Privacy Policy | Mistley Kids Club

1. Introduction

Mistley Kids Club Ltd ("we", "us", or "our") is a registered non-profit charity (Charity Number 1140273) providing after-school and holiday childcare services. Under data protection legislation, we act as the "Data Controller" for the personal data of guardians, parents, emergency contacts, and children registered at our club.

By registering your child, enrolling in our Welcome Pack wizard, or using our online booking portals, you acknowledge the collection and processing of personal information as described in this policy.

2. Data We Collect

To provide safe and compliant childcare, we must collect detailed personal records. This data includes:

Guardian & Parent Profiles: Full name, relationship to child, email address, phone number, residential address, emergency contact profiles, and authorized pickup lists.
Child Profiles: Full name, date of birth, preferred care programs, daily attendance records, and child portrait photos (subject to parent consent).
Sensitive Health & Medical Records: Special Educational Needs (SEN) details, allergies, dietary constraints, routine/emergency medication logs, and medical practitioner contact details.
Financial & Billing Data: Booking records, invoices generated, bank transfer reference logs, and childcare voucher provider details.
System Context Data: Consent timestamp, IP addresses, browser user-agent data, and policy agreement versions submitted during parent registration.

3. How We Use Your Data

We process personal information under the following legal bases of the GDPR:

Data Category	Legal Basis	Purpose & Application
Guardian Contacts & Profiles	Performance of Contract	To manage booking requests, dispatch account billing invoices, and coordinate emergency pick-ups.
Medical Logs & Child Food Allergies	Vital Interests / Legal Obligation	To administer necessary medication, enforce dietary safety, and protect children from medical emergencies.
Ofsted Safeguarding Witnesses	Public Task / Legal Obligation	To maintain childcare registries and medication counters for Ofsted standards and regulatory audits.
Photo Gallery Consents	Explicit Consent	To display children participating in sensory events and club activities on public website banners.

4. Data Sharing & Retention

Data Sharing: We respect your privacy and never sell or rent personal information. We only share details with third parties when legally required or operationally essential:

Regulatory Authorities: Ofsted inspectors during regulatory compliance audits.
Medical Practitioners: NHS emergency responders if a child falls ill under our supervision.
Database Infrastructure: Supabase (our secure database host) to save, store, and backup encrypted profile tables.

Data Retention: We store records for no longer than is necessary to satisfy legal obligations. Safeguarding and attendance logs are retained in accordance with UK statutory regulations for childcare providers, which typically require records to be stored for up to 3 years from the date of the last entry.

5. Security Measures

We implement comprehensive technical and organizational safeguards to secure your personal records:

All database communication is encrypted in transit using SSL/TLS protocols and at rest within Supabase hosting centers.
Strict Row Level Security (RLS) is active on database tables, preventing parents from querying records outside their family boundary.
Staff dashboard accounts require authentication credentials, with access restricted strictly based on approved playworker roles.

6. Your GDPR Rights

Under the General Data Protection Regulation, parents and guardians possess specific rights regarding their personal data:

Right of Access (SAR): You have the right to request a complete copy of the personal files we store for your family.
Right to Rectification: You can request to correct inaccurate contact details or update child medical files at any time via the parent portal.
Right to Erasure ("Right to be Forgotten"): You can request that we delete or anonymize your family profile, subject to statutory retention overrides for Ofsted records.
Right to Restrict Processing: You have the right to object to specific data uses, such as withdraw consent for website photo displays.

7. Policy Updates

We may revise this Privacy Policy periodically to reflect changes in regulatory childcare standards or application technologies. When updates occur, we will adjust the "Last Updated" timestamp at the top of this page. We encourage you to review this policy occasionally.

8. Contact Information

If you have any questions about this Privacy Policy, wish to file a Subject Access Request (SAR), or want to report an issue, please contact our Data Protection Officer:

Email: mistleykidsclub@live.co.uk
Phone: 07809 176252
Address: Mistley Kids Club Ltd, Mistley Village Hall, Shrublands Road, Mistley, Manningtree, Essex, CO11 1HS.