Privacy policy

My Ohana is committed to protecting and respecting your privacy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us: what we collect through this website and when you contact us, why we use it, who we share it with, how long we keep it and the rights you have. Please read it carefully to understand our views and practices regarding your personal data and how we will treat it.

It applies to parents and carers, children, people who apply to work with us, the businesses whose workplace crèches we run, and anyone else who gets in touch.

Who we are

"My Ohana" is a trading name of Tinies UK Limited, registered in England and Wales. Registered number: 2841130. VAT number: 641 8477 21. Registered office: Venture House, 2 Arlington Square, Downshire Way, Bracknell, RG12 1WA.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Tinies UK Limited. We are registered with the Information Commissioner's Office (ICO) under number Z4837316.

For anything about your data, email info@myohana.co.uk or get in touch and ask for our data protection lead.

What we collect

We only collect data to deliver services relevant to you. Through this website that means:

• Enquiries (Enquire now, Admissions & enquiries, and the Stay & Play forms): your name, email address and phone number; your child's name and date of birth or due date; the nursery, start month and days you are interested in; how you heard about us; your message; whether you are happy to hear from us by WhatsApp or SMS; and the page you were on.
• Tour, call and Stay & Play bookings, where we offer them online: the same details, the time you choose, the names of anyone joining you, and any notes. If you move or cancel a visit through the link we send you, we record the new time or your reason.
• Registration (enrolment): details of your child (name, date of birth, gender, nationality, languages spoken at home, dietary needs) and of each parent or carer (names, contact details, address, occupation and place of work, emergency contacts), the start date and days you want, and your typed signature. The form also asks about your child's allergies, health and medication, ethnicity and religion. These are special category data (see below) and the ethnicity and religion questions can be answered "prefer not to say".
• Payments: if you pay a registration fee online, Stripe takes the payment on its own page. We give Stripe the nursery, your child's name and your email address so the payment can be matched to your registration. We do not see or store your card number.
• Job applications ("Register your interest"): your name, email address and phone number, the kind of setting you are interested in, a link to a video CV if you give one, your message and your CV.
• Correspondence: a record of emails, calls and messages with us, including WhatsApp and SMS where you have asked for them.
• Finding a nursery: the town or postcode you type into the nursery finder, or, if you choose "use my location", your device's location. It is used only to show the nearest nurseries and journey times, and we do not keep it.
• Website use: your IP address, device and browser, the pages you visit and how you arrived. Optional analytics and advertising cookies are only set if you allow them; see our cookie policy.
• Our staff: nursery managers sign in to our enquiry system with their work email address, and a short-lived cookie keeps them signed in. Staff who edit this website have an account with Sanity, our content system.

We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.

Once your child joins a nursery we collect much more, such as care records, observations, attendance and health forms. That is explained when you register and in our parent policy. Without that information we will not be able to provide childcare.

Special category data about children

Information about a child's health, allergies, medication, ethnicity and religion is special category data under the UK GDPR, so it has extra protection. The registration form asks for it, and once your child starts we hold it in our childcare management system, Famly.

• Health, allergies and medication: we need these to keep your child safe and to meet our legal duties under the Early Years Foundation Stage (EYFS). We rely on the UK GDPR conditions for employment and social protection obligations and for substantial public interest (safeguarding of children), with the matching conditions in Schedule 1 of the Data Protection Act 2018.
• Ethnicity and religion: we use these to meet your child's cultural, dietary and religious needs and for statutory returns to local authorities. We rely on your explicit consent, which you give on the registration form. You can decline, or withdraw consent later, without affecting your child's place.

Why we use it and our lawful basis

• Answering enquiries, arranging tours and taking your child's registration: steps you have asked us to take before a contract (UK GDPR Article 6(1)(b)).
• Providing childcare, taking fees and keeping records: performing our contract with you (Article 6(1)(b)) and meeting our legal obligations, including EYFS, Ofsted, funding and tax rules (Article 6(1)(c)).
• Safeguarding: legal obligation (Article 6(1)(c)) and, for special category data, the conditions above.
• Considering job applications: steps you have asked us to take before a contract (Article 6(1)(b)) and our legitimate interest in recruiting the right people (Article 6(1)(f)).
• Following up an enquiry you have made, telling you about open days and places at the nursery you asked about, and improving our service: our legitimate interests (Article 6(1)(f)). You can ask us to stop at any time.
• Messages by WhatsApp or SMS: your consent, given by ticking the box on the form, which is never pre-ticked (Article 6(1)(a)). We only message you about your enquiry, on the number you gave, and you can tell us to stop at any time.
• Analytics and advertising cookies: your consent (Article 6(1)(a)), which you can withdraw at any time through "Manage cookies".

We do not make decisions about you using only automated means.

Who we share it with

We would not provide or sell your data to any third party. We share it only with the service providers below, who act on our instructions under a contract, and with others where the law requires it.

• Vercel: hosts this website and handles every page request and form submission. The website itself keeps no database of what you send us; each submission is passed straight to the system that needs it.
• Hiive (built on the HighLevel platform): our enquiry and registration system. Enquiries, bookings and registrations are recorded here, including the answers you give on the registration form.
• Resend: delivers email for us. Where a nursery does not yet use Hiive, your enquiry is emailed to that nursery. Job applications, with the CV attached, are emailed to our people team, and sign-in links are emailed to our staff.
• Stripe: takes registration fee payments.
• Famly: our childcare management system for enrolled children (records, parent communication and billing).
• Microsoft (SharePoint and 365): our email and document storage.
• Sanity: holds the website's content and the accounts of staff who edit it. Nothing you submit through a form is stored there.
• Mapbox: shows the maps, looks up addresses on the registration form and works out journey times. If you choose "use my location", your location is sent to Mapbox for that purpose only. Postcodes.io: looks up the postcode or town you type into the nursery finder.
• Google (Analytics, Tag Manager and Ads) and Meta (Facebook and Instagram): only if you allow optional cookies. LightWidget: shows our Instagram feed, only if you allow marketing cookies.
• daynurseries.co.uk: shows families' reviews of our nurseries on our pages. YouTube and Vimeo: play the videos on the site; we use YouTube's privacy-enhanced mode and ask Vimeo not to track you.

We also share information with Ofsted, local authorities (for funded places and safeguarding), HMRC (for Tax-Free Childcare), the police or courts where we are legally required to, and professional advisers such as our lawyers and insurers.

Transfers outside the UK

Several of these providers are based in, or use staff and data centres in, the United States or the European Economic Area. Where your data leaves the UK, it is protected by UK adequacy regulations (for the EEA), the UK Extension to the EU-US Data Privacy Framework (for certified US companies), or the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses. Contact us for details of the safeguard for a particular provider.

How long we keep it

We only retain data for as long as necessary to fulfil the purposes we collected it for, and to meet legal, accounting, safeguarding and reporting requirements. Our data retention register details each piece of data we hold, the duration and the purpose, and you can ask to see it. Our retention periods become active when you are no longer engaged in services with us.

For example: enquiries that do not lead to a place are kept for a limited time so we can respond if you come back to us; a CV is attached to one email to our people team and is not kept by the website; records about a child's care are kept for the periods the law and regulators require. Where there is a safeguarding concern or allegation we are legally obliged to keep the records, which can mean indefinitely.

How we protect it

Once we have received your information, we will use strict procedures to prevent unauthorised access. We use multi-factor authentication and encryption to prevent unpermitted access to personal data, and our Microsoft SharePoint system includes threat detection, phishing and social engineering mitigation. Access is limited to staff who need it. We may also store manual copies of your personal information in a secure facility where access is restricted.

The links in the emails and messages we send you (to book or move a visit, to tell us what you would like to do next, or to register) open your own enquiry without a password, and they stay valid until your enquiry is closed. Please keep them to yourself and do not forward them.

If you provide us with information via our website, you acknowledge that the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

Your rights

As an individual you have rights and can determine how your data is used. You have the right to:

• be informed: how we collect, store and process your data (this policy);
• access: a copy of the data we hold about you, and what it is used for;
• correction: to have incorrect or incomplete data corrected;
• erasure: to have personal data deleted, where we have no legal reason to keep it;
• restriction of processing: to block or suppress personal data being used;
• data portability: to receive your data in a portable format, or have it sent to another organisation;
• object: to us using your data for our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on it;
• not be subject to automated decision-making: to have a person involved rather than a decision made solely by algorithm.

Parents and carers usually exercise these rights on behalf of young children. We will respond within one month. You can ask for erasure at any time; please note that if you do, we may no longer be able to provide childcare, and we cannot delete records we are legally required to keep, including safeguarding records.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right: our concerns and complaints page explains who to speak to. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Cookies

How we use cookies, and how to change your choice, is explained in our cookie policy.

Other websites

Our site links to other websites, including our job adverts hosted by Dayforce and our providers' own pages. Their privacy policies apply when you use them.

Third-party privacy policies

Some information is processed by our childcare management software provider, Famly. You can read more about how Famly handles data in their privacy policy, including Section 7.

Changes to this policy

We review this policy at least once a year and whenever we change how we handle personal data. The date at the top shows when it was last updated. Any changes we make will be posted on this page and, where appropriate, notified to you by e-mail.