Privacy Policy

1. Introduction

Trolltec Ltd, trading as SmartNursery ("we", "us", "our"), is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our nursery management software and services ("Service").

We are registered as a Data Controller with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller and Data Processor Roles

When you use our Service:

• We act as Data Controller for data relating to your account, billing, and use of the Service (e.g., your contact details, payment information, login records).
• We act as Data Processor for data you input into the Service about children, parents, and staff at your nursery. You remain the Data Controller for this data and are responsible for ensuring you have appropriate legal basis and consent for processing.

3. Data We Collect

3.1 Account and Billing Data (We are Data Controller)

• Name, email address, phone number
• Business name and address
• Payment and billing information
• Login credentials and access logs
• Support communications

3.2 Nursery Data (We are Data Processor)

Data you enter into the Service may include:

• Child records: Names, dates of birth, photographs, medical information, dietary requirements, development records, attendance records
• Parent/guardian records: Names, contact details, emergency contacts, relationships to children
• Staff records: Names, contact details, qualifications, DBS information, training records, timesheets
• Financial records: Invoices, payments, funded hours claims

This data may include special category data (e.g., health information). You are responsible for ensuring appropriate safeguards are in place for such data.

4. How We Use Data

4.1 Account and Billing Data

Purpose	Legal Basis
Providing and managing the Service	Contract performance
Processing payments	Contract performance
Sending service communications	Contract performance / Legitimate interest
Customer support	Contract performance
Improving the Service	Legitimate interest
Legal compliance	Legal obligation

4.2 Nursery Data

We process nursery data solely on your behalf and according to your instructions for the purpose of providing the Service. We do not use this data for any other purpose.

5. Data Sharing

We do not sell personal data. We may share data with:

• Service providers: Hosting providers, payment processors, and support tools that help us deliver the Service. These providers are contractually bound to protect data and use it only for specified purposes.
• Legal requirements: Where required by law, regulation, or legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate data protection safeguards.

All data is stored within the United Kingdom. We do not transfer data outside the UK without appropriate safeguards.

6. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure data centres within the United Kingdom
• Access controls and authentication
• Regular security assessments
• Daily backups with secure storage
• Staff training on data protection

7. Data Retention

Account data: We retain account data for the duration of your subscription plus 7 years for legal and accounting purposes.

Nursery data: We retain your nursery data for the duration of your subscription. Upon termination, we will provide a reasonable period (typically 30 days) to export your data, after which it will be securely deleted.

Backup copies may be retained for up to 90 days following deletion for disaster recovery purposes.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data in certain circumstances
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Request your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests

To exercise these rights, please contact us at privacy@smartnursery.co.uk.

For nursery data (where we act as Data Processor), requests from data subjects should be directed to you as the Data Controller. We will assist you in responding to such requests.

9. Cookies

The SmartNursery application uses essential cookies necessary for the Service to function (e.g., session management, authentication). We do not use cookies for advertising or tracking purposes.

10. Children's Data

The Service is designed to help nurseries manage records for children in their care. We do not knowingly collect personal data directly from children. All children's data is provided by the nursery (our customer) who is responsible for ensuring appropriate consent and legal basis for processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Complaints

If you have concerns about how we handle your data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
www.ico.org.uk

13. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us:

Trolltec Ltd T/A SmartNursery
Green Acres Aston Lane
Aston Flamville
Hinckley LE10 3AA
Email: privacy@smartnursery.co.uk