email account owners before it takes effect. The date at the top is the date of the version you are reading.