Data Processing Agreement

1. Roles

When we host and operate your nursery's website on your behalf, you are the controller of personal data submitted via the site (including parent and staff data) and we are the processor.

We will only process that data on your documented instructions and as set out in this agreement.

2. Sub-processors

A current list of approved sub-processors (hosting, email, file storage) is available on request. We will give you reasonable notice of any new sub-processor and the right to object.

3. Security

We maintain appropriate technical and organisational measures including encryption in transit (TLS 1.2+), least-privilege IAM, daily backups (30-day retention), file scanning and routine penetration testing.

4. International transfers

Personal data is stored in the UK or EU. Any international transfers are made under the UK International Data Transfer Agreement or equivalent safeguards.