PRIVACY POLICY

How we handle your data — in plain English.

Last updated: 26 September 2026. This policy explains what personal data ParentLink collects, why we collect it, who we share it with, and what rights you have over it.

For the technical controls that back this policy, see /security. For the contract terms that apply when you use the service, see /terms.

01

Who we are

ParentLink is operated by ParentLink Education Ltd, a company registered in Scotland under company number SC900539. We are registered with the UK Information Commissioner’s Office as a data controller, reference ZC232143.

For privacy questions, email privacy@parentlinkeducation.co.uk. For security disclosures, email security@parentlinkeducation.co.uk.

02

Controller vs processor

ParentLink operates as a data processor for the nurseries, clubs, and childminding settings that use the platform. That means your nursery — not ParentLink — is the data controller for the personal data they enter about children, parents, and staff. We process that data on their instructions, under a written data processing agreement.

ParentLink acts as the data controller only for a narrow set of platform-level data: your account email when you sign in, our billing relationship with the nursery, support correspondence, and the operational telemetry we need to keep the service running.

03

What we collect

Data your nursery enters (they are the controller)
  • Children's names, dates of birth, allergies, dietary needs, SEND status
  • Parent / guardian names, contact details, communication preferences
  • Attendance records, sign-in / sign-out events, zone movements
  • Daily care notes, photos uploaded by staff, observation entries
  • Financial records: fees, funded hours, payment status
  • Staff records: rota, sign-in times, leave requests
Data we collect about you directly (we are the controller)
  • Your account email and hashed password
  • Security logs of sign-ins, resets and other protected actions (IP address, time, action) — kept 30 days, then deleted automatically
  • Browser type and version, for compatibility
  • Support messages you send us
  • Billing information (handled by Stripe / GoCardless — we never see card numbers)

We do not use advertising cookies, behavioural tracking pixels, cross-site trackers, or session-replay tooling. We do not run Google Analytics, Hotjar, or Facebook Pixel. For basic traffic measurement we use Vercel Web Analytics, which is cookieless, stores no personal data, and only records anonymous, aggregated page views — it cannot identify or follow you across sites. ParentLink sets no cookies of its own. The app keeps your sign-in session and a few preferences (such as the tab you last had open) in your browser’s local storage — strictly necessary for the service to work, so no consent banner is needed. Card and Direct Debit payment pages are run by Stripe and GoCardless, which set their own cookies under their own policies.

04

Why we collect it — lawful basis under UK GDPR

PurposeLawful basis (UK GDPR Art. 6)
Providing the platform to the nurseryContract (with the nursery) — Art. 6(1)(b)
Processing children's data on the nursery's behalfPerformance of the nursery's contract with parents — Art. 6(1)(b)
Health and dietary data for safeguardingVital interests + safeguarding child welfare — Art. 6(1)(d), Art. 9(2)(c)
Audit logging and security telemetryLegitimate interests — Art. 6(1)(f)
Direct billing relationship with the nurseryContract — Art. 6(1)(b)
Service announcements (outage notices, breaking-change notes)Legitimate interests — Art. 6(1)(f)
Marketing emails to nursery decision-makersConsent (opt-in) — Art. 6(1)(a)
Emails to a setting's existing parents about spare sessions at that settingLegitimate interests + PECR soft opt-in (reg. 22(3)) — Art. 6(1)(f); one-click opt-out in every email
05

Who we share data with

We use a small number of third-party services to run ParentLink. Each one is a data sub-processor under our DPA. Your nursery’s operational data — children, staff, attendance and billing records — is hosted on Supabase’s UK (London) region, so the primary database stays in the UK with no cross-border transfer. The other services below — edge delivery, email and SMS, push notifications, translation and AI assist — can involve transfers outside the UK, to the EU and to the US. Transfers to the EU rely on the UK’s adequacy regulations for the EU; transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise the UK International Data Transfer Addendum to the EU standard contractual clauses.

Supabase
Database, authentication, file storage
Region: UK (London)
Transfer basis: UK domestic — no cross-border transfer
Vercel
Frontend hosting, edge delivery, cookieless traffic analytics
Region: EU and global edge
Transfer basis: UK adequacy (EU); UK Extension to the DPF or IDTA
Stripe
Card payment processing
Region: UK / EU / US
Transfer basis: UK adequacy; UK Extension to the DPF or IDTA
GoCardless
Direct Debit processing
Region: UK
Transfer basis: UK domestic
Twilio, Vonage or MessageBird
Optional SMS delivery — the nursery chooses the provider and may use its own account
Region: US / EU
Transfer basis: UK Extension to the DPF or IDTA (US); UK adequacy (EU)
Resend, or the nursery's own email provider
Email delivery — ParentLink's shared sender by default; a nursery may use its own Resend account or SMTP server instead
Region: US (Resend); the nursery's provider otherwise
Transfer basis: UK Extension to the DPF or IDTA
Google Firebase Cloud Messaging
Push notifications to the ParentLink Android app (a short notice such as “signed in”, not the record itself). Web push goes through the browser’s own push service.
Region: US / global
Transfer basis: UK Extension to the DPF or IDTA
DeepL
Optional message translation (off by default; nursery-enabled)
Region: EU (Germany)
Transfer basis: UK adequacy
Anthropic
Optional AI writing assist for observations + messages (off by default; nursery-enabled)
Region: US
Transfer basis: UK Extension to the DPF or IDTA

A nursery can also connect its own accounting software (Xero or QuickBooks). Those connections are the nursery’s own accounts, set up and ended by the nursery, rather than ParentLink sub-processors.

We do not sell, rent, or share customer data for advertising, behavioural profiling, or any other secondary purpose. Ever. This is hardcoded into our DPA and would be a breach for us to do otherwise.

06

How long we keep it

ParentLink does not delete a nursery’s records on a timer. Care records — attendance, safeguarding, incidents, medication and the rest — are kept for as long as the nursery is a customer, so the nursery can meet its own statutory retention duties (Ofsted and the other regulators expect some records to be kept for years after a child leaves). When a child leaves, the nursery marks them as left and the record stays. Erasing a child’s record is handled on request to privacy@parentlinkeducation.co.uk, except where statutory retention applies. When a nursery leaves ParentLink it has 60 days to export its data, and we then delete it within a further 30 days (as our Terms set out).

  • Active accounts: as long as the nursery is a customer.
  • Security logs (IP address, time, action): 30 days, then automatically deleted.
  • Audit log entries: 24 months, then automatically purged. Supports SAR and safeguarding investigations.
  • Billing records: 7 years, as required by HMRC.
  • Support correspondence: 3 years after last contact.
  • Backups: our backup and recovery schedule is set out in the Data Processing Agreement, which we provide before processing begins.
07

Your rights

Under UK GDPR you have the right to:

  • Access a copy of the data we hold about you (Article 15).
  • Rectify data that is wrong or out of date (Article 16).
  • Erasure — the “right to be forgotten” (Article 17), subject to statutory retention exceptions.
  • Restrict processing while a complaint is investigated (Article 18).
  • Data portability — receive your data in a structured, machine-readable format (Article 20).
  • Object to processing based on legitimate interests (Article 21).
  • Withdraw consent for marketing communications at any time.

If your data is controlled by your nursery (i.e. data about your child), please raise the request with your nursery in the first instance — they have the tools to fulfil it directly. If you can’t reach them, email privacy@parentlinkeducation.co.uk and we’ll help.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk. If you are in Ireland, you can also complain to the Data Protection Commission at dataprotection.ie.

08

Changes to this policy

We’ll update this page if we change how we handle data. Material changes will be flagged at the top of the page for 30 days and emailed to nursery administrators. The “last updated” date at the top tells you when the most recent change was.