Legal
Privacy Policy
Last updated: 17 July 2026. How we collect, use, keep and protect your data — and how to have it deleted — under the Mauritius Data Protection Act 2017.
1. Who we are
OnlineTuition.mu is operated by Choolun Education Ltd, a company in the Republic of Mauritius. We are the data controller for the personal data described here. To contact us about your data, email [email protected] or use the Contact page.
2. What we collect
• Account & profile: name, email, phone, grade, school (optional), gender, avatar choice, and optional parent/guardian name and contact. • Learning: subjects, lesson progress, quiz results, points, badges and streaks. • Payments: plan, amount, status and payment reference (full card details are handled by our payment providers and are never stored by us). • Security & device: device type, app version, IP address, approximate location (city/country) and sign-in times. • Support: messages you send us and our replies.
3. Why we collect it, and our legal basis
We process your data to provide the service and give you access to lessons (to perform our contract with you), to process payments (contract and legal obligation), to protect your account and prevent login sharing using device/IP/approximate-location signals (our legitimate interest and yours), and to send messages you've chosen such as reminders and updates (your consent, which you can withdraw at any time in Settings).
4. Children & parental consent
Many of our students are under 18. Registration asks for parent/guardian details and consent. Public student profiles only ever show a first name and last initial — never an email, phone number or full name — and there is no student-to-student messaging. A parent or guardian may contact us at any time to review, correct or delete their child's information.
5. How long we keep your data (retention)
We keep personal data only as long as we need it, then delete or anonymise it: • Account & profile: while your account is active. • Learning data (progress, quizzes, points): while your account is active; afterwards we may keep it only in an anonymised, aggregated form that cannot identify you. • Payment & billing records: retained for as long as Mauritian tax and accounting law requires (generally up to 7 years) even after you delete your account, then deleted. • Security & login logs (IP, device, approximate location): up to 12 months, then automatically deleted. • Support messages: up to 24 months. • Marketing/notification choices and any suppression records: kept for as long as needed to honour your preferences.
6. Deleting your account & your right to erasure
You can ask us to delete your account and personal data at any time — email [email protected] (or, for a student under 18, a parent/guardian can ask on their behalf), or use the Contact page. When you request deletion: • We remove or irreversibly anonymise your personal data within 30 days. • We keep only what the law requires us to keep — for example payment and tax records — for the legally required period, and then delete it. • Learning statistics may be retained only in anonymised form that can't be linked back to you. We'll confirm once your data has been deleted. (You can also manage most of your privacy choices yourself in Settings.)
7. Who we share it with
We use trusted service providers to run the platform — video hosting (Vimeo/Bunny), payment gateways (MCB, PayPal), messaging (email and WhatsApp) and analytics. They act as our processors, only handle data on our instructions, and are bound by contract. Some may process data outside Mauritius, in which case we use appropriate safeguards. We never sell your data or use it for third-party advertising. We may disclose data if required by law.
8. Cookies & similar technologies
We use essential cookies to keep you signed in and secure your session, and limited analytics to understand and improve how the site is used. You can control non-essential cookies through your browser.
9. How we protect your data
We use encryption in transit, access controls, audited admin access, and the account-security measures described in our Terms (single-session sign-in, new-device alerts and login history) to help keep your data safe.
10. Your rights
Under the Data Protection Act 2017 you have the right to access your data, correct it, ask us to delete it, object to or restrict certain processing, withdraw consent, and receive a copy of the data you gave us. Manage much of this yourself in Settings, or contact us for help. If you're not satisfied, you can complain to the Data Protection Office of Mauritius.
11. Updates to this policy
We may update this policy from time to time. We'll post the new version here and, for significant changes, let you know. The "last updated" date above shows when it last changed.