Privacy Policy

1.Who we are

Nursery Room Ltd (“we”, “us”, “our”) is a company registered in England and Wales (Company No. 11237964) with our registered office at 375 Bellegrove Road, Welling, Kent, DA16 3RL, United Kingdom.

We are the data controller for the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO) as a data controller (registration reference ZA483656).

2.The information we collect

We collect personal information in the following ways:

• Directly from you — when you contact us, submit an enquiry, or engage our services.
• Automatically — through our website, including usage data, IP addresses, and cookies.
• From third parties — including our accounting software, payment processors, and service providers.

The categories of personal information we may collect include:

• Contact details (name, email, phone, address)
• Business or organisation information (where applicable)
• Financial transaction records (for accounting purposes)
• Children’s information — collected only from families engaging our nursery services, with appropriate parental consent and under separate notice
• Website analytics data (browser type, pages visited, referral source)

3.How we use your information

We use personal information to:

• Provide our nursery and related services
• Respond to enquiries and communicate with you
• Process payments and maintain accounting records
• Meet legal, regulatory, and tax obligations
• Improve our website, services, and operations
• Protect our business, our customers, and others

4.Our legal basis for processing

Under UK GDPR Article 6, we process personal information on these lawful bases:

• Contract — where processing is necessary to fulfil our services to you
• Legal obligation — where required by tax, accounting, employment, or regulatory law
• Legitimate interests — for the everyday operation of our business, balanced against your rights
• Consent — where you have given specific consent (e.g. marketing communications)

5.Third-party services we use

We use trusted third-party services to operate our business. These include cloud accounting, payment processing, communications, and analytics providers.

Other service providers we may use include hosting providers, communication platforms (such as email services), payment processors, and analytics tools. Each operates under its own privacy policy, and we only share the minimum information necessary.

6.Children’s information

As a nursery provider, we have particular responsibilities towards children’s information. Where we collect data about children:

• We do so only with the appropriate parental or guardian consent
• We follow Early Years Foundation Stage (EYFS) guidance and Ofsted requirements
• Records are kept securely and accessed only by authorised staff
• Children’s records are retained for the periods required by statute (typically up to 21 years for safeguarding records)

Families engaging our nursery services receive a separate, more detailed privacy notice explaining exactly what information we hold and how it is used.

7.How long we keep your information

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law:

• General enquiries: up to 12 months
• Financial and tax records: 7 years (HMRC requirement)
• Children’s records: as required by statutory and safeguarding obligations
• Website analytics: anonymised after 26 months

8.Sharing your information

We do not sell personal information. We may share information with:

• Service providers acting on our behalf (e.g. accounting, hosting, communications)
• Professional advisors (e.g. accountants, solicitors, auditors)
• Regulators (e.g. HMRC, Ofsted, the Information Commissioner’s Office) where required
• Law enforcement, where legally compelled to do so

9.International transfers

Some of our service providers may process information outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place — such as UK or EU adequacy decisions, the International Data Transfer Agreement, or Standard Contractual Clauses — to protect your information.

10.Your rights

Under UK GDPR, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion (“right to be forgotten”) in certain circumstances
• Restrict or object to our processing
• Request your information in a portable format
• Withdraw consent at any time (where consent is the legal basis)
• Lodge a complaint with the Information Commissioner’s Office

To exercise any of these rights, please use the contact details below. We will respond within one month, in line with UK GDPR requirements.

11.How we protect your information

We implement appropriate technical and organisational measures to safeguard personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication on systems holding personal data
• Regular review of security practices
• Staff training on data protection and confidentiality

While we take every reasonable step to protect personal information, no system is entirely immune to risk. If a personal data breach occurs that affects your rights and freedoms, we will notify you and the ICO in line with our legal obligations.

12.Cookies

Our website uses cookies for essential functions and to understand how visitors use the site. You can manage cookies through your browser settings. By using our website, you consent to our use of cookies as described.

13.Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website. The effective date at the top shows when changes were last made. We encourage you to review this policy periodically.

14.Contact us

For privacy enquiries, or to exercise any of your rights, please contact us:

You also have the right to complain to the UK supervisory authority: