Privacy Notice

Who is responsible for the information?

The nursery, preschool or childcare provider that invited you to KinderByte is normally the data controller. It decides why records are needed, who can see them and how long they must be kept. KinderByte provides and hosts the service as a processor acting on that provider's instructions. KinderByte may be a controller for limited service administration, security and support records where it decides how those records are used.

Children's personal information

Depending on the features used by the nursery, KinderByte may hold:

• Names, dates of birth, addresses, identifiers, emergency contacts and authorised collectors.
• Attendance, sessions, daily routines, meals, sleep, toileting, medication and wellbeing records.
• Health, allergy, dietary, disability, special educational needs and safeguarding information where needed for safe care.
• Learning observations, EYFS assessments, two-year checks, activities, achievements and transition records.
• Accident, incident, sickness, leave, behaviour and risk-assessment records.
• Funding, enrolment, contracts, permissions, invoices and payment-status information.
• Messages, feedback and other information supplied by parents, carers, staff or the child.

Staff, parent and carer information

We may process names, contact details, account credentials, roles and permissions, employment or training records, attendance, payroll-related records, signatures, communications, audit logs, device information and support requests. Parent and carer records may also include relationship to a child, collection permissions, bookings, invoices and payment references.

Photos, videos and documents

Nurseries may upload profile photos, learning-journal media, observations, accident or risk evidence, consent forms, contracts, identity or eligibility evidence, staff documents and reports. The nursery must have an appropriate lawful basis and permissions before uploading or sharing media. Access is controlled by user role, but users should not download, copy or share a child's media outside the purposes authorised by the nursery.

Push notifications and Expo tokens

If notifications are enabled, the app stores an Expo push token linked to the signed-in account, plus the device platform and last-seen time. The token identifies an app installation for notification delivery; it is not used for advertising. Notification requests pass through Expo and then Apple Push Notification Service or Google Firebase Cloud Messaging. A token is removed when the user signs out or unregisters the device, when Expo reports that the device is no longer registered, when the account is deleted, or when it is no longer needed.

Why information is used

Information is used to provide safe childcare and operate the service, including:

• Managing enrolment, attendance, rooms, sessions, authorised access and daily care.
• Supporting learning, development, SEND provision, safeguarding and statutory reporting.
• Communicating with families and staff, including service and push notifications.
• Managing fees, funding, contracts, payments and business records.
• Protecting accounts, investigating faults, maintaining audit trails and improving reliability.
• Providing optional AI-assisted features when enabled by the nursery, using only information required for the requested feature.

The nursery selects and documents the appropriate lawful basis, which may include contract, legal obligation, vital interests, public task or legitimate interests. Consent is used where the law or the nature of an optional activity requires it. Health, safeguarding and other special-category information also requires an additional lawful condition.

Hosting and third-party processors

KinderByte and the nursery limit sharing to organisations needed to run the selected features. These may include:

• Cloud hosting, database, backup, file-storage and content-delivery providers selected for the deployment.
• Expo, Apple and Google for mobile app builds and push-notification delivery.
• Email-delivery providers used for invitations, alerts, reports and password resets.
• Sentry or a comparable error-monitoring provider for service diagnostics, configured to avoid sending default personal information where possible.
• Payment providers, such as GoCardless, where the nursery enables online payments.
• AI providers configured by the nursery, such as Groq or Google, only when an AI-assisted feature is enabled and used.
• Professional advisers, regulators, safeguarding bodies, local authorities or law enforcement when disclosure is required or authorised by law.

A provider may process information outside the United Kingdom. Where this happens, the controller and KinderByte require an appropriate UK transfer mechanism and proportionate contractual and security safeguards.

Retention and deletion

The nursery sets retention periods according to childcare, safeguarding, employment, tax, funding, insurance and limitation requirements. KinderByte keeps active records for the duration of the service agreement and deletes or returns them on the nursery's documented instructions, subject to legal duties and secure backup cycles. Support and security logs are kept only as long as reasonably needed. Push tokens are kept only while needed to deliver notifications. Deletion from live systems may not remove an item immediately from encrypted backups, which are isolated and expire under the backup schedule.

Access, correction and deletion requests

Children and adults have data-protection rights. Depending on the circumstances, these include the right to:

• Receive clear information and a copy of personal information.
• Correct inaccurate or incomplete information.
• Ask for deletion or restriction of use.
• Object to certain processing and request data portability.
• Challenge a significant decision made solely by automated processing.
• Complain to the Information Commissioner's Office.

These rights are not absolute. A nursery may need to keep information for safeguarding, legal, regulatory or contractual reasons. It must explain any refusal or limitation. A child may exercise rights directly when they have sufficient understanding; a person with parental responsibility may also act where appropriate.

Withdrawing consent

Where processing relies on consent, the person who gave it may withdraw it at any time without disadvantage. Contact the nursery through its usual email, telephone or office channel and state which permission is being withdrawn, such as photos, optional sharing or push notifications. The nursery will verify identity, record the request and stop consent-based use as soon as reasonably possible. Withdrawal does not make earlier lawful use invalid and does not require deletion where another legal reason requires retention. Device notifications can also be disabled in device settings.

Security

KinderByte uses role-based access, authentication, audit records, encrypted network connections, backups, monitoring and operational controls designed to protect information. Nurseries remain responsible for authorised-user access, accurate permissions, staff training and promptly removing accounts that are no longer needed. No online service can guarantee absolute security.