Privacy Notice — what we hold, and why

This notice is the privacy notice referred to in section 17 of our Terms of Use. It applies to goodtutorsfinder.ch and to every tutoring service we provide. It does not apply to other websites we link to.

1Who we are

Good Tutors Finder is a tutoring service operated by CANICET GmbH, a company registered in Switzerland. CANICET GmbH is the controller of the personal data described here — it decides what is collected and why, and it is answerable for it.

We are not required to appoint a Data Protection Officer and we have not appointed one. Data protection questions go to the email address above and reach a person, not a queue. CANICET GmbH also operates other household and education services under separate brands; each has its own privacy notice, and this one covers Good Tutors Finder only.

2What this notice covers

We are a Swiss company serving families in Switzerland, so the revised Swiss Federal Act on Data Protection (revFADP / revDSG) governs everything described here.

Many of the families we teach hold EU passports or move between Switzerland and the EU. Where the EU General Data Protection Regulation also applies to you, we honour the rights in section 15 on the same terms, and section 4 states the legal basis for each purpose in GDPR language so you can check it. We have not appointed an EU representative, because our service is offered in Switzerland and not directed at the EU market.

3The short version

The rest of this notice is the honest detail behind those five lines, including the three places where data does leave Switzerland and exactly why.

4What we collect and why

We collect only what we need to arrange and deliver tutoring, take payment for it, and meet our legal obligations. Nothing on this list is collected “in case it is useful later”.

Swipe to view all columns →

Swiss law does not use the GDPR’s “legal basis” construction in the same way. Under the revFADP we rely on the principles of lawfulness, proportionality and good faith, and process your data for the purpose we told you about when we collected it. The GDPR column is there so a reader who wants to check the analysis can.

5Sensitive data and children

Most of our students are children, and their data reaches us from a parent or legal guardian. We do not knowingly collect data directly from a child. The booking form is written for the adult who is paying, and the account belongs to that adult.

If you would rather that detail did not sit in a written record at all, say so on WhatsApp or by phone and ask us not to write it down. We will match on it and keep no note.

6Where the data comes from

• From you, almost always — the booking form, an email, a WhatsApp message or a phone call.
• From your use of this website, for the technical and journey data in section 4.
• From Stripe, which tells us whether a payment succeeded and returns the reference, the card brand and the last four digits.
• From the tutor we assigned, for lesson records and progress notes.

We do not buy contact lists, we do not scrape social media, and we do not enrich what you give us with data bought from a third party.

7Card payments

Card payments on this site are processed by Stripe. The card fields on the booking form are served by Stripe and the card number is transmitted directly to them.

Stripe is an independent controller for its own fraud-prevention and regulatory purposes and processes the payment through Stripe Payments Europe, Limited in Ireland, with data also processed by Stripe, Inc. in the United States. Their own privacy policy is at stripe.com/privacy. Section 12 covers what that transfer rests on.

8WhatsApp

WhatsApp is the fastest way to reach us and many families use it. It is worth being straight about what that means.

When you message +41 76 213 1843, the message content is end-to-end encrypted between your device and ours, but WhatsApp Ireland Limited (part of Meta) processes the metadata around it — your phone number, the fact that you contacted us, and when. That processing is governed by WhatsApp’s own privacy policy, not by ours, and we cannot change it. We keep the conversation as part of your record under section 13. If you would rather not use it, email and phone reach us just as well.

9Cookies and this website

This site sets a small number of cookies and none of them are for advertising. Here is the complete list.

Swipe to view all columns →

All of these are strictly necessary to run the site and the booking form, which is why you are not asked to consent to them. If we ever add an analytics or advertising cookie, we will ask first, through a consent banner, and this section will change before the cookie does.

10What this site does not do

Stated as plainly as we can, because most privacy notices bury it:

• No web analytics. No Google Analytics, no Google Tag Manager, no Matomo, no Plausible, no heatmaps, no session recording.
• No advertising or social pixels. No Meta pixel, no TikTok, no LinkedIn Insight, no Google Ads remarketing tag. We do not build advertising audiences from visitors to this site.
• No sale, rent or trade of personal data. Not to anyone, at any price, ever.
• No automated decision-making and no profiling. A person reads every enquiry and a person assigns every tutor. Nothing about your family is decided by an algorithm, and we do not use your data to train an AI model.
• No cold-calling from data you did not give us for that purpose. If you asked for a call back, you get a call back. Otherwise you do not.

11Who else sees your data

Your data is seen by the people who need it to deliver the lessons, and by the suppliers who run the machinery underneath. Every supplier below is bound by a contract that limits them to acting on our instructions.

Swipe to view all columns →

We will also disclose data where the law requires it — a court order, a tax authority acting within its powers, or a genuine safeguarding concern about a child. We do not hand over data to anyone else on request, including to a separated parent who is not the account holder, without checking that we are entitled to.

12Transfers outside Switzerland

The bulk of your data stays in Switzerland: the website, the database and our email are hosted here, and your tutor is here. There are three exceptions, all named in section 11.

• Ireland — Stripe and WhatsApp. Ireland is on the Swiss Federal Council’s list of countries with adequate data protection, so no additional safeguard is required.
• United States — Stripe, Inc., Defiant, Inc. and Google LLC. The United States is recognised as adequate under the Swiss–US Data Privacy Framework for companies certified to it; where a supplier is not certified, the transfer runs on the European Commission’s Standard Contractual Clauses with the Swiss amendments recognised by the FDPIC.

You can ask us for a copy of the safeguard relied on for any transfer above, and we will send it.

13How long we keep it

We delete what we no longer need. Where the law tells us to keep something, we keep it and no longer.

Swipe to view all columns →

14How we protect it

• The whole site is served over HTTPS, and form submissions are encrypted in transit.
• Access to booking records is limited to the people who need it — and a tutor sees their own students, not the client list.
• Administrator accounts use strong unique passwords with two-factor authentication, and a web application firewall blocks attacks against the site.
• Card data is never on our systems to protect — that risk sits entirely with Stripe, which is how it should be.
• Backups are encrypted and rotated.

No system is perfectly secure and we will not claim ours is. If a breach ever occurred that put you at high risk, we would tell you and notify the FDPIC, as revFADP Art. 24 requires, rather than manage it quietly.

15Your rights

Under Swiss law, and under the GDPR where it applies to you, you have the following rights over your own data. Exercising them is free and does not affect the service you get.

Swipe to view all columns →

16Tutors and applicants

Tutors are employed through CANICET GmbH, not engaged as freelancers, so their data is employment data and is handled accordingly.

• If you apply to tutor with us, we hold your CV, qualifications, teaching history, references and right to work in Switzerland, in order to assess the application. An unsuccessful application is kept for 12 months in case something suitable comes up, and deleted on request at any time.
• If you are engaged, we additionally hold what employment requires — address, date of birth, AHV number, bank details, and the social-insurance and payroll records that AHV, BVG and UVG oblige us to keep. Those are shared with the relevant insurers and authorities, and with our payroll accountant, and kept for the periods Swiss employment and social-insurance law prescribes.
• Your name and profile are shared with a family only when we assign you to them.

17Changes to this notice

We update this notice when what we actually do changes — a new supplier, a new country, a new cookie. The current version always lives at goodtutorsfinder.ch/privacy-policy/ with its version number and effective date at the top of the page. If a change materially affects how your data is used, we will tell existing clients directly rather than quietly reposting the page.

18Contact and complaints

Ask us first. Most concerns are a misunderstanding we can clear up the same day, and we would rather fix something than defend it.

If you are not satisfied with our answer, you may complain to the Swiss supervisory authority — the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, edoeb.admin.ch. If you are in the EU or EEA and the GDPR applies to you, you may instead complain to the supervisory authority of the country you live in. You may also bring a claim before the Swiss courts.