How ParentLink processes your setting’s data.

1. Parties and how this agreement applies

1.1 This Data Processing Agreement ("DPA") is between:

• ParentLink Education Ltd, a company registered in Scotland, company number SC900539, registered with the UK Information Commissioner's Office under reference ZC232143 ("ParentLink", "we"); and
• the nursery, club, childminder or other childcare setting that has signed up to the ParentLink service ("the Customer", "you").

1.2 It forms part of the ParentLink Terms of Service ("the Terms") and applies whenever ParentLink processes personal data on the Customer's behalf in providing the service. By accepting the Terms, the Customer accepts this DPA. If this DPA and the Terms conflict on the protection of personal data, this DPA wins.

1.3 Roles. The Customer is the controller of the personal data it puts into ParentLink or collects through it. ParentLink is its processor. ParentLink is a controller only for its own account, billing and support records about the Customer and its users (covered by the Privacy Policy, not this DPA).

1.4 Law. "Data Protection Law" means the UK GDPR and the Data Protection Act 2018 and, for a Customer established in the Republic of Ireland, Regulation (EU) 2016/679 (the EU GDPR) and the Irish Data Protection Acts 1988–2018.

2. What is processed (UK GDPR Art. 28(3))

2.1 Subject matter and purpose. Providing the ParentLink childcare management service to the Customer: registers and attendance, children's records, care logs, learning journals, messaging with families, billing and payments, staff records and rotas, and the related parent app.

2.2 Duration. For as long as the Customer uses the service, and afterwards only for the export and deletion periods in section 10.

2.3 Nature of processing. Storing, organising, displaying, transmitting (to the Customer's staff and to the families the Customer chooses), backing up and deleting personal data, on the Customer's instructions given through its use of the service.

2.4 Categories of data subjects. Children attending the setting; their parents, carers and authorised collectors; the setting's staff; prospective families on the waiting list; for a childminder, their own children and the adults who live in their home.

2.5 Categories of personal data. Names, dates of birth, contact details, addresses, attendance and session records, photographs and video, learning observations and assessments, care records (meals, sleep, nappies), incident and accident records, messages, invoices and payment records, staff employment and rota records; for a childminder, their own children's dates of birth and the dates of the vetting checks (DBS, PVG or AccessNI) of the adults in their home.

2.6 Special category and sensitive data. Health information (allergies, dietary and medical needs, medication records), special educational needs, and safeguarding records, as the Customer chooses to record them. Where the Customer records safeguarding or child-protection information, it is responsible for having a lawful basis and condition for doing so.

3. ParentLink's obligations

ParentLink will:

3.1 process the Customer's personal data only on the Customer's documented instructions — which are the Terms, this DPA and the Customer's use and configuration of the service — unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it;

3.2 tell the Customer promptly if we believe an instruction breaks Data Protection Law;

3.3 ensure everyone we authorise to process the data is under a duty of confidentiality;

3.4 apply the security measures in Annex A;

3.5 use sub-processors only as set out in section 4;

3.6 help the Customer, taking into account the nature of the processing, to respond to people exercising their rights (section 6);

3.7 help the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a regulator, taking into account the information available to us;

3.8 at the end of the service, delete or return the data as set out in section 10; and

3.9 make available the information needed to show compliance with this DPA, and allow for audits as set out in section 9.

4. Sub-processors

4.1 The Customer gives general authorisation for ParentLink to use the sub-processors listed in Annex B (and published on the Privacy page).

4.2 Before adding or replacing a sub-processor, we will email the Customer's account owners (the people named as owners of the setting in ParentLink) and update the sub-processor list on the Privacy page, at least 30 days in advance. The Customer may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, the Customer may end the service without penalty before the change takes effect.

4.3 Each sub-processor is bound by a written contract with data-protection obligations no less protective than this DPA. ParentLink remains responsible to the Customer for its sub-processors.

4.4 Some services are optional and switched on by the Customer (SMS, AI writing assist, the Just ask assistant, message translation, card and Direct Debit payments). A Customer that does not switch one on sends it no data.

4.5 Accounting software the Customer connects (Xero, QuickBooks) is the Customer's own account and processor, not a ParentLink sub-processor.

5. International transfers

5.1 The Customer's core data (the database, authentication and file storage) is held in the UK (Supabase, London region).

5.2 Some sub-processors in Annex B process data in the EU or the US. Transfers to the EU rely on the UK's adequacy regulations for the EU. Transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Addendum to the EU standard contractual clauses (or the International Data Transfer Agreement).

5.3 For a Customer in the Republic of Ireland, transfers to the UK rely on the European Commission's adequacy decision for the UK, and onward transfers on the mechanisms above.

6. Helping with individuals' rights

6.1 The service includes tools for the Customer to answer requests itself: a one-click export of a child's record (profile, guardians, attendance, care records, documents, photos and finances), correction of any record, and erasure of a parent account in the app.

6.2 If ParentLink receives a request directly from an individual about the Customer's data, we will pass it to the Customer without undue delay and will not answer it ourselves unless the Customer asks us to.

6.3 The Customer erases a child's record itself, from Settings → Data retention, once the retention period it has set has passed; each deletion is approved by someone the Customer allows in its Roles and permissions (a manager unless it chooses otherwise; safeguarding records also need someone it allows to open its safeguarding log, and invoices and payments someone with Finance) and logged. ParentLink provides the means and carries out the deletion the Customer approves. The Customer may also set, in the same place, how long it keeps the messages, daily care logs, registers and gallery photos of children still in its care; records older than a period it sets are deleted in the same way, except gallery photos it has already archived, which are deleted automatically at the period it sets.

7. Personal data breaches

7.1 ParentLink will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information then available: what happened, the categories and rough numbers of people and records affected, the likely consequences, and what we have done or propose to do. We will send further information as we learn it.

7.2 Notifying the regulator (the ICO, or for Irish customers the Data Protection Commission) and affected individuals is the Customer's decision as controller; we will help.

8. Support access

8.1 ParentLink support works inside the Customer's data only when a manager at the Customer's setting grants support access, for a limited time, as "view only" or "with changes". The grant can be ended at any moment. Everything support does while access is open is written to the Customer's own audit log under ParentLink's name.

8.2 A few account actions are taken by ParentLink without a grant, because the person who would grant it may be the one locked out: turning off a user's two-factor sign-in, adding a manager, giving or removing group-wide access, pausing or resuming sending, adding sending credit, and a full copy of the Customer's data. When one is asked for, ParentLink first checks the request comes from the Customer, through contact details already on file. Each one is written to the Customer's own audit log as ParentLink support.

8.3 Even with changes allowed, ParentLink support cannot alter the Customer's care records (attendance, medication, incidents, safeguarding, observations, diary, messages to families and similar). This is enforced by the service itself, not only by policy.

8.4 Like any hosting provider, ParentLink's engineers hold administrative credentials to the underlying infrastructure, used only to operate, secure and restore the service.

9. Audits and information

9.1 ParentLink will provide, on request, the information reasonably needed to show compliance with this DPA, including a description of our security measures and sub-processors.

9.2 If that information is not enough, the Customer (or an independent auditor bound by confidentiality) may audit ParentLink's compliance, on at least 30 days' notice, no more than once a year unless a breach or a regulator requires it, during business hours, at the Customer's cost.

9.3 An audit will be carried out first by written questions and documents, and on site or by remote session only if those are not enough. The auditor may not be a competitor of ParentLink, and an audit will not give access to other customers' data or to information whose disclosure would weaken ParentLink's security; where that limits what can be shown, we will explain how the point is met instead.

10. End of the service

10.1 When the service ends, the Customer has 60 days to export its data: its records with the in-app export (Settings → Data export), and its uploaded files (photos, videos and documents) by asking ParentLink, which will send them. ParentLink will then delete the Customer's data within a further 30 days, except where the law requires us to keep something (for example our own billing records), which we will keep only for that purpose and period.

10.2 The database is backed up daily and each backup is kept for 7 days, then overwritten, so deleted data leaves the backups within 7 days of its deletion. Files (photos, documents, signatures) are not in the database backups; each night they are copied to a private backup store in the same hosting project and region, which no user can reach. A copy is removed 30 days after its file is deleted, so a deleted file leaves the backups within 30 days of its deletion, and one deleted by mistake can be restored in that time.

11. Liability, term and law

11.1 Each party's liability under this DPA is subject to the limits in the Terms (§09: the greater of the fees paid in the 12 months before the claim and £5,000), except where Data Protection Law does not allow liability to be limited. That limit is between ParentLink and the Customer; it does not limit what an individual may claim under Data Protection Law.

11.2 This DPA lasts as long as ParentLink processes the Customer's personal data.

11.3 This DPA is governed by Scots law, matching the Terms.

Annex A — Security measures

• Hosting: database, authentication and file storage in the UK (Supabase, London region); frontend on Vercel.
• Encryption: TLS 1.2+ in transit on every connection; AES-256 at rest (managed by the database provider).
• Separation between customers: row-level security on every table holding a setting's data, so one setting's users cannot read another's.
• Access control within a setting: roles (manager, admin, staff) and permissions set by the Customer; money actions follow the setting's Finance permission.
• Sign-in: passwords handled by the authentication provider; optional two-factor authentication (TOTP) for managers, staff and parents, with recovery codes stored hashed; sign-in attempts throttled.
• Support access: by the Customer's time-limited grant, logged to the Customer's audit log; view-only and care-record limits enforced in the database. The few account actions taken without a grant are logged there too (section 8).
• Audit log: changes to children, billing, permissions and consents logged with old value, new value, who and when; kept 24 months.
• Kiosks and devices: kiosk exit PINs and staff PINs stored hashed. Only if the Customer switches on "Let tablets open with no connection": the register tablet and staff clock-in, signed in as the setting's kiosk account, keep a copy of the next 3, 7 or 14 days' bookings (the Customer chooses) in the tablet's own browser storage, encrypted (AES-GCM) with a key made from an offline code the Customer sets — the code itself is never stored (names, booked sessions, a yes/no health flag, who may not collect, today's sign-ins and the staff list). It opens only under that same account, is refreshed while online, and is deleted when the setting is switched off or the tablet is signed out. The Customer keeps those tablets on its premises, as it does its paper registers.
• Backups: provider-managed backup and recovery.
• Personnel: access to production limited to named engineers under confidentiality.
• Development: automated checks on every change for access-control regressions (for example functions that must never be callable by users, and settings that must never be reachable without a grant).

Annex B — Sub-processors