DSAR walkthrough

Published 26 May 2026 · Authored by Robert S., checked by Fiona H. (former First Tutors user)

Recover your First Tutors reviews.

First Tutors closed on 8th May 2026. Recovering your reviews has three parts: claim your archived profile (we already have many of them on file), file a Data Subject Access Request (DSAR) with First Tutors to recover the rest, then upload their reply when it lands. This page walks through all three.

Step 1 · Start here

Claim your archived profile.

Most published First Tutors profiles are in our Common Crawl + Wayback Machine archive. If yours is, claiming it gets your original reviews live on your Tutorperch profile in days. The DSAR walkthrough below recovers everything the archive didn't capture, but the archive claim is the fast path and worth starting first.

Ownership is proved either by avatar-match against your identity-verified Tutorperch photo, or by uploading an original First Tutors email so we can verify its DKIM signature.

See the claim flow

Your rights

What UK GDPR entitles you to.

Two articles do the work. Article 15 covers data others created about you (reviews, received messages, internal notes); Article 20 covers data you supplied (your profile and the messages you sent). Both are free of charge, enforceable through the ICO, with a one-month statutory deadline.

UK GDPR · Article 15

Right of access

You can ask First Tutors for a copy of all the personal data they hold about you, not only what you uploaded. That covers the reviews and ratings written about you by students and parents, messages you received, account and login logs, and any internal notes. Free of charge, in a commonly used electronic form, on a statutory one-month deadline.

Reviewer names may be redacted to protect third-party privacy. The review text, rating, and date are yours by right.

UK GDPR · Article 20

Data portability

For data you provided, like your profile, contact details and the messages you sent, you can ask for it in a structured, machine-readable format like CSV or JSON. Same one-month deadline, same free of charge.

Article 20 doesn't cover reviews written about you. Those come back via Article 15. The template below asks for both.

Don't wait

Don't wait for dissolution.

Your DSAR rights are intact while First Tutors winds down. They survive administration and liquidation: the company remains the controller, and an appointed office-holder is the right person to address the request to. The ICO enforced exactly this in SCL Elections / Cambridge Analytica (2018-19): an enforcement notice during administration, then prosecution and a £15,000 fine when the company didn't comply.

What they don't survive is dissolution. Once the company is struck off Companies House it ceases to exist as a legal person. There is no controller left to honour your DSAR, and recovering your data after that point requires a court application to restore the company to the register under sections 1024-1030 of the Companies Act 2006. The recent move of the operating company's registered office to an accountancy address is consistent with several outcomes including strike-off; we don't know what's planned, but acting now is the lower-risk path.

Send the request this week. The one-month clock starts when they receive it, not when they get round to opening it.

Step 2 · The request

Send the email.

Copy the email below, fill in the three bracketed placeholders, and send it from the address you registered with First Tutors. The template cites the right articles and addresses the predictable objection that reviews are someone else's data rather than yours. (They are both, per Nowak v Data Protection Commissioner, Case C-434/16, CJEU Second Chamber, 20 December 2017.)

To: dpo@firsttutors.co.uk Subject: Data Subject Access & Portability Request: UK GDPR Articles 15 & 20

Dear Data Protection Officer,

I am exercising my rights under Article 15 (Right of Access) and Article 20 (Right to Data Portability) of the UK GDPR.

Please provide, within one calendar month of receipt (Article 12(3)) and free of charge (Article 12(5)):

1. Under Article 20, in a structured, commonly used and machine-readable format (CSV or JSON preferred): all personal data I provided to First Tutors, including but not limited to my profile content (name, photo, bio, subjects, levels, hourly rate, qualifications, availability, location), my account and contact information, and the messages I sent through the platform.

2. Under Article 15(3), in a commonly used electronic form: a copy of all other personal data First Tutors processes about me, including all reviews, ratings, and comments written about me by students or parents (these are my personal data per Nowak v Data Protection Commissioner C-434/16), all messages I received, account and login logs, payment records, and any internal notes, flags, or moderation records.

3. The information required by Article 15(1)(a)-(h): the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom data has been disclosed, the retention period, the source of any data not collected directly from me, and any automated decision-making.

I confirm my identity by writing from the email address registered to my First Tutors account ([INSERT YOUR REGISTERED EMAIL HERE]). My account username is [INSERT YOUR USERNAME / DISPLAY NAME HERE]. Please do not request additional ID unless you have specific, reasoned doubts about my identity (Article 12(6); ICO guidance on reasonable and proportionate verification).

Where the disclosure of reviewer-identifying information would engage Article 15(4) UK GDPR or paragraph 16 of Schedule 2 Part 3 of the Data Protection Act 2018, please redact only the information that would identify the reviewer. The review text, rating, date, and subject must still be disclosed: these are my personal data, not the reviewer's identifying information.

If First Tutors enters administration, liquidation, or any other insolvency process before this request is fulfilled, please forward this request to the appointed office-holder. The obligation to comply with a Data Subject Access Request survives the appointment of an office-holder, and the ICO has enforced compliance in similar cases (Re SCL Elections / Cambridge Analytica, 2018-19). If the company is dissolved before responding, please confirm in writing that the request has been recorded so that it may be reactivated on any subsequent restoration to the register.

Beyond my own data: if it is feasible during the wind-down, please also consider publishing a static, public archive of tutor profiles and reviews at a stable URL. Even a simple flat-file mirror would give former tutors durable, third-party-verifiable evidence of their reviews, which is the cleanest provenance signal for other platforms. I appreciate this is a courtesy rather than a legal obligation, but it would meaningfully reduce the cost of the closure for the people who built reputations on First Tutors over many years.

Please confirm receipt of this request and the date by which you will respond.

Yours faithfully,

[YOUR FULL NAME]
[YOUR REGISTERED EMAIL]
[TODAY'S DATE]

Open in your email app

Four things worth knowing

Send it from the email address you registered with First Tutors. Write from anywhere else and the DPO has grounds to ask for ID first, which costs you weeks.
Save a copy of the email and any reply. If they miss the deadline, those timestamps are what an ICO complaint runs on.
The legal references do the work. You don't need to soften the email or apologise for sending it.
First Tutors' own published Privacy Policy (archived 7 March 2026) explicitly confirms the right of access and the right to data portability "in a structured, commonly used, and machine-readable format". They've already promised the rights you're exercising.

Step 3 · When the reply lands

Upload the reply.

When First Tutors replies with your DSAR data, head to the import flow on your Tutorperch account (sign-in required). Upload the email or data file they sent you and we'll verify it's authentically from First Tutors, then import the reviews on top of whatever the archive claim already gave you. Imported reviews live in their own block on your profile, labelled as imported, separate from your native Tutorperch reviews.

What counts as verified.

Either one of these is enough. You don't need both.

A valid DKIM signature on the email First Tutors sent you. Every email First Tutors sends carries a DKIM signature, a cryptographic stamp applied by their mail servers. We verify it against the public key they publish in DNS. A valid signature proves the email genuinely came from First Tutors and the body hasn't been altered since they sent it. Forwarding breaks the signature, so we need the raw source. How to extract the raw source from your email provider.
A Wayback Machine link to the original review. Public First Tutors profile pages were archived for years. If you can find a review on a snapshot of your old profile, paste the snapshot URL with your import. The Wayback Machine is independent of both you and First Tutors, which is what makes it useful as evidence.

Reviews backed by neither, we wouldn't accept.

Upload your DSAR data Questions? Get in touch

Questions

Common questions.

Has First Tutors actually closed?: Yes. The closure notice was published on 8th May 2026 after more than nineteen years of trading (EduNation Limited incorporated 29 January 2007). The directory is no longer accessible; the homepage shows the announcement.
Who do I contact for a data privacy enquiry?: dpo@firsttutors.co.uk. The address was named in the closure notice and remained live as of 11 May 2026. That is the address used in the request template above. For general (non-privacy) enquiries the named address is info@firsttutors.co.uk, though responses are expected to be slow during the wind-down.
I'm in Scotland or Northern Ireland. Does this still apply?: Yes. UK GDPR applies across the United Kingdom, so the right of access (Article 15) and the right to data portability (Article 20) operate identically wherever you tutor from. The ICO's remit covers all four nations, and the template above is suitable as-is.
Will First Tutors actually respond?: They have a statutory obligation to. UK GDPR Article 12(3) gives them one calendar month from receipt, free of charge. They can extend by up to two further months for genuinely complex requests, but only if they tell you in writing within the first month. The ICO takes non-response seriously even during a wind-down, and the fact that First Tutors named a DPO contact in their closing notice signals they expect requests.
What if they refuse or ignore me?: Complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. The process is free, and they take DSAR non-compliance seriously. EduNation Limited (the company that operates First Tutors) is registered with the ICO under registration number Z1938712, which is the reference an ICO case officer will look up. The leading enforcement example is the Cambridge Analytica / SCL Elections case (ICO enforcement notice in 2018, prosecution and £15,000 fine in 2019), where the ICO pursued a DSAR all the way through the company's administration. The lever is real even when the company is winding down. The complication is timing: if the company is dissolved before they respond, your practical route narrows sharply. The company has ceased to exist as a legal person, and recovering your data then requires a court application to restore it to the register under sections 1024-1030 of the Companies Act 2006. That is why we recommend acting now rather than waiting.
Do I need to send proof of ID?: Probably not. ICO guidance says identity checks should be reasonable and proportionate, so sending the request from the email address you registered with is usually enough. If the DPO asks for ID without giving a specific reason for doubting your identity, you can push back politely and cite Article 12(6).
My students or their parents wrote the reviews. Are they really my personal data?: Yes. The Court of Justice settled this in Nowak v Data Protection Commissioner (Case C-434/16, CJEU Second Chamber, 20 December 2017): opinions and assessments written about an identifiable person are that person's personal data because of their content, purpose, or effect, and any one of those three limbs is enough. A named tutor's reviews fit squarely within that, and Nowak remains binding retained EU case law in the UK. The reviewer's name can ordinarily be redacted to protect their identifying information, but the review text, rating and date should be disclosed.
Can I include messages from my students in the request?: Yes. Your message history is your personal data. The template above asks for both the messages you sent (covered by Article 20 portability) and the messages you received (covered by Article 15 access).
I was a student on First Tutors. Can I do this too?: Yes. Every user has the same UK GDPR rights regardless of role. Students can request their messages, the reviews they wrote, payment records and account history. The same template works; change "tutor" to "student" where appropriate.
Once I have my data, can I bring my reviews to Tutorperch?: Yes: imports went live in May 2026. Imported reviews sit on your profile in their own block, labelled as imported, separate from your native rating. Today they don't feed search ranking, and we'd revisit that openly rather than quietly if we ever did. Two verification paths cover most tutors: a DKIM-signed email from First Tutors, or Wayback Machine cross-checks on archived profile snapshots. Either is enough. List at /list to get started, and /contact for questions.

Recover your reviews in three steps.

Pick wherever you want to start. The archive claim is the fastest path; the DSAR is the statutory route for everything the archive didn't capture.

1 Claim archive

2 DSAR template

3 Upload reply

Ready to start listing once you're done? List as a tutor on Tutorperch →

This page is informational, not legal advice. The legal framework discussed is the UK GDPR (assimilated Regulation (EU) 2016/679, retained under section 3 of the European Union (Withdrawal) Act 2018 and reclassified as assimilated law by the Retained EU Law (Revocation and Reform) Act 2023) and the Data Protection Act 2018. For more on UK data subject rights, see the ICO's right of access guidance.