Last updated: 20/9/25

Introduction

The Nursery Family and iStep Learning are committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This Privacy Policy explains how we collect, use, store, and share personal data, particularly in relation to enquiries and tour bookings submitted by parents and carers. This policy is supported by our internal data protection procedures and our separate privacy notices for staff and registered parents.

Who This Notice Applies To

This privacy notice applies to:

• Parents or carers submitting enquiries via our website contact form;
• Individuals booking nursery tours through Microsoft Bookings;
• Individuals receiving communications from The Nursery Family and /or iStep Learning in relation to early years services.

What Data We Collect

We may collect the following personal data when you contact us or book a nursery tour:

• Parent/carer full name
• Parent/carer email address
• Child’s date of birth
• Requested start date for childcare
• Preferred nursery location

We collect this information in order to assess availability in our nurseries, taking into account room suitability and staff-to-child ratios, and to respond to your enquiry or manage your scheduled nursery tour. As we collect data relating to children under the age of 13, we ensure enhanced safeguards and adhere to principles of necessity and proportionality when handling such data.

How We Collect Your Data

We collect data:

• Directly from you via our website contact form;
• Through Microsoft Bookings, which allows you to book nursery tours directly into our calendars.

In both cases, the information is securely stored and transferred to our internal nursery management system (EYWorks) for follow-up and nursery placement administration.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Legitimate Interests (UK GDPR Article 6(1)(f)) – to respond to your enquiries, assess childcare availability, and manage nursery tour appointments;
• Consent (Article 6(1)(a)) – where you opt in to receive marketing communications or newsletters;
• Contract (Article 6(1)(b)) – when entering into or preparing to enter into a childcare agreement;
• Legal Obligation (Article 6(1)(c)) – where we are required to comply with regulatory frameworks such as Ofsted and safeguarding legislation.

Where any data qualifies as special category data (e.g. safeguarding-related health or development concerns), we process this under:

• Explicit Consent (Article 9(2)(a)); or
• Substantial Public Interest (Article 9(2)(g)) for safeguarding-related obligations.

Use of Microsoft Bookings

We use Microsoft Bookings to allow you to schedule nursery tours. When you use this service, you will be asked to provide the same information as on our contact form.

This information is securely processed by Microsoft, which acts as a data processor on our behalf. Data is transferred to EYWorks for internal follow-up and nursery management purposes. Microsoft provides its services under a contract with us, using Standard Contractual Clauses (SCCs) to safeguard any transfers of data outside the UK/EEA.

Marketing and Newsletters

We will only send marketing emails, newsletters or updates if you explicitly consent to receive them. You can withdraw your consent at any time by contacting us at the address below or using the unsubscribe link in our communications.

Cookies and Tracking

Our website uses cookies and similar technologies to enhance your experience and analyse website performance. Non-essential cookies are only used with your consent. Please refer to our Cookie Policy for full details.

Data Sharing and International Transfers

We will never sell your personal data. We may share your data with trusted service providers, including EYWorks and Microsoft, where necessary for nursery management, booking systems, and communication.

Some providers and partners may be located outside the UK or EEA. Where this is the case, we only transfer personal data when appropriate safeguards are in place. These may include:

• UK adequacy regulations;
• the International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs), supplemented where necessary by additional legal and technical safeguards; or
• tailored contractual agreements with the recipient party that meet or exceed UK data protection standards.

We regularly review these arrangements to ensure they remain effective and proportionate to the level of risk.

How Long We Keep Your Data

• Enquiry and tour booking data is retained for a maximum of 12 months if it does not lead to registration.
• If you register your child at one of our nurseries, your data will be retained in accordance with our parent privacy policy, typically 7 years from the end of your child’s attendance, to meet legal and regulatory obligations.

Your Rights

Under the UK GDPR, you have the right to:

• Access your personal data;
• Request correction of inaccurate data;
• Request deletion of your data (“right to be forgotten”);
• Restrict or object to processing;
• Request data portability (in some cases);
• Withdraw consent where processing is based on consent.

To exercise any of these rights, please email:
marketing@isteplearning.co.uk

How We Keep Your Data Secure

We have robust security procedures in place, including:

• Access controls and staff training;
• Secure systems and cloud platforms;
• Regular review of data protection practices.
• SSL encryption, two-factor authentication, regular vulnerability assessments.

We regularly assess the suitability of our data protection arrangements to ensure your data remains safe and secure. In particular, as we collect and process data relating to children under the age of 13, we apply enhanced safeguards in accordance with the ICO’s Children’s Code and ensure that such processing is limited to what is necessary and proportionate to provide our early years services.

Complaints and Contact Information

If you have concerns about how we handle your data, or wish to exercise any of your data protection rights, please contact:

marketing@isteplearning.co.uk

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

www.ico.org.uk