OUR PRIVACY POLICY
(Last updated: 5 August 2026)
Bright Sparks Coaching is the trading name of Rebecca Goulbourne, a sole trader providing specialist teaching, tutoring, assessment support and related coaching services to children and young people (“services”), and operating the website brightsparkscoaching.net(“website”). I take your privacy, and the privacy of the children I work with, seriously. This policy explains what personal data I collect, why and how I use it, who I share it with, how long I keep it, and the rights you and your child have under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
In this policy, “I”, “me” and “my” refer to Rebecca Goulbourne trading as Bright Sparks Coaching. “You” refers to a parent, guardian, prospective client or website visitor, and “your child” or “learner” refers to the young person receiving tuition or coaching.
For the purposes of the UK GDPR, I am the data controller for the personal data described in this policy. My details are:
● Name: Rebecca Goulbourne, trading as Bright Sparks Coaching
● Address: 15 Townsend Road, Harpenden, Hertfordshire, AL5 4BQ
● Email: rebecca@brightsparkscoaching.net
● Telephone: 07814 615240
● ICO registration reference: 00019940649
As I process personal data about children, including information about learning difficulties and assessments, I am registered as a data controller with the Information Commissioner's Office (ICO). You can check my entry on the ICO's public register using the reference above.
This policy applies to:
● anyone who visits or contacts me through the website;
● parents and guardians who enquire about or book my services; and
● the children and young people (“learners”) I teach, coach or assess.
It does not cover the practices of other organisations or websites I may link to, such as schools, professional bodies or Google. Please check their own privacy notices.
About you (parent, guardian or enquirer): name, address, email address, telephone number, payment and billing details, and the content of any emails, messages or forms you send me.
About your child (the learner): name, date of birth, school and year group; academic history and current attainment; information about learning difficulties, special educational needs, and diagnostic or psychometric assessment reports (for example relating to dyslexia or dyscalculia); my own session notes, teaching plans, progress records and professional observations; and, where relevant, safeguarding information. Information about a learner's health, SEN status or diagnosis is “special category data” under Article 9 of the UK GDPR, and I handle it with extra care as set out in section 6.
Website and technical data: pages viewed, time and date of visits, referring website, IP address, browser and device information, and any details you submit through the website's contact form (which is protected by Google reCAPTCHA – see section 13).
● Directly from you, when you contact me, complete the website enquiry form, or book and pay for sessions.
● From your child, during teaching, coaching or assessment sessions.
● From schools, SENCOs or other professionals (such as educational psychologists), but only where you have given consent for us to share information, for example to arrange school-based sessions or to discuss an assessment report.
● Automatically, through cookies and analytics when you browse the website (see section 13).
I only use personal data where I have a valid legal basis to do so. Depending on the purpose, I rely on one or more of the following:
● Performance of a contract – to agree, deliver and manage tuition, coaching or assessment-support sessions, including scheduling, preparing tailored lesson materials, and invoicing.
● Legitimate interests – to run my business effectively, for example understanding a learner's needs so I can plan sessions well, keeping records for quality and continuity of teaching, and maintaining the security of my website. I only rely on this where my interests are not overridden by your or your child's interests or rights.
● Consent – for special category data (see section 6), for liaising with a school or other professional, for optional marketing communications, and for non-essential cookies. You can withdraw consent at any time.
● Legal obligation – for example keeping financial records for HMRC, or responding to a safeguarding concern.
● Vital interests or substantial public interest – in the rare event I need to act to protect a child's welfare or safety.
Some of the information I hold about a learner – such as a dyslexia or dyscalculia diagnosis, details from an educational psychologist's report, or notes about a learning or medical condition relevant to teaching – is “special category” data under the UK GDPR, because it relates to health. I only collect and use this information:
● with your explicit consent, given when you share it with me or agree to my working from an assessment report; and
● for the specific purpose of understanding your child's needs and planning and delivering appropriate, effective and safe teaching.
I do not use this information for any other purpose, and I do not share it beyond what is described in section 8 without your further consent, except where the law requires it.
My services are aimed at children and young people, but it is parents and guardians who engage my services and who I contract with. In practice, this means:
● a parent or guardian provides most of the personal data I hold about a learner, and gives consent on the child's behalf where consent is the legal basis I am relying on;
● older learners, particularly those at secondary school, may correspond with me directly (for example to arrange a virtual session), and I will only collect what is necessary for that purpose; and
● I do not knowingly collect personal data from children through the website itself – the enquiry form is intended for parents and guardians.
If you believe your child has provided me with personal data without your knowledge, please contact me and I will address it promptly.
I do not sell personal data, and as a sole trader I do not share it with a wider network of tutors. I may share personal data with:
● trusted service providers who support my business, such as my email and cloud storage provider, invoicing/accounting software (and my accountant or bookkeeper), video-calling software used for virtual sessions, my website host, and Google Analytics and reCAPTCHA (see section 13). These providers only process data on my instructions and are required to keep it secure;
● your child's school, SENCO, or another professional such as an educational psychologist, but only with your consent and where relevant to arranging or delivering tuition;
● relevant professional or regulatory bodies (for example the British Psychological Society or British Dyslexia Association) where necessary for professional standards, or bodies involved in my DBS and safeguarding checks;
● law enforcement, courts, regulators or other authorities, where I am legally required to, or where necessary to protect a child's welfare; and
● a new owner of the business, in the unlikely event that I sell or transfer it, in which case your data would be used for the same purposes under this policy.
Some of the service providers I use to run my business – for example cloud email, storage or analytics providers – may store or process personal data on servers outside the UK, including in the United States. Where this happens, I only use providers who offer appropriate safeguards, such as the UK International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses), or who participate in the UK extension to the EU-US Data Privacy Framework, so that your data continues to receive a level of protection equivalent to that under UK law.
● Enquiries that do not proceed to bookings: kept for up to 12 months, then deleted.
● Client and learner records (session notes, teaching plans, assessment information): kept for the duration of our working relationship and for up to 7 years afterwards, in line with my professional indemnity insurance requirements and to allow me to respond to any future queries.
● Financial and invoicing records: kept for 6 years, as required by HMRC.
● Website analytics data: retained in Google Analytics in line with its standard retention settings.
● DBS certificate information: held only for as long as necessary in line with official DBS guidance, and not retained on my systems beyond that.
I review the personal data I hold periodically and securely delete or anonymise it once it is no longer needed for the purposes set out in this policy, or once I am no longer required to keep it by law.
I take reasonable technical and organisational steps to protect personal data, including password-protecting my devices and accounts, using reputable, secure cloud services for storage and email, keeping any physical records (such as printed assessment reports) securely at my home office, and limiting access to personal data to myself. However, no method of transmission over the internet, or electronic storage, is completely secure, and I cannot guarantee absolute security for information you send to me electronically.
Under the UK GDPR, you (or, where appropriate, your child) have the right to:
● be informed about how your personal data is used (as set out in this policy);
● access the personal data I hold about you or your child;
● have inaccurate personal data corrected, and incomplete data completed;
● have personal data erased in certain circumstances (“the right to be forgotten”);
● restrict or object to certain processing of personal data;
● receive certain personal data in a portable format; and
● withdraw consent at any time, where I am relying on consent as my legal basis, without affecting the lawfulness of processing before withdrawal.
These rights are not absolute and do not apply in every circumstance. Where a learner is a child, these rights are usually exercised by a parent or guardian on their behalf, unless the young person is mature enough to exercise them independently. To exercise any of these rights, please contact me at rebecca@brightsparkscoaching.net.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time. I would, however, welcome the opportunity to address your concerns directly first – please contact me in the first instance. The ICO can be contacted at ico.org.ukor by telephone on 0303 123 1113.
The website is built using GoDaddy's Website Builder, which uses cookies necessary for the site to function. When you visit the website with your browser set to accept cookies, this tells me that you consent to cookies being used as described below. You can change your browser settings at any time to decline cookies, though this may limit some website functionality.
Google Analytics: I use Google Analytics to understand how visitors use the website, using anonymised, aggregated information such as visitor numbers and the pages viewed. See Google's own Privacy Policy for more detail, or use the Google Analytics Opt-out Browser Add-on to opt out across all websites.
Google reCAPTCHA: the website's contact form is protected by Google reCAPTCHA to reduce spam. Its use is subject to Google's Privacy Policy and Terms of Service.
Third-party content: if a page embeds content from third-party sites, those sites may set their own cookies, which I do not control.
For more general information about cookies and how to manage them, visit www.allaboutcookies.orgor www.aboutcookies.org.
The website may contain links to other websites of interest. Once you leave my site using one of these links, I have no control over that other website, and I am not responsible for the protection or privacy of any information you provide while visiting it. You should check the privacy policy of any site you visit.
I may update this policy from time to time, for example to reflect changes in my services or the law. Any changes will be posted on this page with an updated “Last updated” date. If a change materially affects how I use personal data about you or your child, I will let existing clients know directly.
If you have any questions, comments, or would like to exercise any of your rights, please get in touch:
● Rebecca Goulbourne, trading as Bright Sparks Coaching
● 15 Townsend Road, Harpenden, Hertfordshire, AL5 4BQ
● Email: rebecca@brightsparkscoaching.net
● Telephone: 07814 615240