Privacy Policy
How we collect, use and protect your personal data
1. Who we are
Macoc Educational Services Ltd (“Macoc”, “we”, “us”, “our”) is a company registered in England and Wales. Our registered address is: Luton, Bedfordshire, England. We are the data controller for the personal data you provide to us.
If you have any questions about this policy, please contact us at admin@macoceducationalservices.co.uk.
2. What data we collect
We collect the following categories of personal data:
- Account data: your name, email address, phone number, and postal address when you register.
- Children’s data: your child’s name, date of birth, school year, and any medical or SEN notes you choose to provide.
- Booking data: course selections, dates, payment amounts, and Stripe payment reference numbers.
- Communication data: messages sent via our contact form.
- Review data: star ratings and written feedback submitted through our website.
- Newsletter data: email addresses of subscribers.
- Technical data: IP address, browser type, and session cookies used to keep you logged in.
We do not store payment card numbers. All card payments are processed by Stripe, which is PCI DSS Level 1 compliant.
3. How we use your data
| Purpose | Legal basis |
|---|---|
| Processing bookings and taking payment | Contract performance |
| Sending booking confirmation emails | Contract performance |
| Managing your parent portal account | Contract performance |
| Safeguarding children in our programmes | Legal obligation |
| Responding to contact form enquiries | Legitimate interest |
| Sending newsletters (if subscribed) | Consent |
| Moderating and publishing reviews | Consent |
| Improving our website and services | Legitimate interest |
| Complying with legal and regulatory requirements | Legal obligation |
4. Children’s data
We take the privacy of children very seriously. We collect children’s personal data (name, date of birth, school year, medical notes) only when provided by a parent or legal guardian through our portal. This data is used solely for the purpose of delivering our educational programmes and ensuring the safety and welfare of each child. We do not share children’s personal data with third parties except where required by law (e.g. safeguarding referrals).
5. Sharing your data
We share your data only with trusted third parties who help us deliver our services:
- Stripe — payment processing (your payment card data is held by Stripe, not us)
- Email service providers — for sending booking confirmations and newsletters
- Hosting provider (Hostinger) — our website and database are hosted on Hostinger servers in the EU
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
6. How long we keep your data
- Account and booking data: retained for 7 years after your last booking to comply with HMRC record-keeping requirements.
- Contact form messages: retained for 2 years.
- Newsletter subscriptions: retained until you unsubscribe.
- Session cookies: expire when you close your browser or log out.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability (receive your data in a machine-readable format)
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email us at admin@macoceducationalservices.co.uk. We will respond within one calendar month.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
8. Cookies
We use a single session cookie (PHPSESSID) to keep you logged in. This cookie is strictly necessary
and does not require your consent under UK PECR. We do not use advertising, tracking, or analytics cookies.
9. Changes to this policy
We may update this policy from time to time. We will notify registered users of significant changes by email. The date at the top of this page indicates when the policy was last updated.