Effective date: 3 August 2026
This Policy explains how personal information is handled through tutoring.serenellamuradoregallas.info, the application process, educational services and related communications.
Serenella Muradore Gallas, independent individual educational service provider. Legal address: Dominicana casi Florida, 001205 Asunción, Paraguay. Privacy contact and person responsible for privacy: privacy@serenellamuradoregallas.info.
For a minor, the Client is normally the parent or legal guardian contracting for the service, the Student is the child receiving educational support, and information may concern both Client and Student. For an adult student, the adult normally controls their own information, even where another person pays, unless law or a specific written arrangement provides otherwise.
The application form at /apply is free to submit. No payment is taken at the application stage, and the form does not collect payment-card or bank details. The $500 educational baseline is paid later, and only after an applicant has been taken forward. The form collects, from a parent or guardian: their own name, email address, country and time zone; who the application is for; the Student's first name, age and school year; the kind of school the Student attends; the subjects concerned; a free-text description of the current situation at school and with the work, of what has already been tried, and of the Student at their best; what would make a multi-year path worth it; the weekly session windows that would work; whether the application is for the fully funded place and, if so, a short account of the situation; and how the applicant heard about the service. Two required checkboxes confirm that the person applying is the parent or legal guardian, or an adult applying for themselves, and that this Policy has been read. The free-text situation fields are collected at the application stage, not only after acceptance, because they are what the application is decided on. The form does not request diagnostic uploads, therapy notes, full medical history, government identifiers or detailed crisis disclosures.
Where an engagement proceeds, I may collect information necessary to deliver it, including Client and Student contact details; date of birth or exact age only where genuinely necessary; school, university, programme, subject and course information; schedules, deadlines, assignments and academic materials; goals, learning preferences and observed educational patterns; session attendance, notes, agreed actions and progress indicators; parent communication and service decisions; invoices, payment status and contractual records; school or professional contact details where authorised; and safeguarding or incident information where necessary.
Information about ADHD, disability, mental health, diagnosis, medication or health can be sensitive. The service does not require a diagnosis as a condition of applying, and it never provides diagnosis, therapy or treatment. Sensitive information is collected only when it is genuinely relevant to safe and appropriate educational support and when a lawful basis or valid consent exists. The Client should provide the minimum necessary information rather than full reports unless these are specifically requested through an appropriate method. Health or diagnostic information is not used for advertising audiences, campaign optimisation or newsletter segmentation.
Information may be used to review fit, capacity, location and educational scope; communicate with the Client or adult Student; prepare and deliver sessions and materials; coordinate parent involvement; monitor attendance and educational progress; issue proposals, contracts, invoices and payment records; protect academic integrity and safety; communicate with a school or professional where authorised; meet legal, tax, accounting, safeguarding or dispute obligations; improve service operations using de-identified or aggregated information; send optional marketing only with an appropriate lawful basis; and contact a person about research only under separate research-interest consent.
Depending on jurisdiction and context, processing may rely on steps requested before entering a contract; performance of the educational contract; legal obligations; legitimate interests in delivering, securing and improving a proportionate educational service; consent or explicit consent for optional or sensitive activities; or protection of vital interests or another lawful safeguarding basis in exceptional circumstances.
For a minor, the first enquiry and contract should be made by a parent or legal guardian. A child under 13 must not submit Website forms directly. Where Québec law applies, information concerning a minor under 14 will not be collected directly from the minor without the consent of the person with parental authority or tutor, unless a clear legal exception applies for the minor's benefit. As the Student matures, their privacy, understanding and participation in decisions should be respected. Parent access is not necessarily identical to unrestricted access to every statement, especially for an older adolescent or adult student.
Online sessions may involve Google Meet. Recordings are disabled by default. A separate written consent is required before any recording. Communication with a minor should occur through approved channels, with suitable parent access or oversight. Personal social-media messaging is not used as an ordinary channel with minors.
Information is shared with a school, university, clinician or other professional only with appropriate written authorisation or where disclosure is legally permitted or required for safety. The authorisation identifies the recipient, purpose, categories of information and validity period.
These are separate activities. Service review uses information to decide how to deliver the contracted service. Service evaluation examines whether operations are working and should use minimum, preferably de-identified information. A testimonial or case study requires separate permission and must not identify a minor without reviewed guardian permission and appropriate Student involvement. Research requires a study-specific process and ethics approval where applicable. Paid-service access does not depend on research or publicity consent.
Information is processed by the following providers: Webflow, which hosts the Website and receives form submissions; Google Workspace, used for email and documents; Google Tag Manager, which manages the measurement tags that run on the Website; Google Analytics 4, which produces aggregated statistics about how the Website is used; Mailchimp, used to send the newsletter and any resource a person has asked for; Calendly, used for booking; PayPal, used for payment; Google Meet, used for video sessions; Apple iCloud, used to store lesson notes and documents, including handwritten session notes created in Notability; and accounting, legal, security or technical services where needed. Analytics and marketing providers do not receive sensitive Student or Client information: Google Analytics 4 and Google Tag Manager receive Website usage information only, and Mailchimp receives only the contact details of a person who has asked for the newsletter or a resource. Which of these providers place or read cookies and similar technologies through the Website itself is described in the Cookie Policy.
Online delivery involves processing in more than one country, because the providers named above operate internationally. Where information is transferred out of the country in which the Client or Student lives, it is covered by the arrangements described in the section on international transfers below, and the Client may ask for information about the transfers that affect them.
An application that is not successful is kept until twelve months after the 31 August close of the admissions cycle in which it was made, and is then deleted, unless earlier deletion is requested and no legal reason requires the information to be kept. An application for the fully funded place is kept on the same basis; the reasons given in support of a funded-place application are used to decide that application and are not reused for any other purpose. Where an application leads to a place, records relating to the engagement are kept as follows. Client agreement, invoices and payment records: seven years after the relevant financial year, or as long as the law requires. Session notes, learning plans and progress records: three years after the end of the academic-year engagement to which they relate. School-authorisation records: for the duration of the engagement and a reasonable accountability period afterwards. Safeguarding or serious-incident records: for the period required by law and warranted by the seriousness of the matter. Newsletter and marketing records: until the person withdraws. Research-interest records: up to 24 months unless renewed or withdrawn. Study records: the period stated in the approved study information and consent document. Retention periods are reviewed once a year against the law of the Provider's establishment and of the principal client markets.
Access to Client and Student information is limited to the Provider. The Website, email, scheduling, payment, video and storage services named above are run by established companies that maintain their own security measures for the information they hold. Information travelling between a browser and the Website, and between the Provider and those services, is encrypted in transit. The accounts used to hold Client and Student information are protected by strong, unique passwords and, where the provider offers it, two-factor authentication. Information is shared inside the service only where there is a reason to share it. No method of sending or storing information is completely secure, and no guarantee of absolute security is given. If a breach occurs that is likely to create a risk for a person, that person is told, and any notification required by law is made.
The Provider is established in Paraguay. Paraguay is not covered by an adequacy decision of the European Commission. Where a Client or Student is in the European Union, the European Economic Area or the United Kingdom, their information is therefore transferred outside those areas so that the service can be provided. Such a transfer is made either on the basis of appropriate safeguards, or because the transfer is necessary in order to perform a contract that the person has asked for, or to take steps at their request before entering into such a contract. The formal transfer mechanism for the Provider's own processing is being put in place with legal counsel, and its current status can be described on request. The providers named above operate their own transfer arrangements for the information they process. Anyone who wants further detail about the transfers that affect them may write to privacy@serenellamuradoregallas.info.
Subject to the law that applies, a person may ask for access to the information held about them; ask for information that is wrong or incomplete to be corrected; ask for information to be erased; ask for processing to be restricted while a question about it is resolved; object to processing that is carried out on the basis of legitimate interests; ask to receive, in a portable form, the information they provided; and withdraw consent at any time where the processing rests on consent. Withdrawing consent does not affect the lawfulness of anything done before the withdrawal, and it does not require a reason. These rights belong to the parent or guardian in relation to their own information and, where applicable, to the Student in relation to information about the Student. A right may be limited where the law requires information to be kept, where acting on the request would reveal information about another person, or where a request concerns a safeguarding matter; where a right is limited, the reason is given.
A request is made by email to privacy@serenellamuradoregallas.info. It helps to say the name of the parent or guardian, the name of the Student where the request concerns them, which right is being exercised, and what the request relates to, so that the right records can be found. Identity may need to be confirmed before a request is answered, so that information is not given to the wrong person. A response is given within one month of receiving the request. Where a request is complex, or where several requests are made together, that period may be extended, and the person is told within the first month if that happens and why. There is no charge for making a request. A fee may be charged, or a request refused, only where the request is manifestly unfounded or excessive, and the reasons are given in writing.
Write to privacy@serenellamuradoregallas.info
Anyone who is unhappy with how their information has been handled is asked to write to privacy@serenellamuradoregallas.info first, so that the matter can be looked at directly and, where possible, put right. A person also has the right to lodge a complaint with the data protection authority of the country in which they live, the country in which they work, or the country in which the matter they are complaining about arose. Raising the matter with the Provider first is not a condition of that right, and doing so does not affect it.
Applications are read and decided by a person. There is no automated decision-making and no profiling that produces legal effects, or effects of similar significance, for the Client or the Student. This applies at the application stage and throughout an engagement. Website analytics produce aggregated statistics about how pages are used and play no part in deciding an application. Scheduling, payment and email tools carry out ordinary automatic steps such as sending a confirmation, and none of them decides anything about a person.
This section is about the Student. What is held about a Student is: their first name, their age and school year, the kind of school they attend, the subjects they are working on, what their parent or guardian has written about how school is going for them, what has already been tried and what they are like at their best, the times they are free for sessions, and, once sessions begin, the school itself and notes about what was worked on and how it went. Almost all of it comes from their parent or guardian rather than from the Student. A Student may ask what is held about them and will be told, in language that suits their age. This is an educational service. It does not require a diagnosis, it does not diagnose, it does not provide therapy or treatment, and it does not create clinical or medical records. Where a parent chooses to mention ADHD or a diagnosis, that information is kept because it helps the teaching, not because it is required.
This Policy is updated when the service changes, when a provider is added or replaced, or when the law requires it. The version published on this page is always the current one, and the effective date at the top of the page shows when it last changed; a new effective date is the signal that something in this Policy has changed. Where a change materially affects how a Client's or a Student's information is used, the Client is told directly by email before the change takes effect, rather than being left to notice the new date. Earlier versions can be requested by email.
Serenella Muradore Gallas
Selective one-to-one tutoring for gifted, ADHD and twice-exceptional students, built over years rather than semesters.
Educational support, not clinical care. I do not diagnose, assess, or provide therapy.
© 2026 Serenella Muradore Gallas. All rights reserved.
Online one-to-one tutoring in mathematics and quantitative subjects · Gifted, ADHD and twice-exceptional students