1. Who We Are
This notice is issued by Nova House Publications Limited, trading as Nova Education (“Nova”, “we”, “us”, “our”). We are an independent educational publisher and tutoring provider. We publish practice materials for children preparing for selective school entry at 7+, 8+, 11+ and ISEB Pre-Test, and we deliver online tutorial programmes, and INSET training to primary schools. For the purposes of UK data protection law we are the data controller for all personal data described in this notice.
| Detail | Information |
|---|---|
| Legal name | Nova House Publications Limited |
| Trading name | Nova Education |
| Registered address | 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ |
| Companies House number | 14561787 |
| ICO registration | ZC126210 |
| Website | novaeducation.uk |
| Data Protection Lead | Cliff Hall, Director |
| Data protection enquiries | contact@novaeducation.uk, please mark ‘Data Protection’ in the subject line |
2. What This Notice Covers
This notice applies to novaeducation.uk and all related subdomains, to the accounts and course materials delivered through our learning platform, to the books and digital products we sell, to our online tutorial programmes, and to our INSET courses for schools. It also explains how we handle the personal data of the self-employed tutors who work with us.
It sits alongside three further documents. Our Cookie Policy explains what cookies we set and why. Our Data Protection & Privacy Policy is our detailed internal privacy policy governing how we handle data across the business, including our retention schedules, breach procedure and security measures, and is available on request. Our Safeguarding & Child Protection Policy governs how we handle safeguarding records.
You may fall into more than one group
A parent might buy a book, hold a platform account, and enrol a child in a tutorial programme. Where that is the case, every part of this notice that applies to those relationships applies to you. We keep the data held for each purpose separate and use it only for the purpose it was collected for.
3. The Information We Collect
What we collect depends on how you interact with us. We do not collect personal data speculatively, and we do not buy personal data from third parties.
| Who You Are | What We Collect | Where It Comes From |
|---|---|---|
| Website visitors | IP address and session data needed for the website to function and to remain secure. We use Umami to count visits: pages visited, referring website, browser, operating system, device type and approximate location. It sets no cookies, and we do not use advertising or tracking technologies. | Collected automatically by strictly necessary cookies and server logs; visit counts are collected by Umami |
| Book and digital product customers | Name, email address, billing and delivery address, order history, and payment confirmation. Card details are handled by our payment processor and are never held by Nova. | Provided by you at checkout |
| Platform account holders | Name, email address, password, course enrolments, and progress through course materials. | Provided by the account holder. Children do not create their own accounts. See Clause 5. |
| Families making an enquiry | Parent name and contact details, the child’s name, year group, current school and target schools, and notes from a consultation. | Provided by the parent or carer by form, email, telephone or consultation booking |
| Enrolled families and students | Everything above, plus session attendance and scheduling records, session notes, reports, assessments and test results, and written work, and any health or welfare information a parent chooses to tell us. | Provided by the parent or carer, and generated by the tutor during the programme |
| Tutors and tutor applicants | Name and contact details, qualifications and experience, DBS certificate reference and outcome, self-employment and payment details, and a photograph and biography where a tutor profile is published. | Provided by the tutor, and from the Disclosure and Barring Service |
| Schools and INSET delegates | School name, delegate names and work email addresses, booking and attendance records, and certification details. | Provided by the school or the delegate |
4. Why We Use It and Our Lawful Basis
We only use personal data where the law allows. The table below sets out each purpose and the lawful basis we rely on.
| Purpose | Lawful Basis |
|---|---|
| Selling and delivering books and digital products, managing orders and returns | Contract |
| Creating and managing a platform account and giving access to purchased materials | Contract |
| Responding to an enquiry and arranging a consultation | Legitimate interests: responding to a request you have made |
| Counting visits to the website to see which pages are useful and to improve it | Legitimate interests: understanding how the website is used |
| Delivering tutorial programmes: scheduling, allocating a tutor, teaching, administering and marking assessments, issuing session notes and reports, and maintaining the programme record | Contract |
| Adapting delivery to a child’s health, wellbeing or learning needs | Explicit consent for health information a parent chooses to give us (Article 9(2)(a)) |
| Discharging our safeguarding obligations, including making referrals where necessary | Legal obligation, and substantial public interest under Article 9(2)(g) and Schedule 1 of the Data Protection Act 2018 |
| Taking payment, issuing invoices and keeping accounting records | Contract, and legal obligation for tax records |
| Engaging tutors, verifying their DBS status and administering their payment | Contract, and legal obligation |
| Publishing a tutor profile to promote our programmes | Legitimate interests: the tutor may object at any time |
| Delivering INSET courses and issuing CPD certification | Contract |
| Sending marketing about our own similar products and services | Legitimate interests (within the PECR soft opt-in, see Clause 8) |
| Publishing a testimonial | Consent, given in writing before publication |
| Keeping the website secure and working | Legitimate interests: operating the website |
| Monitoring the quality of our teaching using programme records and reports | Legitimate interests: maintaining standards across the tutor team |
5. Children’s Data
Every student enrolled in a Nova tutorial programme is a child. Processing children’s data carries heightened obligations under UK GDPR and the ICO’s Age Appropriate Design Code, and we apply the following rules.
All data about an enrolled student is provided by a parent or carer. We do not collect personal information directly from children.
Children do not create their own accounts on our platform. Accounts are held by the parent or carer, who controls access to the course materials.
Parents and carers exercise all data protection rights on behalf of their child throughout the programme.
We do not use children’s data for profiling, behavioural advertising, or any commercial purpose beyond delivering the programme, and we never send marketing to a child.
A child’s data is shared only with the processors listed in Clause 9, and only as far as delivering the programme requires. It is never shared for commercial purposes.
Where a session is delivered to a pair or trio of students, each child’s records, notes and reports are prepared and held separately. No record relating to one child is shared with another family in the group.
6. Sensitive Information
Some information carries additional protection in law. We handle three kinds. Health and welfare information, where a parent chooses to tell us about an illness, a medical condition or a special educational need, is used only to adapt delivery of our service or to explain an absence, and rests on the parent’s explicit consent. Safeguarding information is handled under our Safeguarding & Child Protection Policy and rests on substantial public interest. Information about criminal convictions, offences and allegations relates to tutors and staff only, arises from DBS checks and from the notifications a tutor is contractually required to give us, and rests on the substantial public interest condition for protecting children at risk.
We do not keep copies of DBS certificates. We record only the certificate reference number, its date of issue and the outcome. The full conditions we rely on, and the Appropriate Policy Document required by Schedule 1 of the Data Protection Act 2018, are set out in our Data Protection & Privacy Policy, available on request.
7. Session Recordings
We do not record tutorial sessions
For safeguarding reasons, Nova does not record its online tutorial sessions. No audio or video recording of a session is made, stored or shared, and there is no opt-in to recording. If this position ever changes, we will update this notice and tell enrolled families before any recording begins.
8. Marketing
We may send you email about our own programmes, course books and resources where you have bought from us, enrolled with us, or made an enquiry. This relies on the soft opt-in under the Privacy and Electronic Communications Regulations, which permits marketing of similar products to existing and prospective customers.
| Who We Contact | What We Send |
|---|---|
| Current and past customers and families | Further programmes, new course books, and resources relevant to the next stage of preparation |
| Families who enquired but did not enrol, for 12 months from last contact | Information about programmes relevant to the original enquiry. After 12 months the enquiry record is deleted. |
| Schools and INSET delegates | Information about further courses and training relevant to the school |
Opting out
Every marketing email carries a one-click unsubscribe link, and you can also write to us at contact@novaeducation.uk. The right to object to direct marketing is absolute: we act on it immediately and permanently, and it has no effect on any programme, order or account you hold with us.
What we do not do
- We do not sell, rent or share personal data with third parties for their own marketing purposes
- We do not send marketing communications to children
- We do not use programme data to target individuals through social media advertising or paid digital channels
- We do not profile customers or build behavioural advertising audiences
- We do not contact anyone who has opted out
10. International Transfers
Some of the platforms above are based outside the United Kingdom, so your data may be transferred abroad. UK GDPR restricts such transfers unless adequate protection is in place. The safeguards we rely on are set out below, and we monitor their status and will change our arrangements promptly if any of them is amended or withdrawn.
| Destination | Safeguard |
|---|---|
| United States (Zoom, Calendly, Google) | UK Extension to the EU–US Data Privacy Framework, known as the UK–US Data Bridge. Each provider is certified under it. |
| European Union (LearnWorlds, Greece) | UK–EU adequacy regulations: the UK recognises the EU as providing an adequate level of protection. |
| United Kingdom (TutorCruncher, Stripe UK, Nova tutors) | No international transfer: processing takes place in the UK. |
12. How Long We Keep It
We do not keep personal data longer than we need it. Our holdings are reviewed against the schedule below each year and expired data is deleted promptly. The full schedule appears in our Data Protection & Privacy Policy.
| What | How Long |
|---|---|
| Customer, enrolment and contact records, including your accepted Terms and Conditions and enrolment confirmation | Duration of the relationship, then 7 years |
| Programme records, session notes, reports and scores | 7 years from completion of the programme |
| Safeguarding records | 7 years from the date of the record, or until the child’s 25th birthday, whichever is later |
| Payment and financial records | 7 years from the end of the relevant tax year |
| Enquiry records where no enrolment followed | 12 months from last contact |
| Tutor engagement records | 7 years from the end of the engagement |
| DBS reference numbers and status check records | Duration of the engagement, then 6 months |
| Testimonials | For as long as in use, then 12 months after consent is withdrawn |
| Marketing opt-out records | Kept indefinitely, so that we do not contact you again by mistake |
| Website server logs | 90 days |
13. Your Rights
You have a number of rights over your own personal data, and parents and carers may exercise them on behalf of their child. To use any of them, write to us at contact@novaeducation.uk. We may ask you to confirm your identity first.
| Right | What It Means |
|---|---|
| To be informed | To know what we hold, why we hold it and how we use it. This notice is how we meet that obligation. |
| Access | To receive a copy of the personal data we hold about you. |
| Rectification | To have inaccurate data corrected or incomplete data completed. |
| Erasure | To ask us to delete data we no longer need. This right is not absolute and does not extend to records we are required by law to keep, including safeguarding and financial records. |
| Restriction | To ask us to pause our use of your data, for example while you contest its accuracy. |
| Portability | To receive data you gave us in a machine-readable format, or have it sent to another provider. |
| Objection | To object to processing based on legitimate interests, and to object to direct marketing at any time. The marketing objection is absolute. |
| Withdrawal of consent | Where we rely on your consent, to withdraw it at any time. |
| Automated decisions | Not to be subject to a decision made solely by automated means with a significant effect on you. We do not take decisions in that way. |
How quickly we respond
We respond to any rights request within one month. If a request is particularly complex we may extend that by up to two further months, and we will tell you within the first month if that is necessary. There is no charge for exercising your rights.
14. How We Keep Data Safe
We apply technical and organisational measures appropriate to the sensitivity of what we hold, and we limit access to those who need it for their role.
- Access is restricted by role, and tutors in their capacity as self-employed tutors delivering a course of tuition see only the students they teach; where a tutor changes, the incoming tutor is given that student’s programme records so that teaching continues without interruption
- Password protection and two-factor authentication on every system holding personal data
- Encrypted cloud storage for programme records
- Written data processing agreements with every platform we use, requiring equivalent standards
- Tutors work in Nova-approved systems, on encrypted and passcode-protected equipment, and delete local copies once a report has been submitted
- Data protection training for all tutors and staff at induction and on any material change of policy
If a personal data breach occurs, we follow a documented procedure. Where the breach is likely to result in a risk to people’s rights and freedoms we notify the Information Commissioner’s Office within 72 hours, and where the risk is high we notify the individuals affected without undue delay.
15. Changes to This Notice
We review this notice at least once a year, and sooner if the law, our systems or our services materially change. The current version is always published at novaeducation.uk and is available in hard copy on request. Where we make a material change we will email enrolled families, account holders and tutors with a summary of what has changed and the date it takes effect. Previous versions are retained for five years. This notice supersedes the Nova House Publications Limited Privacy Policy dated February 2026.
16. Contact Us and Complaints
For any question about this notice, or to exercise any of your rights, contact our Data Protection Lead at contact@novaeducation.uk, marking the subject line ‘Data Protection’, or write to Data Enquiries, Nova House Publications Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.
If you are unhappy with how we have handled your personal data you have the right to complain to the Information Commissioner’s Office at ico.org.uk, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather have the chance to put things right first, so please come to us before you approach the ICO if you feel able to.
17. Governing Law
This notice, its subject matter and its formation are governed by the law of England and Wales, and are subject to the exclusive jurisdiction of the courts of England and Wales.