Privacy Policy

Citrus Education Group Ltd (“Citrus”, “we”, “us”) is a company registered in England and Wales, company number 17267381. We run Citrus Holiday Clubs, 1:1 and small group tutoring, and related education services for families and primary schools in Shrewsbury and Shropshire.

We are the data controller for the personal information described in this policy. You can reach us at hello@citruseducationgroup.com or through our contact page. For anything about your data, please put “Data protection” in the subject line.

Depending on how you use our services, we may hold:

• Parent / carer details — name, email address, phone number and your family record with us.
• Home address — the main home address (address line 1, optional address line 2, town/city and postcode) for the child or children attending our Holiday Clubs. This is required information when you book a Holiday Club place: we use it to identify and administer your family record, to contact you and to support safeguarding, welfare and emergency situations. The address is held once against your family record. Where a child's main home address is different from the family address, we hold that child's address as well.
• Child details — name, date of birth, gender, school and year group.
• Health and care information about your child — medical conditions, medications, allergies, dietary requirements, SEND information, EHCP status, whether an inhaler or EpiPen is needed, additional support needs, GP name, surgery and phone number.
• Safety information — emergency contacts, authorised collectors and your collection codeword.
• Booking and attendance information — the days and sessions booked, early drop-off and late collection, changes made to a booking, registers, sign in and sign out times and who collected your child, plus any notes you give us.
• Payment information — the amount, date, method and status of payments and refunds, and a reference from our payment provider. We never see or store your full card details.
• Enquiries — what you tell us in our contact, tutoring and assessment forms.
• Safeguarding records — concerns raised with us about a child's welfare, including who reported them.
• Permissions — your per-child Photo & Marketing Consent answer, your emergency medical consent, acceptance of our terms, and whether you have opted in to marketing emails, together with the date each was recorded.
• Account and technical information — sign-in information for the Parent Portal, and records of the emails we have sent you and whether they were delivered.
• Staff and team information — account details, role and permission level for people who work with us.

Some of this is special category data (health, disability and SEND information) and safeguarding information can be particularly sensitive. We only collect it where it is necessary to look after children safely, and we keep access tightly limited.

We do not ask for NHS numbers. We do not use your information to build profiles or to make automated decisions about you.

To book a holiday club place we need your contact details, your child's details, medical, allergy and dietary information, at least one authorised collector, a collection codeword, emergency medical consent and acceptance of our booking terms — without these we cannot safely accept a booking.

Optional: your child's Photo & Marketing Consent answer is your choice (you can say no and this does not affect your booking), marketing emails are optional and off unless you opt in, extra notes are optional, and optional cookies are off unless you turn them on.

We rely on the following lawful bases under UK GDPR:

• Contract — to take and manage your booking, run the club or tutoring sessions, take payment and give refunds, and contact you about your booking.
• Legal obligation — to keep financial records, meet health and safety duties, and comply with safeguarding and child protection responsibilities.
• Legitimate interests — to run and improve our services, keep our website and accounts secure, answer enquiries, and keep accurate records of what we have been asked to do.
• Consent — for using photographs of your child in marketing, and for marketing emails. You can withdraw either at any time.
• Vital interests and safeguarding — where urgent action is needed to protect a child's life or welfare.

For health, SEND and safeguarding information we also rely on the additional conditions in UK GDPR Article 9 and the Data Protection Act 2018 that cover health and social care, safeguarding of children, and vital interests. The precise conditions that apply to our activities, and whether an appropriate policy document or data protection impact assessment is required, are matters we are reviewing with professional advice. This policy is a description of what we do — it is not legal advice and is not a statement that every requirement has been formally certified.

We do not sell your information. We share it only where we need to:

• Our own team — club leaders and staff see the register, medical, allergy and collection information they need to keep your child safe on the day. Administrators have wider access to manage bookings and families.
• Stripe Payments Europe Ltd — takes and processes your payment (including PayPal, which we offer through Stripe).
• Our hosting, database and sign-in provider — stores our data and runs the Parent Portal (Supabase infrastructure provided through the Lovable platform).
• Our email delivery provider — sends account, booking and service emails on our behalf and tells us whether they were delivered.
• Google Fonts — serves the typeface on our pages; your device requests the font files from Google.
• Schools, the local authority, the police, health professionals or the NHS — where we must share safeguarding or medical information to protect a child, or where we are legally required to.
• Professional advisers, insurers and regulators — where necessary.

We do not use analytics, advertising or social media tracking on this website. See our Cookie Policy for the full technical detail, and Cookie Settings to change your choices.

Our suppliers are established providers used widely in the UK and Europe, but some of them operate global infrastructure and may process or support data outside the UK. We are reviewing the exact storage locations and transfer safeguards (such as the UK International Data Transfer Agreement or Addendum) with each provider, and we will update this policy with that detail once confirmed. We have not stated a guaranteed UK-only position because we cannot verify that today.

If this matters to you, please contact us and we will tell you what we have confirmed so far.

We keep information only as long as we need it. Our current retention framework is set out below. Historic records are not deleted automatically — retention is reviewed by a member of our team before anything is removed.

The accident/incident and safeguarding periods are the working periods we apply; they are subject to confirmation with our safeguarding and legal advisers and may change.

Our services are for primary-aged children, and we collect children's information from their parent or carer rather than from the child. Children do not have their own accounts with us. Parent Portal accounts, bookings, consents and permissions are managed by an adult with parental responsibility.

We ask you to review and confirm your child's details each year before booking, so that medical, allergy, SEND and emergency information stays accurate.

Photo & Marketing Consent is recorded separately for each child, so siblings can be treated differently. If you have not answered, we treat it as no permission. You can change your answer at any time in the Parent Portal under “My Children”, and we keep a record of when permission was given or withdrawn.

Marketing emails are optional, switched off by default, and never required to use our services. You can opt in or out at any time in the Parent Portal under “Privacy & My Data”, or by using the unsubscribe link in any marketing email. Booking confirmations, payment and cancellation emails, changes to your sessions, safety information and account emails are service emails and are sent regardless of your marketing choice.

You have the right to:

• ask what we hold about you and your child, and receive a copy;
• have inaccurate information corrected;
• ask us to delete information, where we do not need to keep it;
• ask us to restrict or object to how we use it;
• receive certain information in a portable format;
• withdraw consent for photographs or marketing at any time;
• complain to the Information Commissioner's Office.

You can ask us to delete your account and personal information from the Parent Portal under “Privacy & My Data”, or by emailing us. Each request is reviewed by a person. We will tell you what we have deleted, and where we have had to keep something — for example financial records, accident records or safeguarding information — we will explain why.

We aim to respond to any request within one month. You will not be charged, and exercising your rights will not affect the service your child receives.

You can contact the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Access to family and child information is restricted by role: parents can only see their own family's records, club staff see only what they need for the sessions they are running, and wider access is limited to administrators. Our database enforces these restrictions at the data level, sign-in is protected by our authentication provider, and administrative changes to bookings are recorded with the account that made them.

No system can be guaranteed completely secure, but we take security seriously and review it as our services grow. If a breach were to affect your rights, we would notify you and the ICO as required.

We may update this policy as our services, suppliers or legal obligations change. Where changes are significant we will tell families directly. Please check the date at the top of this page.

Last updated: 20 September 2026

Citrus Education Group Ltd, registered in England and Wales, company number 17267381. Email hello@citruseducationgroup.com, or for safeguarding matters safeguarding@citruseducationgroup.com.