Privacy Policy

1. About this notice

This sample explains the kinds of information a childcare and activity centre may need to describe in a privacy notice. It covers website enquiries and potential enrolment records. The final notice must name the legal business responsible for personal information and give verified privacy contact details.

2. Information you provide

The website enquiry form asks for a parent’s name, child’s name and age, email address, and an optional message. Please avoid including medical records or other sensitive information in an initial enquiry.

If enrolment goes ahead, the centre may need additional information such as emergency contacts, authorised collectors, and relevant care needs. The business must confirm these categories and explain them before collecting information.

3. How website enquiries work

The current form prepares an email draft in your email app. Selecting “Send Request” does not send a message to the centre. You must open the draft, review it, and send it yourself. Once sent, the message is handled by the email services used by you and the recipient.

4. Why information may be used

Example purposes include answering questions, discussing suitable sessions, arranging visits, managing registration, and supporting a child’s care. Information should be limited to what is needed for each purpose.

The final notice must identify the applicable lawful basis for each use. If health information or other special category data is needed, it must also explain the relevant additional condition. These details are not confirmed by this demo.

5. Sharing and service providers

The final notice should identify who receives information, including relevant email, hosting, administration, or care providers. It should explain any disclosures required for safeguarding or legal obligations, and any transfers outside the UK and the safeguards used. No provider list or transfer arrangements have been confirmed for this draft.

6. Keeping information

Retention periods must reflect the purpose of each record and any applicable requirements. Before adopting this policy, the business must confirm how long enquiry messages, enrolment records, and care records are kept, how access is controlled, and how records are deleted or disposed of. This draft does not set a retention period or promise a particular security standard.

7. Cookies and website data

Hosting and other services may process technical information such as IP addresses and request logs. The operator must confirm the services in use and audit cookies or similar technologies before publishing a final notice. This demo does not state that the site is cookie-free or that analytics or advertising tools are in use.

8. Your information rights

Depending on the circumstances, data protection rights can include access, correction, erasure, restriction, objection, and portability. Where processing relies on consent, you can withdraw it. Some rights have exceptions; the final notice should explain how to make a request and identify the business’s verified contact.

You can read about these rights and complaint options from the Information Commissioner’s Office. A final privacy notice should provide the information described in the ICO’s right to be informed guidance.

9. Contact and updates

For questions, use the contact section after checking that its business details have been confirmed. This draft must be updated when the business’s actual practices are established. It is not a substitute for the final notice provided to families.