Privacy Policy

Last Updated: 9 August 2026

1. Introduction

Welcome to NextGenBright.

NextGenBright provides online education, tutoring, learning resources, courses, assessments, scheduling and related educational services. We are committed to protecting the privacy and security of the personal information entrusted to us by students, parents and guardians, tutors, visitors and other users of our services.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

  • Visit or use the NextGenBright website;

  • Create or use a NextGenBright account;

  • Register as a student, parent/guardian or tutor;

  • Book or attend lessons;

  • Purchase courses or educational services;

  • Communicate with us;

  • Use our learning platforms, applications or online services; or

  • Otherwise interact with NextGenBright.

This policy should be read together with our Terms and Conditions, Cookie Policy, Refund Policy and any other policies that apply to our services.

2. Who We Are

For the purposes of applicable UK data protection legislation, the organisation responsible for your personal data is the relevant NextGenBright operating entity.

Brand: NextGenBright
Website: NextGenBright online platform and associated websites
Contact email: info@nextgenbright.com

For privacy-related questions, requests or concerns, please contact us using the email address above.

Where another organisation processes personal data on our behalf, that organisation may act as a data processor under our instructions.

3. Data Protection Legislation

We process personal information in accordance with applicable UK data protection legislation, including:

  • UK General Data Protection Regulation (UK GDPR);

  • Data Protection Act 2018;

  • Privacy and Electronic Communications Regulations (PECR);

  • Children's Code (Age Appropriate Design Code), where applicable; and

  • Other applicable UK privacy and data protection legislation.

We aim to process personal information fairly, lawfully and transparently.

4. Personal Information We Collect

The information we collect depends on how you use NextGenBright.

4.1 Information Provided by Students

Depending on the services used, we may collect:

  • Full name;

  • Date of birth or age;

  • Email address;

  • Telephone number;

  • Username and account details;

  • Password or authentication information;

  • Educational level/year group;

  • School or educational institution;

  • Subjects studied;

  • Course enrolments;

  • Learning preferences;

  • Assessment results;

  • Assignment submissions;

  • Homework;

  • Tutor feedback;

  • Attendance information;

  • Lesson history;

  • Learning progress;

  • Communications with tutors and NextGenBright;

  • Profile information;

  • Certificates or achievements;

  • Technical information associated with the student's account.

We only request information that is reasonably necessary for providing our services.

5. Parent and Guardian Information

Where a student is under the age of 18, we may collect information about their parent or legal guardian, including:

  • Parent/guardian name;

  • Relationship to the student;

  • Email address;

  • Telephone number;

  • Billing address;

  • Communication preferences;

  • Account login information;

  • Payment and transaction information;

  • Booking and lesson information;

  • Consent or authorisation information;

  • Communications with NextGenBright;

  • Information relating to the student's learning and progress where appropriate.

Parents or guardians may be given access to appropriate information concerning a child they are responsible for, subject to applicable law and our verification procedures.

6. Tutor Information

Tutors may be required to provide:

  • Full name;

  • Contact details;

  • Email address;

  • Telephone number;

  • Address;

  • Qualifications;

  • Teaching experience;

  • Subjects and courses taught;

  • Professional profile;

  • Availability;

  • Employment or engagement information;

  • Identity verification information;

  • Right-to-work information where applicable;

  • References or verification information;

  • DBS or safeguarding information where legally required or appropriate;

  • Payment information;

  • Tutor performance and feedback information;

  • Communications with NextGenBright;

  • Lesson and attendance information.

Where appropriate, tutor information may be verified using third-party services.

7. Payment Information

When you purchase services from NextGenBright, payments may be processed by third-party payment providers.

We may receive information such as:

  • Transaction amount;

  • Transaction date;

  • Payment status;

  • Payment method;

  • Billing information;

  • Limited payment-card information;

  • Payment provider transaction/reference IDs.

We generally do not store complete payment card numbers, CVV numbers or other sensitive card authentication information on our own systems.

Payment information may be processed directly by authorised payment service providers.

8. Information Collected Automatically

When you access our website or online services, we may automatically collect certain technical information, including:

  • IP address;

  • Browser type and version;

  • Operating system;

  • Device type;

  • Screen resolution;

  • Approximate location derived from IP address;

  • Language and regional settings;

  • Website pages visited;

  • Date and time of access;

  • Referring website;

  • Session information;

  • Device identifiers;

  • Log information;

  • Website interaction information.

Some of this information may be collected through cookies and similar technologies.

Further information is provided in our Cookie Policy.

9. Learning and Educational Information

To provide effective educational services, we may process information relating to a student's learning activity, including:

  • Course enrolments;

  • Lesson bookings;

  • Attendance;

  • Assessment results;

  • Homework;

  • Assignments;

  • Tutor comments;

  • Learning progress;

  • Test results;

  • Course completion;

  • Certificates;

  • Academic targets;

  • Feedback;

  • Learning resources accessed.

This information allows us to provide, manage and improve educational services.

10. Communications

When you contact us, we may retain information contained in your communication, including:

  • Emails;

  • Contact forms;

  • Support requests;

  • Messages;

  • Feedback;

  • Complaints;

  • Booking enquiries;

  • Account-related communications.

We use this information to respond to you, provide support, investigate issues and maintain appropriate business records.

11. Children's Personal Data

NextGenBright may provide educational services to children and young people.

We recognise that children require additional protection when their personal information is processed.

Where appropriate, we may require a parent or legal guardian to create or authorise an account, purchase services or provide consent.

We aim to:

  • Collect only information reasonably necessary for providing our services;

  • Explain privacy information in an age-appropriate manner where appropriate;

  • Avoid unnecessary profiling of children;

  • Apply appropriate access controls;

  • Protect children's educational information;

  • Limit access to information to authorised individuals;

  • Apply appropriate retention periods;

  • Provide mechanisms for parents or guardians to exercise applicable rights.

We do not knowingly request unnecessary sensitive information from children.

Where consent is required by law for processing a child's personal data, we will take appropriate steps to obtain or verify the required consent.

Parents and guardians may contact us at info@nextgenbright.com regarding the processing of a child's personal data.

12. How We Use Personal Information

We may use personal information for the following purposes:

Providing our services

  • Creating and managing accounts;

  • Providing online lessons;

  • Managing courses;

  • Scheduling classes;

  • Connecting students with tutors;

  • Providing educational resources;

  • Recording attendance;

  • Managing assessments;

  • Tracking learning progress;

  • Issuing certificates;

  • Providing customer support.

Managing payments

  • Processing purchases;

  • Managing subscriptions;

  • Processing refunds;

  • Detecting fraudulent transactions;

  • Maintaining financial records.

Account management

  • Creating accounts;

  • Authenticating users;

  • Maintaining account security;

  • Resetting passwords;

  • Communicating account notifications.

Communications

  • Responding to enquiries;

  • Sending service-related notifications;

  • Providing booking confirmations;

  • Sending lesson reminders;

  • Communicating changes to services;

  • Handling complaints.

Improving our services

We may analyse aggregated or appropriately anonymised information to:

  • Improve our platform;

  • Improve course content;

  • Understand usage patterns;

  • Identify technical problems;

  • Improve user experience;

  • Develop new educational services.

Security and fraud prevention

We may process information to:

  • Protect accounts;

  • Detect suspicious activity;

  • Prevent fraud;

  • Investigate security incidents;

  • Protect our users and systems.

Legal and regulatory purposes

We may process information where necessary to:

  • Comply with legal obligations;

  • Respond to lawful requests;

  • Establish, exercise or defend legal claims;

  • Maintain appropriate records;

  • Protect our legal rights.

13. Legal Bases for Processing

Under the UK GDPR, we rely on one or more lawful bases for processing personal information.

13.1 Contract

We may process personal information where it is necessary to perform a contract with you or take steps at your request before entering into a contract.

Examples include:

  • Creating your account;

  • Providing tutoring;

  • Processing bookings;

  • Delivering courses;

  • Processing payments;

  • Managing subscriptions.

13.2 Legal Obligation

We may process information where necessary to comply with a legal obligation.

Examples include:

  • Accounting requirements;

  • Tax obligations;

  • Legal requests;

  • Regulatory requirements;

  • Safeguarding obligations.

13.3 Legitimate Interests

We may process information where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

Examples may include:

  • Maintaining platform security;

  • Preventing fraud;

  • Improving services;

  • Managing our business;

  • Responding to enquiries;

  • Protecting our legal rights.

13.4 Consent

Where required, we may rely on consent.

Examples may include:

  • Certain marketing communications;

  • Certain optional cookies;

  • Certain optional uses of personal information.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

14. Marketing

We may send information about NextGenBright services where permitted by applicable law.

Marketing communications may include:

  • New courses;

  • Educational programmes;

  • Promotions;

  • Events;

  • Platform updates;

  • Relevant educational opportunities.

Where required, we will obtain appropriate consent before sending electronic marketing communications.

You can unsubscribe from marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us at:

info@nextgenbright.com

Service and transactional communications may still be sent where necessary to provide services you have requested.

15. Cookies and Similar Technologies

NextGenBright may use cookies and similar technologies.

Cookies may be used for:

  • Essential website functionality;

  • Authentication;

  • Security;

  • Remembering preferences;

  • Analytics;

  • Performance monitoring;

  • Improving user experience;

  • Marketing, where permitted and appropriately consented to.

Non-essential cookies will be used in accordance with applicable law.

Please refer to our separate Cookie Policy for further information.

16. Sharing Personal Information

We do not sell personal information to third parties.

We may share personal information with trusted organisations where necessary to provide our services or meet legal obligations.

These may include:

  • Payment processors;

  • Hosting providers;

  • Cloud service providers;

  • Learning management system providers;

  • Email service providers;

  • Customer support platforms;

  • Scheduling providers;

  • Video-conferencing providers;

  • Analytics providers;

  • IT and cybersecurity providers;

  • Professional advisers;

  • Accountants;

  • Legal advisers;

  • Government authorities;

  • Regulators;

  • Law enforcement agencies where legally required.

Third-party service providers are expected to process personal information only for appropriate purposes and to apply appropriate security measures.

17. Tutors and Student Information

To provide tutoring services, appropriate student information may be made available to the tutor assigned to the student.

This may include:

  • Student name;

  • Relevant educational level;

  • Course or subject;

  • Lesson information;

  • Learning objectives;

  • Relevant assessment information;

  • Appropriate learning progress information.

Tutors must only use student information for legitimate educational purposes and must comply with applicable NextGenBright policies and confidentiality requirements.

18. Parent and Guardian Access

Where applicable, parents or legal guardians may receive information concerning a child's NextGenBright account and educational progress.

The information provided may include:

  • Attendance;

  • Course enrolment;

  • Lesson information;

  • Progress;

  • Assessment results;

  • Tutor feedback;

  • Account information.

We may take reasonable steps to verify the identity and authority of a person requesting access to a child's information.

19. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods may depend on:

  • The type of information;

  • The purpose for processing;

  • Whether an account remains active;

  • Legal requirements;

  • Accounting requirements;

  • Safeguarding requirements;

  • Dispute resolution;

  • Fraud prevention;

  • Our legitimate business requirements.

When personal information is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it.

Some records may need to be retained for longer periods where required by law or necessary to establish, exercise or defend legal claims.

20. Data Security

We take reasonable technical and organisational measures to protect personal information.

These may include:

  • Access controls;

  • Authentication mechanisms;

  • Password protection;

  • Encryption where appropriate;

  • Secure hosting;

  • Monitoring and logging;

  • Backup systems;

  • Security updates;

  • Restricted staff access;

  • Staff confidentiality requirements;

  • Security procedures;

  • Incident management procedures.

No internet-based service can guarantee absolute security. You should therefore use strong passwords and avoid sharing your login credentials with others.

If you believe your account has been compromised, please contact us promptly at:

info@nextgenbright.com

21. Data Breaches

If we become aware of a personal data breach, we will assess the incident and take appropriate action in accordance with applicable data protection legislation.

Where legally required, we may notify the Information Commissioner's Office (ICO) and affected individuals.

Our response may include:

  • Containing the incident;

  • Investigating the cause;

  • Assessing potential risks;

  • Taking corrective measures;

  • Notifying relevant authorities where required;

  • Informing affected individuals where required.

22. International Data Transfers

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer complies with applicable UK data protection law.

Depending on the circumstances, safeguards may include:

  • UK adequacy regulations;

  • UK International Data Transfer Agreements;

  • UK Addendum to EU Standard Contractual Clauses;

  • Appropriate contractual safeguards;

  • Other legally recognised transfer mechanisms.

23. Third-Party Websites and Services

Our website or services may contain links to third-party websites, applications or services.

We are not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policy of any third-party service before providing personal information.

24. User Accounts

You are responsible for keeping your account credentials confidential.

You should:

  • Use a strong password;

  • Avoid sharing your password;

  • Log out from shared devices;

  • Notify us if you suspect unauthorised access.

We may suspend or restrict accounts where we reasonably believe there is a security risk or misuse of the platform.

25. Your Data Protection Rights

Subject to applicable law, you may have the following rights.

Right of Access

You may request a copy of personal information we hold about you.

Right to Rectification

You may request correction of inaccurate or incomplete information.

Right to Erasure

You may request deletion of your personal information in certain circumstances.

This is sometimes called the "right to be forgotten".

Right to Restriction

You may request that we restrict processing of your information in certain circumstances.

Right to Data Portability

Where applicable, you may request your personal information in a structured, commonly used and machine-readable format.

Right to Object

You may object to certain processing, including processing based on legitimate interests or certain direct marketing activities.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning automated decision-making and profiling.

Not every right applies in every situation. Some rights are subject to legal exceptions and conditions.

26. How to Exercise Your Rights

To exercise your data protection rights, contact:

Email: info@nextgenbright.com

Please provide enough information for us to identify you and understand your request.

For security purposes, we may need to verify your identity before providing information or making changes to an account.

We aim to respond to valid data protection requests within the timeframe required by applicable law.

27. Requests Concerning Children

Where a request relates to a child's personal information, we may need to verify:

  • The identity of the requester;

  • Their relationship with the child;

  • Their legal authority to make the request.

Depending on the child's age, maturity and applicable law, the child may also have rights concerning their own personal information.

We will consider these factors when handling requests involving children.

28. Complaints

If you have concerns about how we process your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

Email: info@nextgenbright.com

You also have the right to complain to the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)

The ICO provides information about data protection rights and how to make a complaint.

29. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be necessary because of:

  • Changes to our services;

  • Changes to technology;

  • Changes to applicable legislation;

  • Changes to our business practices;

  • New security requirements.

When we update this policy, we will update the "Last Updated" date at the beginning of the policy.

Where appropriate, we may provide additional notice of significant changes.

30. Contact Us

If you have any questions about this Privacy Policy, our data protection practices or your personal information, please contact us.

NextGenBright

Email: info@nextgenbright.com

We encourage users, parents, guardians and tutors to contact us whenever they have concerns about privacy or the handling of personal information.

31. Important Information for Parents and Guardians

If you are a parent or legal guardian registering a child for NextGenBright, you should ensure that:

  • The information you provide is accurate;

  • You have the appropriate authority to provide the child's information;

  • The child understands, where appropriate, how their information will be used;

  • Account credentials are kept secure;

  • You notify us if information changes;

  • You contact us if you have concerns about the child's privacy.

NextGenBright aims to provide a safe, secure and privacy-conscious educational environment for students and their families.

32. Effective Date

This Privacy Policy is effective from:

9 August 2026

NextGenBright
Privacy Contact: info@nextgenbright.com

Last modified: Sunday, 9 August 2026, 12:34 PM