Family privacy notice

Jumping Jacks WACC LTD (company number 12773546), trading as Jumping Jacks Childcare, is the data controller for child and family records and the setting’s CCTV. Our address is The Studio, High Street, Limpsfield, Oxted, Surrey RH8 0DR. Charmaine Johnson, owner, is your privacy contact: jumpingjackswacc@gmail.com or 07932 466643. This notice covers preschool, wraparound and holiday care, school transport, enquiries, family accounts and visitors recorded by CCTV. Staff and recruitment records have separate arrangements.

We receive information from parents and carers, children, authorised collectors, schools, previous settings, health and support professionals, Surrey and safeguarding agencies where relevant. This includes names, dates of birth, addresses, contact and emergency details, parental responsibility and collection arrangements; bookings, attendance, funding eligibility and declarations; learning and development, dietary needs, allergies, health, medication and additional needs; accident and safeguarding records; invoices, payment references, messages, permissions and reading confirmations.

App use also produces sign-in, device, notification-subscription, security and activity records. CCTV captures images and movements within its coverage. Please tell emergency contacts and other adults whose details you provide about this notice. We do not ask for information unrelated to providing our service.

Enquiries, agreed bookings, accounts and invoices: we use information to take requested steps before a parent contract and to perform that contract. We also have legitimate interests in administering the service, keeping accurate records, communicating with families, planning places and transport, preventing misuse and resolving queries. For children’s information, we consider their interests and use legal obligations or these assessed legitimate interests as appropriate, rather than treating the parent’s contract as the child’s contract.

Care, attendance, welfare, required records, safeguarding and regulatory reporting: we use information to meet applicable childcare, safeguarding and other legal duties. Funding information is used to establish and administer eligibility and comply with the applicable funding arrangements once confirmed. Accounts and tax records support our legal accounting obligations. In a genuine emergency we may use information to protect life.

Health, disability and other particularly sensitive information receives additional protection. For routine information you choose to provide for an individual care or support arrangement, we seek a separate explicit agreement to its use where explicit consent is the appropriate condition. For necessary safeguarding use, we rely on the substantial-public-interest condition for safeguarding children where its legal requirements are met; emergency or legal-claim conditions may also apply in their limited circumstances. A contract or policy-reading tick alone does not authorise sensitive-data processing.

Optional publicity photographs and other optional uses requiring consent have their own choices. You may refuse or withdraw those choices without losing an otherwise available childcare place. Withdrawal does not undo earlier lawful use or prevent retention required for another lawful purpose. Necessary care information may be needed to provide safe care; if you are worried about providing it or withdraw a relevant agreement, speak to Charmaine so we can discuss a safe arrangement.

Access within Jumping Jacks depends on duties: staff receive the care and collection information they need; safeguarding and confidential records are restricted to authorised leads. We share necessary information with authorised collectors and relevant schools, receiving settings, health or support professionals, Surrey, Ofsted, police and safeguarding services where lawful and necessary. Consent is sought where it is the appropriate basis; it is not a requirement for every safeguarding disclosure.

Our service providers include Supabase for app accounts, database and file services, Netlify for website hosting, and the device/browser push services used when you enable notifications. Hik-Connect supports authorised remote CCTV access. Email, messaging, accounting and payment services receive information relevant to the service you use; where an online Stripe checkout is offered, Stripe processes the payment information under its own privacy information. The family app does not store full payment-card numbers. We do not sell family information.

The app’s primary Supabase database is hosted in London (eu-west-2). This does not mean every support, security, delivery or communications operation stays in the UK. Supabase, Netlify, notification services and Hik-Connect operate international services. Hik-Connect remote access may involve service data and transmission outside the UK even though recordings are held on our DVR.

Providers publish their processing and transfer terms. Relevant protections include adequacy arrangements where applicable and contractual safeguards such as Standard Contractual Clauses with the UK Addendum where required. Supabase’s published processing agreement includes a UK Addendum; Hik-Connect’s privacy information describes international processing and contractual transfer safeguards. Ask Charmaine for the relevant provider information or copies of applicable safeguards. We do not describe the service as UK-only storage and processing.

CCTV: routine recordings are kept for 30 days on the setting’s DVR. Relevant footage may be preserved longer for an identified incident, safeguarding concern, access request or legal matter, with the reason and continued need reviewed.

Registers: we retain each session’s register for three calendar years from that session’s date.

Child accident records: we retain these until the child’s 21st birthday. Linked acknowledgement and audit evidence is retained with the relevant record.

Child safeguarding incident and concern records: we retain these until the child’s 25th birthday. Safeguarding records are managed separately and are not erased when a login account is closed. Allegations about staff and other record categories follow their own schedules.

These are Jumping Jacks’ ordinary retention periods for the stated categories. A specific safeguarding, inquiry, legal, insurance or other documented preservation requirement may require relevant records to be kept longer. We review and document that requirement. If a required date is missing or unverified, we review the record rather than guessing a disposal date. Reaching a retention date prompts disposal review; it does not automatically delete a record.

Other family, booking, permission, medication, care and learning records: we keep records while providing care, then retain only what is needed for applicable childcare duties, funding audits, unresolved complaints, insurance or legal claims. Learning records are shared or transferred appropriately when a child moves on. Financial records follow applicable accounting and tax requirements. Routine enquiries, messages and device records are reviewed for continuing service, security or dispute needs; necessary messages may form part of a child’s care or safeguarding record.

Closing an account or withdrawing consent does not immediately erase records that have another lawful retention purpose or another carer’s account. Records no longer needed are securely deleted, anonymised or transferred as appropriate. Removal from the live app does not necessarily remove a copy immediately from a provider’s backup cycle. You can ask Charmaine for the retention decision applying to a particular record.

CCTV supports safeguarding, incident review, premises security and prevention or investigation of crime. These are our legitimate interests, balanced against the privacy of children, families, staff and visitors. It does not replace staff supervision or provide a parent webcam service. It is not used for facial recognition or routine automated assessment of children.

Cameras cover the setting’s rooms except toilets. Nappy changing is outside their view and no audio is recorded. Recordings are stored only on the DVR, not in cloud recording storage. Hik-Connect provides remote access. Only Charmaine Johnson has playback access. Relevant extracts may be lawfully disclosed to police, safeguarding or regulatory authorities, insurers or legal advisers, or to fulfil an individual’s access rights while protecting other people.

Contact Charmaine promptly if you need footage preserved, giving the approximate date, time and location. We assess requests on behalf of a child in their interests, check authority and protect other people’s information. Access is normally free; any exceptional charge or refusal must meet the legal criteria. A parent does not automatically receive an unredacted recording of other children.

You can ask for access, correction, erasure, restriction or, where applicable, a portable copy of your information. You can object to processing based on legitimate interests and withdraw consent for processing that relies on it. Rights have legal limits: for example, we may need to retain records for safeguarding, a legal duty or a claim. We explain the reason if we cannot meet a request.

Rights over a child’s information belong to the child. We consider a parent’s authority, the child’s understanding and best interests, safeguarding and other people’s rights. We normally respond within one month, subject to lawful identity checks, clarifications and extensions. Contact Charmaine using the details above; you do not have to use a special form.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113. You may contact the ICO without first completing our complaints process.

Push notifications are optional and can be switched off through your device settings. The app uses sign-in/session and local device storage needed to keep you signed in and operate the service; removing these may sign you out. Please keep shared devices secure. Essential account or safety messages may still be available in your account when push notifications are off.

The app assists with capacity, bookings, routes and administrative checks; a parent can ask Charmaine to review an outcome. We do not use solely automated decisions with legal or similarly significant effects about children or families. New optional uses of information will be explained separately. This notice is dated 29 October 2026 and will be updated when our practices or requirements change. Reading it is not blanket consent to all processing.