Privacy policy

It is written for parents and guardians in plain language, but it is meant to be accurate and complete.

Sunrise Learning Academy Ltd, which trades as "Sunrise Learning" ("Sunrise Learning", "we", "us", "our"), runs an online one-to-one tutoring service at sunriselearninghub.com. We pair children of the African diaspora with tutors based in Nigeria. The children we teach live in places such as the United States, the United Kingdom, the European Union and Canada, so this policy is informed by the UK General Data Protection Regulation (UK-GDPR), the EU General Data Protection Regulation (EU-GDPR) and the Nigeria Data Protection Act (NDPA) 2023. Families in Canada, the United States and other countries also have rights under their own local privacy laws (for example, PIPEDA in Canada), and this policy is meant to work alongside those laws. Where more than one law applies, we aim to meet the highest standard.

This policy explains what personal information we collect, why we collect it, the legal grounds we rely on, who we share it with, where it goes, how long we keep it, how we protect it, and the rights you and your child have. Throughout this policy, "child" or "learner" means the minor who receives lessons, and "you" means the parent or guardian who holds the account.

Sunrise Learning Academy Ltd (company number 9643348), which trades as "Sunrise Learning", is the data controller for the personal information described in this policy. This means we decide what information is collected and how it is used. The company is registered in Nigeria, with its registered office at Sule Olalere Close, Ogo-Oluwa, Osogbo, Osun State, Nigeria, and was founded by Olujoke Olabomi.

If you have any question, request or concern about your privacy, or about your child's information, you can contact us by email at hello@sunriselearninghub.com or by WhatsApp on +234 803 812 5273. Please use these same contacts to exercise any of the rights described later in this policy. We will respond to any request without undue delay and normally within one month. If a request is complex or you have made several requests, we may need a little longer, and we will tell you if that is the case and why.

When you create and use a parent or guardian account, we collect the information needed to set up your account, arrange lessons and keep you informed. This includes: your full name; your email address; your phone number (if you choose to give it); your country; and your timezone. If you give us your phone number, we use it only to reach you about a lesson or an urgent scheduling change; it is optional and you do not have to provide it.

We also hold a password for your account. Your password is stored in a hashed (scrambled) form by our authentication provider. We never see or store your password in readable form.

We keep records of the discovery call you may book on our marketing site, and of the bookings you make once you have an account, including the lesson times you choose, the tutor and the subject.

When you pay for lessons, our payment provider (Paystack) processes the payment. We do not see or store your card number or full payment details. We keep only a payment reference, the amount, the currency and the status of each payment, so that we can confirm your booking, keep proper financial records and help with any query or refund.

We deliberately keep the information we hold about a child to the minimum needed to arrange and deliver lessons. You, the parent or guardian, add your child to your account, and you decide what to enter.

For each child we collect: the child's first name; their school year or grade; their level (optional); and the subject or subjects they are learning, which are captured when you make a booking. Together these make up the child's learning record.

You may also add optional free-text notes about your child (for example, learning needs or preferences). These notes are private to you. They are visible only to you inside your own account and are never shown to tutors. Please do not enter any information you do not want us to hold. In particular, we ask you not to include sensitive details (such as health or medical information) unless it is genuinely necessary, because we would prefer not to hold that kind of information at all. If you do choose to enter sensitive information in the notes, you are asking us to hold it, and we rely on your explicit consent as the parent to do so; we still keep it private to your account and never show it to tutors.

During a lesson, the tutor sees only your child's first name and the lesson details needed to teach: the school year or grade, the level if you added one, and the subject booked. Tutors do not see your child's private notes, your contact details, or your payment information, and they do not have access to your full account record.

We only use personal information for clear, specific reasons, and for each reason we rely on a lawful basis under the UK-GDPR, EU-GDPR and NDPA. The main uses are set out below.

To provide the service (lawful basis: performance of a contract, and, for the child's data specifically, your parental consent). We use your account details, your child's details and your bookings to create your account, match a suitable tutor, schedule and run lessons, and manage changes and cancellations.

To take payment (lawful basis: performance of a contract, and legal obligation). We use your payment reference, amount, currency and status to process payments through Paystack, confirm your bookings, and keep the financial records the law requires.

To communicate with you and run and secure the service (lawful basis: performance of a contract, our legitimate interests in running the service well and keeping it secure, and legal obligation where relevant). We send transactional and service emails such as booking confirmations and sign-in or authentication emails, we may contact you about your lessons or your account, and we use essential account and session information to authenticate you, protect accounts, prevent misuse and keep the platform reliable. Sunrise Learning sends only transactional and service messages of this kind; we do not send marketing or promotional email, and creating an account does not sign you up to any marketing list.

To meet our legal duties (lawful basis: legal obligation). We retain certain records, particularly payment and transaction records, to comply with tax, accounting and other legal requirements.

Where we rely on your consent, including a parent's or guardian's consent to process a child's information and to the international transfer described below, you can withdraw that consent at any time by contacting us. Withdrawing consent does not affect anything we did lawfully before you withdrew it, but it may mean we can no longer provide the service to your child.

Where we rely on legitimate interests, we have considered your interests and your child's interests and rights, and we only rely on this basis where it does not override them. You can ask us for more detail, or object, using the contacts above.

Our learners are children, and protecting their information is central to how we work. Under Nigerian law a child is anyone under 18. Under the UK-GDPR and EU-GDPR, online services aimed at children rely on the consent of a person with parental responsibility where the child is below the relevant age of digital consent (which varies between 13 and 16 across the UK and EU member states). For simplicity and safety, we rely on parental consent for every child on the platform.

This means a child's information is only ever added to Sunrise Learning by a parent or guardian, and it is processed on the basis of that parent's or guardian's explicit consent, given in your role as the person with parental responsibility. When you add a child, you give two linked confirmations: first, your consent for us to process that child's information so we can provide lessons; and second, your separate, informed consent to the transfer of your and your child's information to, and its access by, our tutors in Nigeria (a country that does not currently have a UK or EU adequacy decision, as explained in the international-transfers section below).

We rely on your confirmation that you hold parental responsibility for the child. We do not independently verify this beyond the account you hold and the consent record we keep, and we do not run a separate age-verification check. We are reviewing whether any additional age- or parental-responsibility verification is appropriate under Article 8 of the UK-GDPR and EU-GDPR (the "reasonable efforts" to verify parental consent).

We record your consent. When you add a child, we store a record that you, from your account, gave consent for that specific child, together with the date and time it was given, so that we can show the basis on which we hold that child's data. If you later remove the child or withdraw your consent, we act on that as described in this policy.

We collect only the limited child information described above, we keep tutors' access to a strict minimum, and we do not use a child's information for advertising or profiling, and we never sell it.

We do not sell your personal information and we do not share it for anyone else's marketing. We do share it with a small number of trusted service providers (processors and sub-processors) who help us run the service. Each of them acts only on our instructions and only for the purposes we set. They are:

Supabase - provides our database and account authentication (sign-in). Supabase stores your account and lesson information and holds your hashed password. The data is hosted in the European Union (Frankfurt, Germany, in the region known as eu-central-1).

Paystack - processes payments. Paystack handles your card and payment details directly; we receive back only a payment reference, amount, currency and status.

Resend - sends our transactional emails, such as booking confirmations and sign-in or authentication emails. To do this, Resend processes the recipient's email address and the content of those messages (which can include a child's first name and lesson details).

8x8 (Jitsi-as-a-Service) - provides the video technology for live lessons. Each lesson takes place in a private, per-session video room. We do not record lessons.

Vercel - hosts and delivers our website, so that pages load for you securely and reliably.

Cal.com - powers the scheduling of the free discovery call on our marketing site, processing the booking details you provide for that call.

We may also share information where the law requires it (for example, in response to a valid legal request), or to establish, exercise or defend legal claims, or to protect the safety of a child or another person. If our business is ever restructured or transferred, information may be shared as part of that process, and we would continue to protect it as described here.

Sunrise Learning is an international service, so your information moves across borders. The two most significant cross-border flows are these: first, your account and lesson data is stored in the European Union (with Supabase, in Frankfurt); and second, and importantly, that data is accessed and processed by tutors who are based in Nigeria, so they can prepare for and deliver lessons.

These are not the only flows. As set out in the section above on who we share your information with, some of our other providers - for example our email, video, hosting and scheduling providers - may process limited personal data in other countries, potentially including outside the EU and UK. We are not stating specific locations for those providers here yet; we will confirm the correct locations and the appropriate safeguards for each of them and state them here.

At present, Nigeria is not covered by a UK or EU "adequacy decision" - that is a formal finding that a country's data-protection standards are equivalent. For now, where the law needs an additional basis for the transfer to Nigeria, we rely on your explicit consent, as the parent or guardian, to the transfer of your and your child's information to our tutors in Nigeria for the purpose of providing lessons (consistent with Article 49 of the UK-GDPR and EU-GDPR). We explain this transfer to you clearly so that your consent is informed. We are also confirming whether appropriate safeguards (such as Standard Contractual Clauses or the UK International Data Transfer Agreement) should be the primary mechanism rather than consent, given that tutor access to lesson data is a regular and ongoing part of the service rather than a one-off transfer.

We are also putting appropriate safeguards in place to protect information that travels to Nigeria, and we are working to formalise these. We have not told you that any specific legal transfer mechanism (such as Standard Contractual Clauses or the UK International Data Transfer Agreement) is already signed, because we will only say that once it is genuinely in place. As these safeguards are finalised, we will update this policy.

If you would prefer that your child's information is not transferred to and accessed by tutors in Nigeria, then unfortunately we would not be able to provide lessons, because our tutors are located there. You can contact us to discuss this at any time.

We keep personal information only for as long as we need it, and no longer than the law allows or requires.

Account information (your details and your child's details) is kept while your account is active and for a reasonable period afterwards, so that you can return, and so we can deal with any follow-up questions. After that, we delete or anonymise it.

Payment and transaction records are kept for longer, because tax and financial laws require it. A typical retention period for such records is up to six years; the exact period depends on the tax and financial law that applies to us, which we will confirm and state here. For these records we keep only the limited payment reference, amount, currency and status described earlier, not card details.

When you remove a child from your account, our system anonymises that child's personal details in our systems - it strips out the information that identifies the child - while keeping non-identifying booking and payment records that we need for financial and legal purposes. In other words, the record that a lesson took place and was paid for can remain, but it is no longer linked to an identifiable child. Because tutors in Nigeria access lesson information to teach, we also instruct tutors to delete any local copies of a child's details when a child is removed; we cannot guarantee instant, universal deletion everywhere at the moment of removal, but we anonymise our own records and require tutors to do the same.

When you or we close your account, we delete or anonymise your personal information within a reasonable period, except for records we are legally required to keep for longer (again, mainly financial records).

We take the security of your information, and especially your child's information, seriously, and we use a combination of technical and organisational measures.

Information is encrypted in transit, so it is protected as it travels between your device and our providers. Passwords are stored in hashed form, so they are not held in readable text. Access to data is restricted using row-level controls, which are designed so that each account reaches only its own records, and tutors are given the least access they need to teach.

Video lessons take place in private, per-session rooms reached by unique links, and lessons are not recorded. As noted above, tutors never see a child's private notes or a parent's full account record or payment details.

We also have a process to detect, investigate and respond to personal-data breaches. If a breach happens, we will notify the relevant supervisory authority (the Nigeria Data Protection Commission, and the ICO or the relevant EU authority where the law requires) without undue delay and within the timeframes the applicable law sets. Where a breach is likely to result in a high risk to you or your child, we will also tell the affected parents or guardians. Because we serve children, we treat this as a priority, and we follow the notification timelines the applicable law sets.

No online service can promise perfect security, but we work to protect your information and to keep improving our safeguards, and we ask you to help by keeping your password confidential and contacting us promptly if you think your account has been misused.

You and your child have rights over personal information. Depending on the law that applies to you, these include: the right to access the information we hold; to have inaccurate information corrected (rectification); to have information erased; to restrict how we use it; to receive it, or have it sent to another provider, in a portable format; to object to certain uses; and, where we rely on consent, to withdraw that consent at any time.

Because our learners are children, you generally exercise these rights on your child's behalf as their parent or guardian. Depending on your child's age and where you live, an older child may also have the right to be involved in decisions about their own information or to exercise some of these rights themselves; if that applies, we will handle any request accordingly. Two of these rights are also built directly into the platform: you can update your child's details at any time, and you can remove a child, which anonymises their personal details as described above.

When you ask us to erase a child's data, we anonymise the details that identify the child, but please note that we may keep limited, non-identifying payment and transaction records where the law requires us to, as explained in "How long we keep your information". So the right to erasure applies to the identifying information, while a small amount of anonymised financial record may lawfully remain.

To make any request, contact us by email at hello@sunriselearninghub.com or by WhatsApp on +234 803 812 5273. Raising a request or a concern is free of charge, and we will respond without undue delay and normally within one month (extending this only if a request is complex, and telling you if we do). We may need to confirm your identity first, to make sure we are dealing with the right person and protecting the child's information.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You can also complain to a data-protection regulator at any time, in addition to (not instead of) contacting us, and doing so is free. Because we are based in Nigeria, you can complain to our home regulator, the Nigeria Data Protection Commission (NDPC). If you live in the United Kingdom, you may also complain to the Information Commissioner's Office (ICO). If you live in the European Union, you may complain to the supervisory authority in your country. If you live in Canada, the United States or elsewhere, you may also have the right to complain to your local data-protection or privacy regulator.

On our own platform we use only essential cookies - the small files needed to sign you in and keep you securely signed in during your session. These are necessary for the platform to work, so they cannot be turned off without breaking core features such as logging in.

We do not use advertising cookies, and we do not track you across other websites. We do not sell your personal information, and we do not use it to build advertising profiles.

One point about our marketing site: the free discovery call on our marketing site is scheduled through an embedded Cal.com widget. If that widget sets any cookies of its own when you book a call, they would be third-party scheduling cookies on the booking page rather than cookies set by us. If the widget does set cookies, we will update this section and add any consent step that may be needed.

We may update this policy from time to time - for example, when we finalise the safeguards for international transfers, appoint a UK or EU representative, add or change a service provider, confirm our retention periods, or when the law changes. When we make an important change, we will update the date at the top and, where appropriate, let you know.

If you have any question about this policy, about your information, or about your child's information, or if you want to exercise any of your rights, please contact us. We are here to help.

Email: hello@sunriselearninghub.com. WhatsApp: +234 803 812 5273. Controller: Sunrise Learning Academy Ltd (company number 9643348), trading as Sunrise Learning. Registered office: Sule Olalere Close, Ogo-Oluwa, Osogbo, Osun State, Nigeria.