Privacy Policy for ElevenAce.com

Last Updated: 3 July 2026

At ElevenAce.com (“Eleven Ace”, “we”, “us”), operated by Ace Education Academy Limited, we value your privacy and are committed to protecting the personal information you and your child provide to us. This Privacy Policy explains what we collect, why, how we protect it, how long we keep it, and the rights you have. It applies to our website, the Eleven Ace learning platform (tutor.elevenace.com), and our live classes.

Because we provide tutoring to children, this policy explains our approach to children's data and parental consent in Section 8 — please read it.

1. Who is responsible for your data (Data Controller / Data Fiduciary)

Ace Education Academy Limited (Company No. 10012032), registered at 7c Cranbrook House, 61 Cranbrook Road, Ilford, Essex, IG1 4PG, United Kingdom, is the data controller (UK/EU GDPR) and data fiduciary (India Digital Personal Data Protection Act 2023) for the personal data described in this policy. Contact details for our Data Protection / Grievance Officer are in Section 12.

2. Information we collect

• From the parent/guardian (the account holder): name, email address, phone number, and billing information provided at enrolment or in communication with us.
• About the learner (the child): name, date of birth / age, country, the subjects they study, progress and assessment results, attendance, and any notes a tutor or administrator records about their learning.
• Live-class media: classes are recorded as a standard part of our service. A recording contains the participants' video, audio, and any shared materials, and a text transcript may be generated from the recording. Transcripts may be analysed, including with the assistance of automated tools, to produce session summaries and progress feedback for tutors and parents. See Section 7 (Recordings).
• Usage and device data: device and browser type, IP address, and in-product activity (which features are used, and meeting join/leave/mute events), used to operate, secure, and improve the service. See Section 6 (Analytics) and Section 9 (Retention).

We do not store full payment card numbers; card payments are handled by our payment processor (Section 5).

3. The legal basis for using your data

We rely on the following lawful bases (UK/EU GDPR Article 6; India DPDP Act consent and legitimate-use provisions), by purpose:

We do not use children's data for behavioural advertising, and we do not profile children to target advertising (see Section 8).

4. How we use your information

To provide and schedule tuition and courses; to run and record live classes and produce transcripts and session feedback; to give parents progress reports; to provide customer support; to process payments; to operate, secure and improve the platform; to send service messages; and, only with your opt-in consent, to send marketing. You can opt out of marketing at any time via the unsubscribe link in any marketing email or by contacting us.

Automated decision-making: we do not make any decision about a learner based solely on automated processing that produces legal or similarly significant effects. Automated tools may assist in preparing session summaries and progress feedback, but assessments of a learner's progress are always subject to human review by our tutors and staff.

5. Payment processing

Card and online payments are processed by Stripe. Stripe processes your payment data under its own privacy terms and appropriate security standards (including PCI-DSS). We store only a payment reference and the transaction record — never your full card number.

6. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used so we can improve it. You can control cookies through your browser settings; disabling them may affect some features. Our in-product usage analytics are first-party — used only by us to operate and improve the service — and are not used to build advertising profiles. Analytics data is retained for a limited period only (Section 9).

7. Recordings of live classes

Live classes are recorded by default as a standard, integral part of our service: recordings and transcripts allow learners and parents to review sessions, and allow us to prepare progress feedback and maintain teaching quality. We tell you this clearly before enrolment, and this policy forms part of the information provided at that point.

If you do not want your child's classes recorded, contact us at info@elevenace.com before or at enrolment. We will discuss whether an alternative arrangement (such as an unrecorded class, where available) is possible. If no suitable arrangement can be made, you may choose not to proceed with, or to discontinue, the service. Declining recording will never affect classes your child has already taken or your other rights under this policy.

Recordings are stored on Google Drive (Google Workspace) and made available to the relevant learner's parent/guardian via a private, unguessable link shared only with that family. These links must not be shared or forwarded to anyone else; access to another family's recording is a misuse of the service and may be a data-protection breach. We keep the ability to disable a recording link at any time and are progressively moving recordings to access restricted to the named parent's email address.

Recordings and transcripts are retained for 6 months from the date of the class and then deleted (Section 9).

8. Children's privacy and parental consent

Our services are used by children from Year 1 to Year 13 (up to age 18). Because India's DPDP Act 2023 treats anyone under 18 as a child, and because our learners include children under 13 (the UK threshold below which parental consent is always required for online services), we require the involvement and consent of a parent or guardian for every learner under 18, in every country we serve. This single standard meets or exceeds the requirements of the UK GDPR and the ICO's Age-Appropriate Design (Children's) Code, EU GDPR Article 8, and India's DPDP Act §9.

In practice:

• Learner accounts are created by an Eleven Ace administrator at the request of, and with the consent of, the child's parent or guardian, who is the account holder and our contracting party. The parent's enrolment — including acceptance of this policy — is recorded and kept as an auditable record of that consent.
• We process the minimum data needed to provide tutoring and apply high-privacy defaults.
• We do not carry out behavioural monitoring of children beyond what is needed to deliver and safeguard the tutoring itself, and we never profile children for advertising or direct any targeted advertising at them.
• A parent or guardian may exercise all of the rights in Section 10 on their child's behalf, including reviewing what we hold, correcting it, and requesting deletion.

9. How long we keep your data (retention)

We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it:

The 6-month analytics window is enforced automatically in the platform. Where law requires us to keep a specific record for longer (for example, safeguarding records), we keep only that record, only for as long as the law requires.

10. Your rights and choices

Subject to law, you (or a parent/guardian acting on a child's behalf) may:

• Access — request a copy of the personal data we hold.
• Rectify — have inaccurate data corrected.
• Erase — request deletion, subject to records we must retain by law.
• Restrict / object — to certain processing, including any profiling.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where we rely on consent (for example, marketing), withdraw it at any time without affecting prior lawful processing.
• Opt out of marketing — via the unsubscribe link or by contacting us.
• Nominate (India DPDP Act §14) — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any right, contact our Data Protection / Grievance Officer (Section 12). We will acknowledge your request promptly and respond within the timescales required by applicable law (one month under UK/EU GDPR; within the period prescribed under India's DPDP Act and its rules, and in any event within 90 days). You also have the right to complain to a supervisory authority: the Information Commissioner's Office (UK), your EU member-state data protection authority, or the Data Protection Board of India.

11. Third parties and international transfers

We share personal data only with service providers who help us deliver the platform, under contracts requiring them to protect it and use it only on our instructions. We do not sell or rent your personal data. Our key sub-processors are:

Your data may therefore be transferred to and stored outside your home country. Where that happens, we rely on appropriate safeguards: adequacy decisions where they exist (the UK and EU have adequacy arrangements covering Japan and, for certified organisations, the US), and otherwise the UK International Data Transfer Agreement/Addendum and the EU Standard Contractual Clauses, as incorporated in our providers' data processing agreements.

12. Contact us / Data Protection & Grievance Officer

For any privacy question, to exercise your rights, or to raise a grievance under India's DPDP Act, contact:

Data Protection & Grievance Officer, Eleven Ace Academy

• Email: info@elevenace.com
• Address: 7c Cranbrook House, 61 Cranbrook Road, Ilford, Essex, IG1 4PG, United Kingdom

13. Data breaches

If a personal data breach occurs that risks your rights or your child's rights, we will notify the relevant authority (the ICO in the UK, or the Data Protection Board of India, as applicable) within the timescales required by law — including within 72 hours where UK/EU GDPR requires it — and we will inform affected parents and learners without undue delay where the risk to them is high.

14. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new “Last Updated” date and, where required, notified to you by email. Please review this page periodically.