Safeguarding and child protection policy

1. Policy statement

Most of the students on Cookie Tutoring are under 18. Every lesson is one adult and one child, online, usually with nobody else in the room. That is the whole reason this document exists.

Keeping children safe comes before every other interest this business has: before growth, before a tutor's convenience, before our own commission. Where the two conflict, this policy wins.

Under no circumstances may anyone working with or through Cookie Tutoring inflict physical or psychological harm on a child, and nobody is ever penalised for reporting a concern that turns out to be nothing.

We are a small business run by one person. This document says what that person does, what every tutor must do, and, honestly, where the current arrangements fall short of what we intend.

2. Scope and definitions

This policy applies to:

• the founder, who is also the Designated Safeguarding Lead, the only administrator and, today, the only listed tutor;
• every tutor listed on the platform and every applicant, from the moment they apply;
• any future employee, contractor or volunteer;
• and, in what it promises them, every student, parent and guardian who uses the service.

Definitions used here:

• Child: anyone under 18. Students here are usually 10 to 18; children under 13 hold an account only if a parent or guardian created it for them.
• Safeguarding: the DfE definition: protecting children from maltreatment; preventing impairment of their mental and physical health or development; ensuring they grow up in circumstances consistent with safe and effective care; and taking action when we identify or suspect that a child is suffering, or at risk of, harm.
• Child protection: the part of safeguarding that responds to a specific child who is suffering or likely to suffer significant harm.
• DSL: the Designated Safeguarding Lead (section 3).
• Sponsor: our word for the adult responsible for a student's account: the parent or guardian who books, pays, and can read the student's messages, lesson reports and the notes a tutor sends them. A sponsor must be 18 or over. Under 16 every student has one; since 2026-09-11 a 16- or 17-year-old may book and pay for themselves instead, in which case nobody else reads their messages unless a concern is reported; every other safeguard in this policy applies to them unchanged.
• Tutor: a self-employed person we have vetted and listed. Tutors are not our employees.
• Regulated activity: teaching or instructing a child, frequently or on more than three days in thirty days (Safeguarding Vulnerable Groups Act 2006, Sch 4). Every tutor here is in regulated activity. ⛔ The "supervised" exemption was abolished on 1 September 2026 (Crime and Policing Act 2026 s.139), so no argument that a parent nearby or our own oversight takes a tutor outside it remains.
• LADO: the Local Authority Designated Officer, who coordinates allegations against people who work with children.
• Allegation: information suggesting that an adult working with children has behaved in a way that harmed, or may have harmed, a child; may have committed a criminal offence against a child; behaved towards a child in a way that indicates they may pose a risk of harm; or behaved in a way, in or out of the setting, that indicates they may not be suitable to work with children.
• Low-level concern: behaviour by an adult that is inconsistent with the code of conduct but does not meet the threshold for an allegation (section 8). "Low-level" does not mean insignificant.

3. Roles and accountability

3.1 The Designated Safeguarding Lead

The DSL has lead responsibility for everything in this policy. Specifically, the DSL:

• receives every safeguarding report and every concern raised by email, and acknowledges it within the response clock (section 5.4);
• decides whether a concern goes to children's social care, the LADO, the police, or the DBS, and records the decision and the reasons;
• takes the on-platform protective steps (suspending a listing, muting, removing);
• keeps the records described in section 10 and controls access to them;
• keeps this policy, the tutor code of conduct and the DBS handling policy current, and reviews them at least annually and after any incident;
• is the named person a parent or carer can contact about a safeguarding concern (the DfE guidance asks for one; the published page names the DSL and the address above);
• holds the training described in section 15.

3.2 Deputy DSL — ⚠ none yet

There is no deputy. The DSL is one person, who is also the only administrator account and the only listed tutor. That means:

• a safeguarding report filed while the DSL is unavailable is not looked at until they are (the hourly chase in section 5.4 emails about it; it cannot act on it);
• a concern about the DSL cannot be handled by anyone inside the business, which is why the route in section 7 is external;
• the published dispute process says plainly that the person reviewing a decision is the person who made it.

The policy commitment: appoint a named deputy who holds DSL-level training and can receive safeguarding email and act on it in the DSL's absence. Until then this gap is stated rather than papered over, here and on /safeguarding.

3.3 The second channel for safeguarding reports

A report filed under the category "A child's safety" is emailed immediately to every administrator and to a second, safeguarding-only address (SAFEGUARDING_ALERT_EMAIL, set on the hosting platform) chosen because it reaches a phone. The platform records the time a notification was confirmed sent, so "nobody was told" is a fact the admin page can show rather than an assumption. Spam and other categories deliberately do not use the second channel, so that whoever watches it does not learn to ignore it.

3.4 Tutors

Every tutor is responsible for the children they teach while they teach them. A tutor must:

• follow the tutor code of conduct (tutor-code-of-conduct.md), which they acknowledge before they are listed and re-acknowledge every twelve months;
• report anything that worries them the same day, however small and however unsure they are;
• never investigate, never promise a child secrecy, and never handle a concern alone;
• cooperate with the DSL, the LADO, children's social care, the police and the DBS.

3.5 Parents and guardians (sponsors)

A sponsor books and pays for an under-18's lessons, agrees the conduct rules when they set up, and can read every message between the child and their tutor and every lesson report, from their own pages, without asking. They cannot join or watch a lesson, and they cannot write in the child's conversation. Section 11 says what we ask of them.

3.6 Local and national contacts

✅ The two Kent details are confirmed (founder, 2026-09-13): the Integrated Front Door numbers are correct, and a LADO referral must go through the portal. The two email addresses were supplied by the founder on 2026-09-12. ⚠ Nothing else found through a search index is recorded here (no email fallback for the Front Door and no LADO email) because neither was confirmed.

We are an online service and the children we teach live all over the UK and beyond. A referral about a child goes to the authority where the child lives. An allegation about a tutor goes to our own LADO in the first instance, who may redirect it to the authority where the tutor lives; we take that advice rather than guessing.

4. Recognising a concern, including online

Everyone covered by this policy should know the signs of abuse and neglect: physical, emotional and sexual abuse; neglect; child sexual and criminal exploitation; domestic abuse, of which a child who sees or hears it is a victim in law; and harm that happens online.

Because everything here happens online, we pay particular attention to the DfE's four online risk areas (content a child sees, contact with a harmful adult, conduct (including images), and commercialisation) and to the specific patterns this service can produce. The following are always worth reporting, and the code of conduct forbids a tutor from doing any of them:

• asking a child to move the conversation to WhatsApp, Snapchat, Discord, Instagram or anywhere else, or to pay privately;
• asking for or giving a phone number, personal email, social media handle or address, in a message, on a profile or out loud in a lesson;
• asking a child to keep something between the two of them;
• asking for a photo, what a child looks like, or where they live;
• suggesting meeting in person, for any reason;
• pressing a child to turn their camera on, or making it a condition of the lesson;
• personal questions about the child's life, who is at home and when;
• a child who is visibly distressed, will not turn their camera on when they usually do, is taking lessons late at night from a bedroom, or whose situation "feels off" with nothing concrete behind it.

Tutors are also told to notice, and never to counsel, a child who raises self-harm, an eating disorder or real distress about exams: be kind, do not act shocked, point them at Childline, and tell us the same day so the parent can be involved properly. Mental-health difficulties can be a sign of, and increase vulnerability to, abuse, grooming and exploitation.

Child-on-child abuse is unlikely to occur inside a one-to-one lesson, but a child may disclose it during one. It is a safeguarding matter and is handled through this policy in the same way.

Children with special educational needs and disabilities face additional barriers to being heard. A tutor must not assume that a change in mood, behaviour or engagement is explained by a child's disability without raising it.

5. Responding to a concern

5.1 If a child is in immediate danger

Call 999. Do not wait for us. Then tell us, so that we can act on our side too.

5.2 If a child tells you something (a disclosure)

Whoever the child tells (a tutor, a parent, the DSL), the steps are the same:

1. Listen. Take it seriously, and let them know they were right to tell you.
2. Do not promise to keep it secret. Say instead that you have to tell somebody whose job it is to help.
3. Do not question them or try to establish what happened. That is somebody else's job, and doing it badly can make a later investigation harder and a prosecution weaker.
4. Do not confront the person they have named.
5. Write down what they said, in their own words, as soon as the lesson ends.
6. Tell us the same day: the "Report a problem" link in the footer of every page, the report control on the conversation, or safeguarding@cookie.education.

Tutors answer a question on exactly this before they can be listed (section 15).

5.3 How a concern reaches the DSL

• A Report control on every tutor profile, every review, every message and every lesson, and one inside the lesson room. The reporter chooses a category ("A child's safety" is first in the list) and can add as much or as little detail as they like.
• "Report a problem" at the foot of every page, which works signed out and does not need the concern to be attached to anything.
• safeguarding@cookie.education, for anyone who would rather write to a person.
• Automatic flags from the message monitor (section 13), which land in the same queue.
• The person reported is never told who reported them.

5.4 The response clock

We publish two promises, on /terms and /safeguarding, and both are rendered from one file (src/lib/legal/enforcement.ts) so they cannot exist in two versions:

• anything about a child's safety: the same day, measured by the software as 24 hours from the moment the report was filed, because "before midnight" would make a report filed at 23:50 overdue in ten minutes;
• anything else: five working days.

An hourly job (/api/cron/safeguarding-chase, scheduled from the database so that it can run more often than once a day) emails the DSL about every safeguarding report that is still unacknowledged past the clock. It chases; it never escalates, dismisses or un-lists anybody by itself. Every decision is a person's.

5.5 What the DSL does with a concern

1. Acknowledge it within the clock, which stops the chase.
2. Read what exists: the report, the conversation (messages are retained and cannot be edited or deleted after sending), the lesson reports, any earlier reports or flags about the same person. We do not read messages routinely; a report, a dispute or a safeguarding concern is when we do.
3. Protect first. If there is any risk to a child, take the on-platform step immediately: suspend the tutor's listing so no new lessons can be booked, and, where needed, stop the conversation. The published enforcement ladder says that anything involving a child's safety skips the ladder, and that we would rather be wrong and apologise than leave a profile up.
4. Decide the route:
   • no further action, recorded with reasons;
   • a conversation with the tutor (a low-level concern, section 8);
   • advice from children's social care where the child lives, before deciding whether to refer;
   • a referral to children's social care where a child may be suffering or at risk of significant harm, following that authority's referral process, by phone where urgent;
   • an allegation against a tutor: section 6 (LADO, and police where a crime may have been committed);
   • the police, at once, where a crime may have been committed or a child is at immediate risk.
5. Tell the parent or guardian what has happened and what we are doing, unless doing so could put the child at greater risk, in which case take advice from children's social care or the LADO first. Where the concern is about the home, take advice before contacting the family.
6. Record the concern, what was done, and why (section 10).
7. Answer the reporter in writing. A concern about us gets the same clock and the same written answer.

Reports are open until resolved or dismissed, and an open report is never swept by the retention job.

6. Allegations against a tutor (or any adult working through the platform)

An allegation is anything that suggests a tutor has harmed a child, may have committed an offence against a child, has behaved in a way that indicates a risk of harm, or has behaved, in or out of the platform, in a way that suggests they may not be suitable to work with children.

The procedure:

1. Do not investigate. The DSL does not interview the child, does not put the allegation to the tutor before taking advice, and does not tip the tutor off. The DSL keeps a written record of the allegation and of everything else that comes to light.
2. Contact the LADO as soon as reasonably practicable, the same day, by a referral through Kent's portal (section 3.6), and the police where a crime may have been committed. The LADO coordinates every allegation against a person who works with children and will say what we should do next, including whether children's social care need to be involved. Where a child is at immediate risk, the referral to children's social care, the police and the LADO all happen at once.
3. Protect the child and other children. Suspend the tutor's listing while the matter is looked into. A suspension stops new bookings; lessons already booked and paid for are honoured or refunded, and nobody loses money because we are investigating somebody else. Since 10 September 2026 a warning, a suspension and a removal each send the tutor an email carrying the reason and the route to disagree (enforcementNoticeEmail), and /terms promises the grounds in writing. Where the LADO or the police advise that the tutor should not yet be told the substance, the DSL records that advice and the notice says only what they have agreed.
4. Tell the child's parent or guardian how the allegation is being handled, unless the LADO or police advise otherwise.
5. Keep it confidential. Only the people who need to know are told, and everyone involved is asked to keep it that way while it is looked into.
6. Cooperate with whatever the LADO, children's social care or the police then do, and follow their lead on timing.
7. Decide the outcome once they have finished or advised: reinstatement, a recorded warning, removal. Each is written to the append-only enforcement record with the reason.
8. Consider a DBS referral (section 9). The software asks the question on every suspension and removal and will not let it be answered silently.
9. Learn from it. Review this policy after any allegation, whatever its outcome.

A tutor who resigns or deletes their account during this process does not end it: the records survive account deletion, and the duty to refer applies as if we had removed them.

7. Allegations or concerns about the founder / DSL

There is one person inside this business. An internal escalation that ends at the person you are worried about would be a fiction, so we publish an external route instead, and mean it:

• the NSPCC whistleblowing advice line (0800 028 0285, help@nspcc.org.uk) is independent of us, free, and exists precisely for somebody who cannot raise a concern inside an organisation. You do not have to be sure, and you do not have to tell us first;
• the LADO and the police can be contacted directly about the founder in the same way as about any other adult who works with children;
• the NSPCC helpline (0808 800 5000) for any adult who is worried.

If a concern about the DSL is nonetheless sent to us, it is logged, it gets the same response times, and it is answered in writing. The published page says that if a concern is about the DSL personally, say so and it will not be handled by them. ⚠ Until a deputy exists (section 3.2) there is no second person for it to go to, so the honest version of that sentence is: it will be passed to the external bodies above, and the DSL will step back from any decision about it.

8. Low-level concerns

A low-level concern is anything an adult working with children has done that is inconsistent with the tutor code of conduct but does not meet the threshold for an allegation, in or out of the platform. "Low-level" describes the threshold, not the importance: the point of recording them is that a pattern is visible only if each one is written down.

Examples here: a tutor who is over-friendly in messages; a personal question answered in more detail than it needed; a lesson run late at night; a follow request accepted and then declined; a message that mentioned a messaging app and was flagged; a parent's offer to pay directly that was declined but not reported.

What we do:

• Anyone can raise one, including a tutor about themselves ("I think I handled that badly").
• The DSL records it as a conversation or a recorded warning in the enforcement record, with the reason, the first two rungs of the published ladder. That record is append-only and is weighed against anything that follows.
• The DSL speaks to the tutor. Most low-level concerns are settled by that conversation.
• If in any doubt whether a concern meets the threshold for an allegation, the DSL consults the LADO.
• Automatic flags from the message monitor (section 13) are treated as low-level concerns until a person has read them; nobody is accused by a pattern match.
• Repeated low-level concerns about the same person are reviewed together and may be referred to the LADO as a pattern even where no single one would be.

9. Referral to the Disclosure and Barring Service

The duty. The Safeguarding Vulnerable Groups Act 2006 places a legal duty to refer on a regulated activity provider (s.35) and on a personnel supplier (s.36). We vet tutors, decide who is listed, hold the money and can remove them; whichever of the two we are (a solicitor has not yet said, and it is on the founder checklist), both carry substantially the same duty, so we assume it applies. Failing to refer without reasonable justification is a criminal offence (a fine of up to £5,000 on conviction, per DBS guidance). We may also refer where the duty does not strictly arise, if we believe a person poses a risk.

When it arises. Both conditions must be met:

1. we have withdrawn a tutor's permission to teach here (removed or suspended them) or would have, had they not resigned, deleted their account or left first; and
2. we think the tutor has engaged in relevant conduct (harmed a child or put one at risk of harm), satisfied the harm test (may harm a child in future), or been cautioned or convicted of a relevant offence.

The duty applies even where we have also told the LADO, the police or a professional regulator.

When we refer. Once our own decision to remove or suspend has been made and we have gathered what we know, as soon as possible. We do not wait for a police investigation or a court to conclude. We tell the LADO that a referral has been made.

How. Through the DBS online referral form, or by email to dbsdispatch@dbs.gov.uk (03000 200 190), following the DBS guidance Making barring referrals to the DBS. The referral gives the person's details, what happened, what we did, and the evidence we hold.

What the software does (src/lib/legal/dbs-referral.ts): on every suspension and every removal, the administrator is asked whether a referral is owed, and the answer is recorded against the enforcement action as one of not yet considered, considered, no referral owed, referral owed, not yet made, or referred to the DBS, with a date and a note. Nothing is referred automatically and nothing is decided by software: a rule that cannot tell a bereavement from negligence should not be the one acting. The default, not yet considered, is rendered as an open question rather than as "no". ⚠ Nothing yet chases a not yet considered that is left sitting; surfacing it on the admin queue is owed.

10. Information sharing and record keeping

Sharing. Data protection law does not prevent the legitimate sharing of information to keep a child safe, and concerns about it must never obstruct that. We share what is necessary, and no more, with: the child's parent or guardian (who can already read the child's messages and lesson reports); children's social care; the LADO; the police; the DBS; a court that orders it. We never tell the person reported who reported them, and we never share a tutor's application material or DBS details with families.

What we keep, and for how long. Every window is set in one file (src/lib/retention.ts), rendered on /privacy and enforced by the nightly sweep, so the promise and the behaviour cannot drift:

Records about a child are never deleted because the adult who wrote them or is named in them deletes their account: the person goes, the record stays for its window.

Who can read them. Only an administrator (today, the DSL) through the service-role client. None of the reporting, enforcement or vetting tables is readable by any signed-in user, and the database refuses the columns rather than a page hiding them.

What the DSL records for every concern: what was reported and by whom; what the DSL read; what was decided and why; who was told (LADO, police, children's social care, the family); what happened next; and, for every suspension and removal, the DBS referral decision.

11. Lone one-to-one lessons

Every lesson here is one adult and one child, online, often with nobody else in the room. That is regulated activity, and it is the situation the DfE guidance is most careful about: it asks for a parent, carer or trusted adult to be present or nearby where possible, for written parental consent to lone working (essential for a child under 16, and to be considered carefully at 16 or 17) and for the family to have a copy of the child protection policy.

What exists today:

• A lesson time is agreed in conversation first and paid for before the lesson; there is no instant booking. A 13–15-year-old's lessons are arranged and paid for by an adult sponsor, who agrees the terms and acknowledges the conduct rules; a 16–17-year-old may arrange and pay alone or choose a sponsor. A child under 13 has an account only because an adult created it and set its password.
• The sponsor can read every message and every lesson report, and notes a tutor sends the student, with their pictures, drawings and widgets, continuously, from their own pages.
• We tell parents, on /safeguarding, to have lessons somewhere shared rather than behind a closed bedroom door where they can, at a time when somebody else is in the house, and that this "is worth more than anything on this page".
• We tell tutors that a parent does not have to sit in; what protects everybody is that the lesson happens in a space that keeps a record, and that the tutor behaves as though it does.
• Every lesson runs in our room, on our video system, with a shared whiteboard; a tutor may not teach anywhere else. The whiteboard is exported as an image at the end of the lesson and kept for a year.
• A tutor cannot open a conversation with a student; only the student's side can. After that, a tutor can suggest a lesson time only to a student who already contacted them, accepted them as their tutor, or had a lesson with them (/terms).

✅ Decided position: we do not ask for separate written parental consent to one-to-one lessons (founder's decision, 2026-09-13). The DfE guidance recommends it; we have considered it and rely instead on the protections above, which between them put a responsible adult into every young child's arrangement: a child under 13 exists here only because an adult created the account; a 13–15-year-old's lessons are arranged and paid for by an adult sponsor who agrees the terms and the conduct rules; the sponsor can read every message and lesson report, and notes a tutor sends the student, throughout; and every lesson happens in our own room, which keeps a record. For a 16–17-year-old arranging their own lessons, the tutor is told in the thread that no parent reads it. Revisit before any schools work, or if a report shows these are not enough.

⚠ What this policy commits to that is not yet built:

• An expectation, stated to the family at booking, that an adult is within earshot for a child under 16. Today it is advice on a page.
• A copy of this policy sent to every sponsor when they first book.

12. No recording

We do not currently record lessons. There is no video or audio recording or transcript of any lesson, by us or by the platform. /privacy says that if we ever add one we will say so first, that it will need everyone in the lesson to agree (for anyone under 18, a parent or guardian as well), and that nobody's camera will ever be recorded. What is kept is the whiteboard the platform saves and the written messages.

Tutors and students must not record lessons either: no screen recording, no audio, no photographs of the other person, and no recording, transcription or note-taking tool of their own running in the room. The code of conduct says so. A tutor must not copy, download, screenshot or store a student's work, messages, lesson reports or profile outside the platform.

The one exception this policy anticipates: if a recording is ever made by anyone, in breach of this rule, it is preserved as evidence and reported, not deleted.

13. Message monitoring

Everyone agrees, before sending anything, that messages are kept, cannot be edited or deleted, and may be read by us. What that means in practice:

• We do not read messages routinely. We read them when there is a report, a dispute about a lesson, or a safeguarding concern.
• Software checks every message for something shaped like a phone number, an email address at any domain but our own, the names of other messaging apps (WhatsApp, Snapchat, Instagram, Discord, Telegram, Facebook, Messenger, Skype), and phrases such as "my number", "text me", "add me on", "off the platform". It is a pattern match, not an AI, and it must never become one. It never blocks or delays a message, because blocking teaches people to arrange things out loud in the lesson instead. A match creates an automatic flag in the same queue as a report, with no reporter; the sender is not told; and a person decides what it means. A digest of unacknowledged automatic flags is emailed to the DSL every morning.
• A message sent into a muted thread files an automatic harassment report; the sender is not told.
• A tutor cannot start a conversation. Only the student's side can open one, before anything is booked. A tutor can suggest a lesson time only to a student already connected to them (who contacted them, accepted them, or had a lesson with them). That is the strongest grooming control on the site. It is published on /terms ("How we keep the platform safe", since 10 September 2026); ⚠ /safeguarding should say it too.
• A child's sponsor can read the whole conversation, continuously. Parents are told, /privacy says so, and since 10 September 2026 the conversation itself tells both the student and the tutor that a parent or guardian can read it, and that software checks each message (Children's Code standard 11).
• A parent or guardian who wants a copy of their child's conversations can ask and we provide them.

14. Whistleblowing

Anyone (a tutor, a parent, a student, a future employee) should feel able to raise a concern about poor or unsafe practice or a failure in our safeguarding arrangements, and know that we will take it seriously.

• Raise it with the DSL at safeguarding@cookie.education. It is logged, it gets the same clock as any other concern, and it is answered in writing.
• If you cannot raise it with us, for any reason, including that we are the problem, use the NSPCC whistleblowing advice line, the LADO or the police (section 7). You do not have to tell us first.
• Nobody is ever penalised, de-listed, marked down or treated differently for raising a concern in good faith, including a concern that turns out to be nothing. Tutors are self-employed, so the statutory whistleblowing protections for employees may not apply to them in law; this policy gives the same protection as a matter of our own rules.
• A concern raised about the DSL is not handled by the DSL.

15. Training

The DSL. The DfE guidance asks for a DSL who has undertaken safeguarding and child protection training, including online safety, and who understands the referral route into children's social care and what to expect from it. This policy sets the standard at the level a school's DSL holds: a "leading on child protection" / designated-lead course, covering online safety, the LADO process, low-level concerns and the DBS referral duty, refreshed at least every two years, with the certificate kept as evidence. ⚠ No such training is recorded for the DSL today. Deferred by the founder on 13 September 2026 until there are a few paying customers, and in any case before any tutor other than the founder is listed. The courses chosen: NSPCC Learning's Designated safeguarding officer (DSO) in England — core, with its Child protection for tutors and Online safety training e-learning. When completed, record the date and provider here; until then this remains an open gap.

Tutors. Before a tutor can be listed they must:

• have the nine tutor safeguarding scenarios (/safeguarding?for=tutors) on screen, and acknowledge the conduct rules; the acknowledgement records the version and the time;
• pass a five-question safeguarding check drawn from those scenarios (a disclosure, a request for a personal number, a child alone at home, a social-media follow, and an unfounded hunch) where the wrong answers are the plausible ones and all five must be right; a wrong answer shows the explanation and the check is retaken. The pass is recorded against the application with its version, and the software will not approve a tutor without it. There is no override.

After listing, a tutor re-acknowledges the rules every twelve months, and whenever the scenarios are improved the new version is shown to every tutor again.

⚠ What that is not: a certificated training course. This policy requires every tutor to hold basic online-safeguarding training (for example the NSPCC's introductory child protection course or an equivalent covering online safety) evidenced at onboarding by a certificate uploaded with the application, and refreshed every two years. That is not yet collected, and there is no training record for tutors or the DSL. The record the DfE asks for (who was trained, in what, when, and when the refresher is due) is owed.

16. Mandatory reporting — readiness

The Crime and Policing Act 2026, ss.85–95, creates a duty on people carrying out regulated activity with children to report child sexual abuse to the police or local authority children's social care when a child tells them of it or they witness it. It is not yet in force. When it commences, every tutor here will be a mandated reporter in their own right, and the DSL will need to be able to confirm to a tutor that an onward report has been made.

What is already in place: tutors are told to report a disclosure to us the same day; the DSL refers to the police and children's social care under section 5; the record shows who was told.

⚠ What is owed before commencement: an in-app disclosure path a tutor can use that records that a report was made onward, to whom and when, and confirms it back to the tutor; an update to the tutor scenarios and the safeguarding check to say that the duty is now the tutor's own; and a review of this policy on the commencement date.

17. Safer recruitment (summary)

Full detail is in tutor-code-of-conduct.md (eligibility) and dbs-handling-policy.md (certificates). Before a tutor appears in the directory the software requires: a verified university email; a CV, degree and school grades reviewed by us; an interview held inside the platform; an identity check; the safeguarding check above; and a criminal record check marked verified against an uploaded certificate: an Enhanced DBS for a tutor in the UK, the country's equivalent for a tutor outside it, refreshed every twelve months for both. We do not rely on a DBS check alone, and a certificate is a snapshot of one day.

✅ At the twelve-month re-check date the tutor comes off the listing automatically (decided by Claude on the founder's delegation, 2026-09-13). They are emailed 30 and 7 days before; on the date their profile leaves the public list and new bookings are refused until a fresh certificate is recorded, which restores it. It is not a suspension, and lessons already paid for are left for the DSL to handle through the founder queue rather than cancelled automatically.

Three of the review's gaps closed on 10 September 2026: the children's barred-list check is now recorded and a UK certificate cannot be marked verified without it; the UK re-check clock runs from the certificate's issue date; and the legacy hand-onboarding route runs the same gates as the application route. ⚠ Gaps this policy still commits to closing: references (the founder decided on 10 September 2026 that they are optional (up to two, given on the application, shown to the reviewer and contacted by a person) and become required before any schools work); a UK Enhanced check regardless of residence plus a certificate from each country of six-plus months' residence in the last five years, as a gate rather than guidance; and an 18-or-over check for tutors read from their identity document; since 12 September 2026 signup refuses the tutor role unless the person declares they are 18 or over, but that is a declaration, not a check. (✅ The right-to-work check for UK-based tutors, once on this list, was built on 2026-09-10 and runs before approval; the provider is Vouchsafe and the founder's own check is on file (13 September 2026); tutors who teach from outside the UK are out of scope: right-to-work-procedure.md.)

18. How this maps to the DfE checklist

19. Complaints

Anyone who disagrees with a decision we make (about a report, a suspension, a removal, a review) can write to us and say what happened and what they think should change. There is no form and no deadline. A person reads it (today, the same person who made the decision, because there is one) and replies within five working days with the outcome and why. If money is involved and we got it wrong, we put it right. Nothing in this policy removes a statutory right, including the right to go to the police, the LADO, the ICO or a card issuer directly.

20. Review and sign-off

✅ Done on 15 September 2026, by the founder's decision: the published version and review date moved to 14 September 2026, the day this policy was approved (the next review stays 3 September 2027); the policy is published in full and linked from the parent, tutor and student versions of the Safeguarding page; and every parent, guardian or sponsor is sent a link to it: in the invitation an adult receives when a student asks them to arrange lessons, in the email a sponsor receives when their student joins, and in the tour a parent, guardian or sponsor is shown when they first sign in.

---

Sources

• DfE, After-school clubs, community activities, and tuition: safeguarding guidance for providers (February 2026): checklist of safeguarding arrangements; Section 2 (policy contents, DSL, managing concerns, disclosures, working alone); Section 3 (recruitment, DBS, staff behaviour policy, low-level concerns, referral, training); Section 5 (complaints, whistleblowing); online safety and GDPR sections.
• DBS, Making barring referrals to the DBS (gov.uk): the two conditions, resignation, the offence.
• Safeguarding Vulnerable Groups Act 2006 ss.6, 9, 35, 36, Sch 4; Crime and Policing Act 2026 ss.85–95 (not in force), s.139 (in force 1 September 2026).
• docs/legal/legal-review-2026-09-09.md §3.4.1–3.4.5, §3.2.4.