1. Who we are
Data Controller: Myette Blannin, trading as Otto Education
Contact: hello@ottoeducation.co.uk
Otto Education is a sole trader providing SEND consultancy, tutoring and school support services. We are not required to register with the ICO as a data controller under the small organisation exemption, but we are committed to fully complying with UK GDPR and the Data Protection Act 2018.
2. What data we collect and why
We only collect the data we genuinely need. Here is what we collect and our lawful basis for doing so:
Enquiry and booking data
When you submit an enquiry form or book a call, we collect your name, email address, and any information you choose to share about your child or school. Lawful basis: Legitimate interests (to respond to your enquiry) and, where a service agreement follows, performance of a contract.
Client and child data
When we begin working with you, we may hold additional information including your child's name, age, school, SEND needs, EHCP or IEP documents, and session notes. Lawful basis: Performance of a contract; and for special category data relating to a child's health or disability, explicit consent.
Safeguarding records
Where a safeguarding concern arises, we hold records of the concern, actions taken, and any referrals made. Lawful basis: Legal obligation and vital interests of the data subject.
Website analytics
This website does not currently use cookies or third-party analytics tools. If this changes, this policy will be updated and your consent will be sought.
3. How we use your data
We use your data only for the purposes for which it was collected:
- Responding to enquiries and booking requests
- Delivering tutoring, consultancy and school support services
- Maintaining records of our work together, including session notes and progress records
- Complying with safeguarding and legal obligations
- Communicating with you about your service, including scheduling and invoicing
We do not use your data for marketing without your explicit consent. We do not sell, rent or share your data with third parties for commercial purposes.
4. Special category data
Information about a child's health, disability or SEND needs is special category personal data under UK GDPR. We process this data only with explicit consent, and take additional care to ensure it is stored securely and shared only with those who have a direct need to know (for example, where we liaise with a school on your behalf with your permission).
5. How we store and protect your data
Your data is stored securely using password-protected, encrypted systems. We do not store physical paper files containing personal data in unsecured locations. Access to client data is limited to Myette Blannin and, where relevant, the associate directly involved in delivering your service.
We will never transmit sensitive personal data (such as EHCP documents) via unencrypted email without your knowledge. We use secure file-sharing methods where required.
6. How long we keep your data
- Enquiry data (no service commenced): 12 months from last contact, then deleted
- Active client records: For the duration of the service plus 3 years
- Safeguarding records: Minimum 25 years, or until the child reaches age 25 (whichever is longer), in line with statutory guidance
- Financial records (invoices): 7 years, in line with HMRC requirements
7. Sharing your data
We share your data only where:
- You have asked us to (e.g. liaising with your child's school on your behalf)
- We are required to by law (e.g. a safeguarding referral to children's social care)
- It is necessary to deliver the service you have contracted us for (e.g. a Calendly booking system processes your name and email to schedule a call)
Where we use third-party tools (such as Calendly for booking or Formspree for form handling), those services operate under their own privacy policies and data processing agreements. We select tools that are GDPR-compliant and process data within the UK or EU where possible.
8. Your rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate data
- Erasure: ask us to delete your data (subject to legal obligations)
- Restriction: ask us to limit how we use your data
- Portability: receive your data in a portable format
- Object: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at hello@ottoeducation.co.uk. We will respond within one month.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.
9. Changes to this policy
We may update this policy from time to time. The current version and effective date are shown at the top of this page. Where changes are significant, we will notify active clients directly.
Effective: May 2026 · Policy owner: Myette Blannin, Otto Education