This Schools & Organisations Agreement (the "Agreement") sets out the terms on which Tutorio Ltd provides the Tutorio Service to schools, colleges, multi-academy trusts, local authorities, tutoring agencies and other organisations (each an "Organisation"). It incorporates the Terms of Service and the Tutoring & Live Lessons Terms, and includes our standard data processing terms. Where an Organisation has signed a separate order form, contract or data processing agreement with us, that document takes precedence to the extent of any conflict.
The parties and how the Agreement is formed
This Agreement is between Tutorio Ltd (company number 14962372) and the Organisation. It is formed when the Organisation's authorised representative accepts it - by signing an order form, by creating an organisation on Tutorio, or by using organisation features - and continues until terminated in accordance with this Agreement.
What we provide
- An organisation workspace in which named administrators can invite and manage tutors and staff, create classes, connect learners, share a course library between colleagues and view results across the Organisation.
- Join links, QR codes and codes that connect the Organisation's learners to its tutors.
- The learner experience described in the Terms of Service, including courses, practice, live lessons, assignments, reviews, screening tests and, where enabled, AI features.
- Security and compliance features including a configurable password policy, account lockout, multi-factor sign-in through Apple and Google, role-based access control and an extractable audit trail.
- Support during UK business hours by email, and the security and compliance information published at tutorio.app/compliance.
The Organisation's responsibilities
- Nominate at least one administrator and keep their contact details current.
- Ensure that staff who use Tutorio are appropriately vetted and trained for the learners they teach, and comply with the Tutoring & Live Lessons Terms and the Safeguarding Policy.
- Have a lawful basis for putting learner and staff data into Tutorio and provide the privacy information required by law to those individuals (and, for children, to their parents or guardians where appropriate). Our Children's Privacy & Parents policy describes what we do on our side.
- Manage access: revoke accounts when staff or learners leave, and tell us promptly if an account may have been compromised.
- Use the Service in accordance with the Terms of Service, the Acceptable Use Policy and applicable law, and ensure its users do the same.
- Pay the fees in any order form on time.
Fees and term
Fees, the number of licences and the subscription term are set out in the order form or the plan selected in the Service. Unless the order form says otherwise, subscriptions renew automatically for successive terms of the same length unless either party gives at least 30 days' notice before renewal. Fees are exclusive of VAT, which is charged where applicable. Invoices are payable within 30 days.
Data processing terms
This section applies to personal data the Organisation puts into the Service or that Tutorio collects from the Organisation's users on the Organisation's behalf ("Organisation Data"). It is intended to meet the requirements of Article 28 of the UK GDPR.
Roles
The Organisation is the controller of Organisation Data and Tutorio is its processor. Tutorio is an independent controller only for the limited purposes of securing the platform, billing, detecting fraud and abuse, producing aggregated non-identifying analytics, and complying with law.
Subject matter, nature and purpose
Tutorio processes Organisation Data to provide, secure and support the Service described in this Agreement, for the duration of the Agreement plus the retention period described below.
Categories of data subjects and data
- Learners: name or display name, email or username, class and organisation membership, year group or qualification, learning activity (answers, scores, progress, streaks, notes, drawings), screening test results, device and notification identifiers, and any content the learner creates.
- Staff and tutors: name, work email, role, classes, content they create, sign-in and audit records.
- Parents or guardians: where provided, name and contact details.
Tutorio does not require special category data. Organisations must not enter special category data (such as health or SEND details) into free-text fields unless a separate agreement covers it.
Our commitments as processor
- Instructions. We process Organisation Data only on the Organisation's documented instructions, which include this Agreement and the Organisation's use of the Service's settings. We will tell you if we believe an instruction breaks the law.
- Confidentiality. Our staff who access Organisation Data are bound by confidentiality obligations and access is limited to what their role requires.
- Security. We maintain appropriate technical and organisational measures, including encryption in transit (TLS 1.2+) and at rest, ISO 27001 certified hosting, role-based access control, hashed passwords with configurable complexity, lockout and history rules, logging and monitoring, regular backups, and secure development practices. Details are published at tutorio.app/compliance.
- Sub-processors. We use the sub-processors listed in Sub-processors & Data Locations under written contracts imposing equivalent obligations. We will give at least 30 days' notice of any new sub-processor; the Organisation may object on reasonable data protection grounds, and if we cannot resolve the objection the Organisation may terminate the affected part of the Service without penalty.
- International transfers. Organisation Data, including backups, is stored in the United Kingdom. Where a sub-processor processes data outside the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum, as listed in the sub-processor page.
- Assistance. We will help the Organisation respond to data subject requests, carry out data protection impact assessments and consult the ICO, taking into account the nature of the processing and the information available to us.
- Breach notification. We will notify the Organisation without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Organisation Data, and will provide the information reasonably required for the Organisation to meet its own notification duties.
- Deletion and return. On termination, or on the Organisation's request, we will delete or return Organisation Data within 90 days, unless the law requires us to keep it. Learners may retain their own independent accounts and personal learning history, disconnected from the Organisation, unless the Organisation instructs otherwise for accounts it created.
- Audit. We will make available the information reasonably necessary to demonstrate compliance, including our completed security questionnaire, policies and third-party certifications of our hosting providers, and will allow audits by the Organisation or its appointed auditor on reasonable notice, no more than once a year unless required by a regulator or following a breach.
- AI. Where AI features are enabled, Organisation Data is sent to AI providers only for the request in hand, under data processing terms that prohibit its use to train their models. AI features can be disabled for the Organisation on request. See the AI Transparency Statement.
The Organisation's commitments as controller
The Organisation is responsible for the lawfulness of the Organisation Data it provides, for issuing privacy notices, for handling its own data subject requests (with our help), and for the instructions it gives us.
Safeguarding
Both parties will comply with the Safeguarding Policy. The Organisation will nominate a safeguarding contact. Tutorio will pass any safeguarding concern it receives about the Organisation's learners or staff to that contact without delay, and may also report to statutory authorities where it is legally required or where a child is at risk.
Intellectual property
Tutorio retains all rights in the Service and its content. The Organisation retains rights in content its staff create, licensing it to Tutorio as set out in the Terms of Service so that it can be hosted and shared within the Organisation. Content created by a member of staff in the Organisation's workspace remains available to the Organisation if that member of staff leaves.
Warranties and liability
Each party warrants that it has authority to enter into this Agreement. Tutorio warrants that it will provide the Service with reasonable skill and care and substantially as described. Except as set out here, all other warranties are excluded to the extent permitted by law.
Neither party excludes liability for death or personal injury caused by negligence, fraud, or anything that cannot lawfully be excluded. Subject to that, each party's total liability under this Agreement in any 12-month period is limited to the fees paid or payable by the Organisation in that period (or £1,000 if greater), and neither party is liable for indirect or consequential loss, loss of profit or loss of goodwill. Tutorio's liability for breach of the data processing terms is subject to the same cap unless a signed agreement provides otherwise.
Term and termination
Either party may terminate this Agreement on written notice if the other commits a material breach that is not remedied within 30 days of notice, or becomes insolvent. Tutorio may suspend access immediately where necessary to protect learners, users or the Service, giving notice as soon as practicable. On termination, licences end, and the deletion and return provisions above apply. Fees already paid are not refundable except where we terminate for convenience or as required by law.
General
This Agreement may not be assigned without consent (not to be unreasonably withheld), except to a successor in business. Notices must be sent by email to the addresses on the order form or, for Tutorio, to [email protected]. If any provision is unenforceable the remainder continues. This Agreement is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.
Contact
Commercial and legal questions: [email protected]. Security questionnaires and DPIA support: [email protected]. Data protection: [email protected].