GDPR & Data Protection Policy

01Purpose of this policy

This policy explains how Nurture Sense collects, uses, stores, and protects personal information about parents and children who attend classes. It ensures compliance with data protection and safeguarding law in both England and Wales, and outlines the practical steps taken to protect families’ information.

02Relevant laws and guidance

This policy follows the requirements of:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR) (for email/SMS contact)
• Human Rights Act 1998 (Article 8 – right to privacy)
• Children Acts 1989 and 2004 (England safeguarding)
• Working Together to Safeguard Children (2023) (England guidance)
• Social Services and Well-being (Wales) Act 2014 and Wales Safeguarding Procedures (2019)
• Guidance from the Information Commissioner’s Office (ICO) – www.ico.org.uk

03Data controller

Nurture Sense is the data controller for all personal information collected.

Contact: [email protected]

04What information is collected and why

Nurture Sense only collects the information necessary to run classes safely and effectively. This may include:

• Parent or carer’s name, address and contact details (email, phone number),
• Child’s first name, age/date of birth
• Relevant medical, needs or allergy information that parents elect to provide
• Attendance records and payment details.

This information is used to:

• Manage class bookings and communication.
• Ensure the safety and wellbeing of participants.
• Maintain accurate financial and safeguarding records.

Information will not be used for marketing unless explicit consent has been given.

05Data collected via Google Forms

Some information (such as bookings, registration, or mailing list sign-ups) is collected using Google Forms.

Responses are stored securely in Google Drive. Google acts as a data processor and complies with UK GDPR via its Data Processing Terms and participation in the EU–US Data Privacy Framework.

To keep this information safe and compliant:

• My Google account is protected by a strong password and 2-Step Verification.
• Only I have access to form responses.
• Forms and linked spreadsheets are stored in private, non-shared Google Drive folders.
• Data is deleted from Google Forms once no longer needed.
• Each form includes a brief privacy statement explaining what data is collected, why, and how it will be stored.

When using Google Forms, Nurture Sense is responsible for following data protection rules.

Keep it simple and safe:

• Only ask for information we need
• Include a brief privacy statement (e.g. We’ll only use your information to contact you about Nurture Sense classes and updates. You can unsubscribe at any time.).
• Don’t share contact details with anyone else.
• Use BCC when emailing your list manually.

This ensures that online data collection meets the same standards as other stored information.

06Images and photographs

Nurture Sense has a strong ethical stance on images of children. I will never use images of children for marketing or promotional purposes, even with parental consent.

At Nurture Sense we believe children are too young to provide informed consent, and I believe protecting their privacy is essential.

Only general, non-identifying images (e.g. hands, toys, props) may be used for marketing or social media.

07Lawful basis for processing

Personal data is processed under the following lawful bases:

• Contract: to provide the service booked by parents.
• Legal obligation: to maintain financial and safeguarding records.
• Vital interests: to protect someone in a medical or safeguarding emergency including attendance register.
• Consent: for optional communications such as newsletters or photos of adults.

08Children’s data and consent

Children’s personal data is treated as highly sensitive. Parents or legal guardians act as the main decision-makers for any data relating to their child.

For online sign-ups, I recognise the UK age of 13 as the minimum for a child’s own consent to online services; below this, parental consent is always required.

09How data is stored and kept safe

• Laptop: password-protected, encrypted, and protected by current antivirus software.
• Memory stick: encrypted and used only for secure backups.
• Cloud storage: trusted UK/EU-based provider with encrypted login e.g. One Drive, Google Drive
• Google Drive: protected by 2-Step Verification and stored in private folders.
• Paper records: kept in a locked cabinet and shredded when no longer required.

Access to personal data is limited strictly to the data controller.

Data is retained only as long as necessary — usually one year after the last class attended, unless required longer for safeguarding, financial, or legal purposes.

10Retention schedule

11Sharing information

Personal data will never be shared with third parties unless:

• It is required by law (e.g. safeguarding, medical emergencies, or HMRC).
• Consent has been specifically provided.

In safeguarding cases, I will share information only with the appropriate authorities, following:

• The Wales Safeguarding Procedures (2019) and Regional Safeguarding Board guidance when in Wales.
• The Working Together to Safeguard Children (2023) guidance when in England.

I am legally required under the Social Services and Well-being (Wales) Act 2014 and the Children Acts 1989/2004 to report concerns if I believe a child is at risk of harm.

Records of any such decisions or disclosures are stored securely.

12CCTV at venues

Some community venues may operate CCTV for security purposes.

Nurture Sense is not the data controller for any CCTV footage; parents should contact the venue directly for CCTV-related queries or requests.

13Marketing and communications (PECR)

Marketing emails or text messages are sent only:

• With the individual’s explicit consent, or
• Under the soft opt-in rule for existing customers (where the individual has attended classes and can easily opt out).

All communications include a clear unsubscribe option which is to email [email protected] and ask to be unsubscribed.

14Data breaches – procedure and reporting

A data breach is any loss, theft, unauthorised access, or accidental sharing of personal data.

If a breach occurs, I will:

• Record the incident – what happened, when, and which data was affected.
• Contain and recover – secure accounts, reset passwords, and retrieve data.
• Assess the risk to individuals’ rights or freedoms.
• Notify the ICO within 72 hours if the breach poses any risk.
• Inform affected individuals promptly with clear information and guidance.
• Take corrective action to prevent recurrence (training, security review, updated software).

All breaches are logged, whether or not they require ICO notification.

First 72 Hours Checklist:

• Contain: stop further access or sharing.
• Assess: identify what data, who is affected, possible harm.
• Decide: report to ICO if rights/freedoms may be affected.
• Communicate: notify those affected promptly and support them.
• Document: keep full record of actions taken.

15Seeking advice and support

If I have questions about data protection, I will seek advice from the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Helpline for small organisations: 0303 123 1113

I also review the ICO’s small business checklists and templates annually to ensure ongoing compliance.

16Rights of parents and carers

Parents and carers have the right to:

• Access the personal data held about them or their child.
• Request correction of inaccurate information.
• Request deletion of their data (where legally possible).
• Withdraw consent for optional uses such as newsletters.
• Complain to the ICO if they believe data has been mishandled.

Requests can be made by email to [email protected] and will be handled within one month.

Before responding, I will verify the requester’s identity to protect privacy.

17Accountability and data protection lead

As the sole business owner, I act as the Data Protection Lead for Nurture Sense.

I will complete a brief annual review of this policy, check my data storage security, and refresh my understanding using ICO resources.

18Nurture Sense – Your Privacy Matters

At Nurture Sense, I take your privacy — and your child’s — very seriously. I only collect the information I genuinely need to run classes safely, stay in touch, and make sure everyone feels comfortable and supported.

Here’s how your information is handled:

🌱 What I collect

When you register for a class or join the mailing list, I’ll ask for things like:

• Your name and contact details (so I can confirm bookings or reach you in an emergency).
• Your child’s first name, age, and any medical or allergy information I should know about.
• Occasionally, information about how you found the classes or what you hope to get from them — to help me improve what I offer.

🌼 How it’s collected

Most information comes through a Google Form (for bookings or mailing lists). This is stored securely in my Google Drive, protected by passwords and two-step verification, and only I can access it.

Paper forms are kept in a locked cabinet and shredded once they’re no longer needed.

🌸 How it’s used

Your information helps me:

• Keep you and your baby safe in sessions.
• Contact you about classes or updates you’ve signed up for.
• Keep records for legal or accounting reasons.

I’ll never share your details for marketing, and I’ll never post or use photos of children — even with consent. I believe children’s privacy is too important to risk.

🌿 How it’s kept safe

All data is stored on a password-protected laptop and in secure, encrypted folders. Cloud storage and Google Drive are used carefully and privately.

Information is deleted when it’s no longer needed — usually within a year after your last class.

🌻 Your rights

You can:

• Ask to see what information I hold about you or your child.
• Ask me to correct or delete it (where legally possible).
• Change your mind about being on the mailing list at any time.

Just email me at [email protected] — I’ll always respond within a month.

🌾 Safeguarding and the law

If I ever have a concern that a child may be at risk of harm, I have a legal duty to share relevant information with safeguarding professionals.

I follow both Welsh and English safeguarding laws and guidance, depending on where a class takes place.

Your personal details will never be shared unless it’s absolutely necessary for safety or required by law.

🌷 Need more details?

You can read the full Nurture Sense GDPR & Data Protection Policy for all the finer points, please email [email protected] to request a copy.

I also follow guidance from the Information Commissioner’s Office (ICO) and will always seek their advice if I have any questions about protecting your information.

Contact: [email protected]

Nurture Sense – Grounded in theory. Nurtured through connection.

19Website, cookies and external forms

The Nurture Sense website itself does not set cookies, use analytics or advertising trackers, or store information in your browser. There are no forms embedded on the website; booking and mailing-list links take you to Google Forms.

If you choose to complete a Google Form, the information you submit is collected through Google and made available to Jess to manage bookings or the mailing list, as described in this policy. Google may use cookies and process technical information on its own services under its own privacy and cookie policies. Following a social media link also takes you to a separate service with its own privacy practices.

Our hosting and infrastructure providers may process technical information, such as your IP address, browser details and the pages requested, in server or security logs to deliver and protect the website. This is separate from cookies and from the information you choose to submit through Google Forms. If cookies, analytics or embedded services are added in future, this notice will be reviewed and any required choices provided.