Privacy Policy

Marlow Learning
Justin Marlow, Owner
[email protected]

Effective Date: July 3, 2026

1. Introduction

Marlow Learning is a sole proprietorship operating as a private English Language Arts tutoring practice serving students in Grades 9–12 in Alberta and British Columbia. This Privacy Policy explains how Marlow Learning collects, uses, discloses, retains, and protects personal information in accordance with Alberta’s Personal Information Protection Act, SA 2003, c P-6.5 (“PIPA”).

Marlow Learning is the organization responsible for personal information under its custody or control. All inquiries regarding this policy or the handling of personal information may be directed to:

Justin Marlow [email protected]

2. Scope

This policy applies to personal information collected from clients, students, and prospective clients in connection with Marlow Learning’s tutoring services. It does not apply to information about employees or contractors, as Marlow Learning has none.

3. What Is Personal Information

“Personal information” means information about an identifiable individual. It does not include business contact information used solely to contact an individual in their business capacity, or information that has been rendered non-identifiable.

4. Personal Information Collected

Marlow Learning collects the following categories of personal information:

From clients (parents or guardians):

Legal name,
Mailing address,
Email address, and
Phone number.

From students:

Legal name,
Email address,
Phone number (where consent is given by the client), and
Academic work, including homework, drafts, essays, and other written materials submitted for tutoring purposes.

Session records:

Video recordings of all tutoring sessions conducted via Nextcloud Talk.

Transaction records:

Payment transaction data (amounts, dates, and associated client names) imported from Stripe, Marlow Learning’s third-party payment processor. Marlow Learning does not collect, store, or have access to payment card numbers or other raw payment instrument details, which are processed exclusively by Stripe.

5. Purpose of Collection

Marlow Learning collects personal information for the following purposes:

Providing one-on-one English Language Arts tutoring services,
Scheduling, managing, and confirming tutoring sessions and consultations,
Executing and retaining service agreements,
Communicating with clients and students regarding sessions, progress, and resources,
Issuing invoices and processing payments,
Maintaining session records for educational continuity and client review, and
Complying with legal obligations.

Marlow Learning will not use or disclose personal information for any purpose other than those listed above without obtaining prior consent, except as required or permitted by law.

Marlow Learning collects personal information with the knowledge and consent of the individual concerned, except where collection without consent is authorized by PIPA or other applicable law.

Consent may be express (written or verbal) or implied from the circumstances. By entering into a service agreement with Marlow Learning, clients consent to the collection, use, and disclosure of personal information as described in this policy.

Where a student is under 18 years of age, consent is obtained from the client (parent or guardian). A student’s phone number is collected only where the client expressly consents to its collection.

Clients and students may withdraw consent at any time, subject to legal or contractual restrictions, by contacting [email protected]. Withdrawal of consent may affect Marlow Learning’s ability to provide services.

7. Limits on Collection

Marlow Learning collects only the personal information necessary for the purposes identified in Section 5. Information is collected by fair and lawful means.

8. Use and Disclosure

Personal information is used only for the purposes for which it was collected. Marlow Learning does not sell, rent, trade, or otherwise disclose personal information to third parties for commercial purposes.

Personal information may be disclosed in the following limited circumstances:

Stripe: Payment transaction data is processed by Stripe, Inc., Marlow Learning’s payment processor. Stripe operates under its own privacy policy and is responsible for PCI DSS compliance. Marlow Learning imports transaction records (amounts, dates, client names) into a locally hosted, offline accounting system for bookkeeping purposes.
Tuta Mail: Email communications are transmitted through Tuta Mail, an end-to-end encrypted email service operated by Tuta GmbH, a German company subject to the European Union’s General Data Protection Regulation. Tuta’s encryption architecture prevents Tuta from accessing the content of messages.
BorgBase: Encrypted backup data is stored with BorgBase, a backup hosting service operating EU-based data centres. All backup data is encrypted by Marlow Learning before transmission, meaning BorgBase has no access to the contents of any backup.
Legal disclosure: Marlow Learning may disclose personal information without consent where required by law, court order, or a lawful authority with jurisdiction.

Except as described above, personal information is stored exclusively on infrastructure operated by or on behalf of Marlow Learning within Canada.

9. Retention and Destruction

Marlow Learning retains personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

Video recordings of tutoring sessions are automatically purged after 30 days. Video recordings are not duplicated to any backup repository and cannot be recovered once deleted.

Other personal information is retained for a reasonable period following the end of the client relationship to fulfill any outstanding legal, contractual, or administrative obligations, and is then securely destroyed.

When personal information is no longer required, it is destroyed in a manner that prevents reconstruction.

10. Accuracy

Marlow Learning takes reasonable steps to ensure that personal information is accurate and complete for the purposes for which it is used. Clients are encouraged to notify Marlow Learning of any changes to their personal information by contacting [email protected].

11. Safeguards

Marlow Learning protects personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction using security measures appropriate to the sensitivity of the information. These measures include, but are not limited to:

Self-hosted infrastructure located in Canada (OVHcloud Canada) for all live client data,
End-to-end encrypted communications via Tuta Mail and Nextcloud Talk,
Encrypted backups using Borg, with offsite storage on BorgBase EU infrastructure,
Strong, unique credentials for all systems, managed in a locally hosted password manager,
Multi-factor authentication on all client-facing services,
Restricted physical and logical access to ensure that client data is accessible only on Marlow Learning’s dedicated office machine and self-hosted server, and
A Content Security Policy (CSP) and related HTTP security headers configured on the website to protect visitors from cross-site scripting and related attacks.

A detailed description of Marlow Learning’s security infrastructure and software stack is available on the Privacy & Data Security page.

12. Openness

This Privacy Policy is publicly available at marlowlearning.ca. Marlow Learning will provide information about its policies and practices upon request.

13. Individual Access

Upon written request, an individual has the right to:

Be informed of the existence, use, and disclosure of their personal information held by Marlow Learning,
Be given access to that information, or
Challenge the accuracy and completeness of that information and have it amended where appropriate.

Requests for access should be directed to [email protected]. Marlow Learning will respond within 45 days of receipt of a written request, or provide notice of an extension where permitted by PIPA.

Marlow Learning may decline to provide access in circumstances permitted by PIPA, including where doing so would reveal personal information about a third party or where the information is protected by legal privilege.

14. Privacy Complaints

Individuals may direct complaints or challenges regarding Marlow Learning’s compliance with this policy or with PIPA to:

Justin Marlow
[email protected]

If a concern is not resolved to the individual’s satisfaction, a complaint may be made to the Office of the Information and Privacy Commissioner of Alberta:

Office of the Information and Privacy Commissioner of Alberta
410 – 9925 109 Street NW
Edmonton, Alberta T5K 2J8
Telephone: 780-422-6860
Toll-free: 1-888-878-4044
Website: oipc.ab.ca

15. Amendments

Marlow Learning may amend this policy from time to time. The current version will always be available at marlowlearning.ca. Material changes will be communicated to existing clients.

This Privacy Policy was prepared in accordance with Alberta’s Personal Information Protection Act, SA 2003, c P-6.5.