Last updated: 26 September 2026. This policy explains what personal data ParentLink collects, why we collect it, who we share it with, and what rights you have over it.
For the technical controls that back this policy, see /security. For the contract terms that apply when you use the service, see /terms.
ParentLink is operated by ParentLink Education Ltd, a company registered in Scotland under company number SC900539. We are registered with the UK Information Commissioner’s Office as a data controller, reference ZC232143.
For privacy questions, email privacy@parentlinkeducation.co.uk. For security disclosures, email security@parentlinkeducation.co.uk.
ParentLink operates as a data processor for the nurseries, clubs, and childminding settings that use the platform. That means your nursery — not ParentLink — is the data controller for the personal data they enter about children, parents, and staff. We process that data on their instructions, under a written data processing agreement.
ParentLink acts as the data controller only for a narrow set of platform-level data: your account email when you sign in, our billing relationship with the nursery, support correspondence, and the operational telemetry we need to keep the service running.
We do not use advertising cookies, behavioural tracking pixels, cross-site trackers, or session-replay tooling. We do not run Google Analytics, Hotjar, or Facebook Pixel. For basic traffic measurement we use Vercel Web Analytics, which is cookieless, stores no personal data, and only records anonymous, aggregated page views — it cannot identify or follow you across sites. ParentLink sets no cookies of its own. The app keeps your sign-in session and a few preferences (such as the tab you last had open) in your browser’s local storage — strictly necessary for the service to work, so no consent banner is needed. Card and Direct Debit payment pages are run by Stripe and GoCardless, which set their own cookies under their own policies.
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing the platform to the nursery | Contract (with the nursery) — Art. 6(1)(b) |
| Processing children's data on the nursery's behalf | Performance of the nursery's contract with parents — Art. 6(1)(b) |
| Health and dietary data for safeguarding | Vital interests + safeguarding child welfare — Art. 6(1)(d), Art. 9(2)(c) |
| Audit logging and security telemetry | Legitimate interests — Art. 6(1)(f) |
| Direct billing relationship with the nursery | Contract — Art. 6(1)(b) |
| Service announcements (outage notices, breaking-change notes) | Legitimate interests — Art. 6(1)(f) |
| Marketing emails to nursery decision-makers | Consent (opt-in) — Art. 6(1)(a) |
| Emails to a setting's existing parents about spare sessions at that setting | Legitimate interests + PECR soft opt-in (reg. 22(3)) — Art. 6(1)(f); one-click opt-out in every email |
We use a small number of third-party services to run ParentLink. Each one is a data sub-processor under our DPA. Your nursery’s operational data — children, staff, attendance and billing records — is hosted on Supabase’s UK (London) region, so the primary database stays in the UK with no cross-border transfer. The other services below — edge delivery, email and SMS, push notifications, translation and AI assist — can involve transfers outside the UK, to the EU and to the US. Transfers to the EU rely on the UK’s adequacy regulations for the EU; transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise the UK International Data Transfer Addendum to the EU standard contractual clauses.
A nursery can also connect its own accounting software (Xero or QuickBooks). Those connections are the nursery’s own accounts, set up and ended by the nursery, rather than ParentLink sub-processors.
We do not sell, rent, or share customer data for advertising, behavioural profiling, or any other secondary purpose. Ever. This is hardcoded into our DPA and would be a breach for us to do otherwise.
ParentLink does not delete a nursery’s records on a timer. Care records — attendance, safeguarding, incidents, medication and the rest — are kept for as long as the nursery is a customer, so the nursery can meet its own statutory retention duties (Ofsted and the other regulators expect some records to be kept for years after a child leaves). When a child leaves, the nursery marks them as left and the record stays. Erasing a child’s record is handled on request to privacy@parentlinkeducation.co.uk, except where statutory retention applies. When a nursery leaves ParentLink it has 60 days to export its data, and we then delete it within a further 30 days (as our Terms set out).
Under UK GDPR you have the right to:
If your data is controlled by your nursery (i.e. data about your child), please raise the request with your nursery in the first instance — they have the tools to fulfil it directly. If you can’t reach them, email privacy@parentlinkeducation.co.uk and we’ll help.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk. If you are in Ireland, you can also complain to the Data Protection Commission at dataprotection.ie.
We’ll update this page if we change how we handle data. Material changes will be flagged at the top of the page for 30 days and emailed to nursery administrators. The “last updated” date at the top tells you when the most recent change was.