Privacy Policy
Last updated: April 2026
1. Who We Are
Pop Up Care Clubs ("we", "us", "our") operates two childcare settings:
Wellingborough Nursery — 178 Finedon Road, Wellingborough, NN8 4AH
Irchester Nursery — Irchester Village Hall, NN29 7AW
We are the data controller for the personal information you provide to us, meaning we are responsible for deciding how and why your data is used and for keeping it safe. We are registered with the Information Commissioner's Office (ICO). You can verify our registration at ico.org.uk.
2. Information We Collect
About parents and carers:
Full name, home address, telephone numbers, and email address
Emergency contact details
Employer details (where relevant to childcare funding claims)
Payment and funding information (e.g. 15/30 hours free entitlement eligibility)
Information shared during enquiries, showaround bookings, or contact form submissions
About children in our care:
Full name, date of birth, address, and nationality
Medical information including allergies, conditions, medications, and immunisation records
Dietary requirements and food preferences
Special educational needs or disability (SEND) information
Development records, learning journals, and progress observations
Photographs and videos taken as part of our educational documentation
Incident, accident, or safeguarding records where applicable
Website and enquiries:
Information submitted via our contact or enquiry forms
Technical data including IP address, browser type, and browsing behaviour via cookies
3. How We Use Your Information
We use your personal information to:
Plan and deliver your child's daily care and learning
Manage health, safety, dietary, and medical needs
Fulfil our safeguarding duties and protect children from harm
Process registrations, invoices, payments, and government funding claims
Communicate with you about your child's progress, settling in, and nursery updates
Meet our obligations under the EYFS statutory framework and Ofsted requirements
Share photographs or videos on our website or social media where you have given consent
4. Legal Basis for Processing
Under UK GDPR, we rely on the following lawful bases:
Contract — to fulfil our agreement with you as a childcare provider
Legal obligation — where required by law, including safeguarding legislation, Ofsted regulations, and the EYFS framework
Legitimate interests — for administrative and operational purposes necessary to run our nurseries, where these do not override your rights
Consent — where you have given explicit permission, such as for use of photographs in marketing or social media
Vital interests — in emergencies where sharing information is necessary to protect a child's life or wellbeing
For special category data (such as health, medical, or SEND information), we rely on processing being necessary for the provision of care, or substantial public interest in the context of safeguarding.
5. Children's Data
We treat children's personal information with the highest level of care. It is only accessible to authorised staff who require it to carry out their duties.
Where we take photographs or videos of children — whether for learning journals, displays, or promotional use — we will always obtain written consent from a parent or legal guardian beforehand. You may withdraw this consent at any time by contacting us directly.
We will never share identifiable images or personal information about children on public platforms without explicit parental consent.
6. Sharing Your Information
We do not sell your personal data. We may share information with:
The local authority — to process funded childcare hours (15/30 hours free entitlement)
Ofsted — during inspections or regulatory enquiries
Healthcare professionals — such as health visitors, GPs, or SEND specialists, where this is in your child's best interests
Safeguarding authorities — including children's services or the police, where we have a legal duty to do so to protect a child. Consent is not required in these situations.
IT and software providers — who support our nursery administration and act as data processors under our instruction, bound by data processing agreements
All third parties are required to keep your data confidential and use it only for the purposes we specify.
7. How Long We Keep Your Data
Type of Record
Retention Period
Child's registration and care records
Until the child's 25th birthday (26th if SEND applies)
Accident and incident records
Until the child's 21st birthday
Safeguarding records
Minimum 25 years, as directed by local authority guidance
Financial records (invoices, payments)
7 years (HMRC requirement)
Staff records
6 years after employment ends
Enquiry / contact form submissions
12 months from enquiry date
Consent-based marketing data
Until consent is withdrawn
After these periods, data is securely deleted or anonymised.
8. Your Rights
Under UK GDPR, you have the right to:
Access — request a copy of the personal data we hold about you or your child
Rectification — ask us to correct inaccurate or incomplete information
Erasure — request deletion of your data where there is no longer a lawful reason for us to hold it
Restriction — ask us to pause processing your data while a concern is resolved
Portability — receive your data in a structured, commonly used format where applicable
Object — object to processing based on legitimate interests, including for direct marketing
Withdraw consent — where processing is based on consent, you may withdraw at any time without penalty
Automated decisions — we do not use automated decision-making or profiling that significantly affects you
To exercise any of these rights, please contact us using the details in Section 13. We will respond within one calendar month and may ask you to verify your identity before fulfilling your request.
9. Cookies
Our website (popupcareclubs.co.uk) uses cookies — small text files placed on your device — to help the site function and to understand how visitors use it. We use:
Strictly necessary cookies — essential for the website to operate; these cannot be disabled
Analytics cookies — to understand how visitors navigate our site; only placed with your consent
Functional cookies — to remember your preferences and improve your experience
You can control or delete cookies at any time through your browser settings. Please see our separate Cookie Policy for full details.
10. Data Security
We take appropriate technical and organisational measures to protect your personal information, including:
Restricting access to authorised staff only, on a need-to-know basis
Password-protected systems and secure digital storage
Locked storage for any paper-based records
Regular staff training on data protection and confidentiality
Secure disposal of records that are no longer needed
In the event of a data breach that poses a risk to individuals, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
11. Third-Party Links
Our website may contain links to external sites such as government funding portals. We are not responsible for the privacy practices of those sites and recommend you read their own privacy notices.
12. Changes to This Policy
We review this Privacy Policy periodically and update it to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last revised. Where changes are significant, we will notify you directly by email or by notice at our nurseries.
13. Contact and Complaints
If you have questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us:
Wellingborough: popupdaynursery@outlook.com Irchester: popupirchester@gmail.com Post: 178 Finedon Road, Wellingborough, NN8 4AH
If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection authority:
Information Commissioner's Office (ICO) Website: ico.org.uk | Helpline: 0303 123 1113
We would always welcome the opportunity to resolve your concerns directly before you contact the ICO.