Privacy Policy

Last updated: 13th July 2026

Introduction

Tortoise & Hare Childcare (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal data when you use our services, visit our website, or otherwise interact with us.

By engaging with Tortoise & Hare Childcare, you acknowledge that you have read and understood this Privacy Policy.

Data Controller

The data controller responsible for your personal data is:

Tortoise & Hare Childcare
Registered office: Pewley View, Guildford Park Road, Guildford, Surrey, GU2 7ND
Email: hello@tortoiseandharechild.care

Personal Data We Collect

We may collect and process the following categories of personal data:

a) Information you provide to us directly:
• Full name (parent/guardian and child)
• Contact details (address, email address, telephone numbers)
• Child’s date of birth and gender
• Emergency contact details
• Medical information relevant to the child’s care (e.g. allergies, dietary requirements, health conditions, GP details)
• Information relating to your child’s development, learning needs and preferences
• Payment and billing information
• Any other information you choose to provide when you communicate with us (by email, phone, in person or via forms on our website)

b) Information we collect automatically:
When you visit our website, we may automatically collect certain information, such as:
• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time and date of visit, and other usage statistics

c) Information from third parties:
In some cases, we may receive information about you or your child from third parties, such as:
• Previous childcare or educational settings (e.g. for transition reports, with your consent)
• Health or educational professionals (where necessary and with appropriate lawful basis)

Lawful Bases for Processing

We process your personal data under one or more of the following lawful bases, as set out in the UK General Data Protection Regulation (UK GDPR):

• Contract: to enter into or perform our childcare agreement with you.
• Legal obligation: to comply with applicable laws and statutory requirements, including those set by Ofsted and safeguarding legislation.
• Vital interests: to protect the vital interests of your child or another person, particularly in relation to health or safety.
• Legitimate interests: to manage and improve our services, maintain records, and operate our business in a responsible manner, where these interests are not overridden by your rights.
• Consent: where you have given explicit consent for specific uses of your or your child’s data (e.g. certain photos or marketing communications). You may withdraw your consent at any time.

How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide high-quality childcare and early years education services.
• To manage our relationship and communicate with you about your child’s progress, wellbeing, attendance and daily activities.
• To comply with legal, regulatory and safeguarding obligations, including those imposed by Ofsted and local authorities.
• To maintain accurate records for administrative, accounting and auditing purposes.
• To process payments, invoices and manage your account.
• To respond to enquiries, requests or complaints.
• To ensure the safety and security of children, parents/guardians, staff and visitors.
• To improve our website, services and communications.
• With your consent, to send you information about our services, events or updates that may be of interest to you.

Special Category Data

In the course of providing childcare, we may process special category data about your child, such as health and medical information, dietary requirements, and information relating to any additional needs.

We process this information where it is necessary for:
• Providing appropriate care and safeguarding;
• Complying with legal and regulatory obligations; or
• Protecting vital interests of your child or another person.
Where required, we will seek your explicit consent.

Children’s Data

We understand the particular importance of protecting children’s data. Personal data relating to children is collected solely for the purpose of providing childcare and education services, safeguarding and fulfilling our regulatory obligations. We do not use children’s personal data for marketing purposes.

Sharing Your Personal Data

We may share your personal data with:

• Regulatory bodies such as Ofsted and local authorities, where required by law or regulation.
• Health, education or other professionals involved in your child’s care or development, where necessary and appropriate.
• Our professional advisers (e.g. accountants, legal advisers) where necessary for our business operations and compliance.
• Service providers who support our operations (e.g. IT support, payment processors, secure digital storage), under contracts that require them to protect your data and use it only as instructed by us.
• Emergency services or other relevant authorities, if necessary to protect vital interests.

We do not sell your personal data to third parties.

International Transfers

We aim to store and process your personal data within the UK or the European Economic Area (EEA). If we need to transfer personal data outside the UK/EEA, we will ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, to protect your data in accordance with UK data protection law.

Data Security

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it from unauthorised access, loss, alteration or disclosure. These measures include:

• Secure physical storage of paper records.
• Restricted access to personal data on a need-to-know basis.
• Password-protected systems and devices.
• Regular review of our data protection practices.

While we strive to protect your personal data, no method of transmission or storage is completely secure. However, we take all reasonable steps to minimise risks.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting or reporting requirements.

In particular:
• Child records and related documentation are kept for the minimum periods required under childcare, safeguarding and education regulations.
• Financial records are kept for the period required by tax and financial legislation.
• Enquiry and correspondence data is retained for a reasonable period to manage any follow-up and to improve our services.

When personal data is no longer required, we will securely delete or anonymise it.

Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access – to request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification – to request correction of inaccurate or incomplete personal data.
• Right to erasure – in certain circumstances, to request deletion of your personal data.
• Right to restriction of processing – in certain circumstances, to request that we limit how we use your data.
• Right to data portability – in some cases, to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
• Right to object – to object to processing based on our legitimate interests or for direct marketing.
• Rights in relation to automated decision-making and profiling – we do not carry out automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, please contact us using the details in Section 2. We may need to verify your identity before responding to your request.

Cookies and Website Tracking

Our website may use cookies and similar technologies to enhance user experience, analyse website traffic and understand usage patterns. Cookies are small text files stored on your device.

You can manage or disable cookies through your browser settings; however, some website features may not function properly if you disable essential cookies.

Further details about our use of cookies (if applicable) may be set out in a separate Cookie Policy.

Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We recommend that you review the privacy policies of any third-party websites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation or our practices. Any updates will be posted on our website with an updated “Last updated” date. We encourage you to review this Privacy Policy periodically.

If you have any questions, concerns or requests regarding this Privacy Policy or our handling of your personal data, please contact:

Tortoise & Hare Childcare
Registered office: Pewley View, Guildford Park Road, Guildford, Surrey, GU2 7ND
Email: hello@tortoiseandharechild.care

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, if you are unhappy with how we have handled your personal data. Further information is available at www.ico.org.uk.