Privacy policy
What this website collects, why, and what happens to it. This is a working draft and has not been checked by a solicitor yet.
This website asks you for very little, and this page says exactly what happens to the little it asks for. It is written for parents rather than lawyers.
1.The short version
The rest of this page is the detail. If you only read one section, read this one.
- The only thing this website asks you for is the waiting list form on the contact page.
- That form does not ask for your child's name, and it asks for a year of birth rather than a date of birth.
- Enquiries can be read by our own staff after they sign in. Nobody else can read them, including anyone else who fills in the form.
- There is no analytics on these pages, no advertising tags and no tracking cookies. There is no cookie banner because there is nothing to agree to.
- Photographs published here have their hidden location data removed before they are saved.
- We do not sell your information and we do not pass it to anyone outside the business.
- You can ask to see what we hold, ask us to correct it, or ask us to delete it.
2.Who is responsible for your information
Newtown Kids Club is the data controller for this website. A controller is the organisation that decides what gets collected and what happens to it afterwards. That means the questions on this page are ours to answer.
- Trading name
- Newtown Kids Club.
- Registered business
- [VERIFY] The registered entity has not been confirmed. The name "Newtown Kids' Club Ltd" appears in published academic work, and no Companies Registration Office number has been found for it. Before this page goes live, confirm either the exact registered company name and CRO number, or that the business trades as a sole trader, and name the person.
- Address
- Newtown, Abbeyknockmoy, Tuam, Co. Galway. [VERIFY the Eircode. None has been confirmed for the site.]
- Tusla registration
- TU2015GY198 for The Nursery and TU2015GY199 for The Willows. Both services are on the Tusla Early Years Register.
- Email for data questions
- [VERIFY] No email address has been created for the setting yet. One is needed before this page can be published, because a privacy policy has to give people a working way to reach the controller.
- Phone
- [VERIFY] Two numbers appear on the Tusla register, one against each service, and it has not been decided which is the one for parents to ring.
- Data Protection Officer
- [VERIFY] We have not appointed one, and no claim about whether one is required is made here. A solicitor or the Data Protection Commission guidance should confirm the position for a setting of this size, and this line should then say plainly either who the officer is or that none is required.
3.What this policy covers
This policy is about the website you are reading. It covers the waiting list form, the staff sign-in, and the photographs and profiles published on these pages.
It does not cover the records the creche and preschool keep about children who actually attend. Enrolment forms, medical and dietary details, accident records, attendance and the rest are held by the setting under the early years rules, not by this website.
[VERIFY whether the setting has its own written data protection policy for those records. If it does, link it from here. If it does not, one is needed, and it is a larger job than this page.]
4.The waiting list form
The form on the contact page is the only place this website asks you for anything.
What it asks for
- Your name
- Required, so we know who we are replying to.
- Your email address
- Required, so we can reply.
- Your phone number
- Optional. Only so that we can ring you instead of typing, if that is easier.
- Which setting you are asking about
- The Nursery, The Willows, the After-School Club, or not sure yet. It tells us which list you belong on.
- Your child's year of birth
- Optional, and a year only, four digits. A year is enough to work out which age group a child falls into.
- Your message
- Optional. Anything you want to tell us or ask us.
What it deliberately does not ask for
There is no box for your child's name, and we ask for a year of birth rather than a full date of birth. An enquiry does not need to identify a child, and collecting less is the only reliable way to hold less.
Why we are allowed to hold it
Our view is that this is Article 6(1)(b) of GDPR, which allows an organisation to use your details for steps taken at your request before entering into a contract. You are asking us about a place, and we cannot answer without a way to reach you.
[VERIFY the lawful basis with a solicitor. The alternative is consent, under Article 6(1)(a). The choice matters, because consent has to be freely given and can be withdrawn at any moment, and that changes both what the form has to say and what has to happen when someone changes their mind.]
The message box and sensitive information
The message box is free text, so anything can be typed into it. Some parents will mention a diagnosis, a health condition or an additional need. GDPR calls that special category data and holds it to a higher standard than a name and an email address.
We do not ask for it, and you do not need to send it to get on the list. If you do send it, it sits inside the enquiry with everything else until somebody reads it.
[VERIFY what happens to an enquiry that contains health information: whether it is deleted from the website database once it has been read and moved into the setting records, who is allowed to see it in the meantime, and how that is recorded. This needs deciding before the page goes live.]
5.Information about children and families
An enquiry is about a child even when it never names one. It tells us that a family exists, roughly how old a child is, and sometimes a good deal more in the message box. We treat it as information about a family, because that is what it is.
The form is for parents and guardians. This website is not aimed at children, and we do not knowingly collect anything directly from a child through it.
Please only send us your own details and details about your own child. If you are enquiring on behalf of another family, tell us in the message so we know.
[VERIFY] Article 8 of GDPR sets extra rules for online services offered directly to children. Our reading is that it does not apply here, because an adult fills in this form about a child rather than a child using a service. Have that confirmed rather than assumed.
6.Photographs
The photographs on this website include children in our care. Parents ask about this more than anything else, so here is exactly where it stands.
Location data is removed
A photograph taken on a phone usually carries the exact spot it was taken at, written invisibly into the file. When a photograph is uploaded to this website that information is stripped out before the picture is saved. The coordinates never reach the published file.
Consent
Photographs of children need a parent or guardian to agree to them being published. This paragraph should state exactly what has been agreed and how, and it cannot be written from the website alone.
[VERIFY the consent position and write it here in plain words. Nothing about it can be assumed. The open questions: is written parental consent taken for photographs, at enrolment or separately; does it name this website as well as Facebook and printed material; is it recorded per child and kept up to date; can a parent agree to one and refuse another; and what happens when a child leaves. Until that is written down, every photograph already on the site should be checked against whatever consent exists.]
Asking for a photograph to be taken down
If your child appears in a photograph here and you would rather they did not, tell us and we will take it down. You do not have to give a reason and it will not be awkward.
[VERIFY the contact route for this and how quickly you are willing to commit to removing a photograph. A stated timeframe is better than a vague promise.]
7.Staff information
Two separate things happen here and they are worth keeping apart.
- Signing in
- Staff who write for the site sign in with their email address. There is no password. We email a one-time link and clicking it signs the person in. We hold the email address, a display name and the date the account was created.
- Profiles published on the site
- The team page publishes a name, a job title, qualifications, a short biography and a photograph for each educator. That is published on purpose, so that parents can see who will be minding their child.
[VERIFY that every person whose profile is published has agreed to it, that they know they can ask for it to be changed or removed, and what happens to a profile when someone leaves.]
8.Cookies, analytics and the font
There is no analytics on this website. No Google Analytics, no advertising pixel, no heatmaps, no session recording. Nothing on these pages is counting you.
The public pages set no cookies at all. That is why there is no cookie banner: there is nothing for you to agree to.
The only cookies on this site keep a member of staff signed in to the admin area at /admin. They are set when a staff member signs in, the sign-in cannot work without them, and a visitor never receives one.
The typeface
The typeface is served from this website itself. Your browser makes no request to Google or to any other font service, so no third party learns you visited because of a font.
That is a deliberate choice. Fonts loaded from a third-party service carry your IP address to that service before you click on anything, and that has been a live compliance question for European websites. Serving the file ourselves removes the request entirely.
Who else can see your information
Running a website means a small number of other companies handle information on our behalf. This is all of them.
- Supabase
- The database and file storage behind this site. Every enquiry, post and photograph is held there, in Supabase's Ireland region, inside the EU. Supabase also sends the one-time sign-in emails to staff.
- The website host
- Google Cloud Run, in an EU region. Whoever hosts the site sees the requests their servers handle, which normally means IP addresses in a server log. [VERIFY what Cloud Run logs and for how long, before this page goes live.]
- Fonts
- Nobody. The typeface is served from this website itself, so no font request reaches Google or any other service. Section 8 explains it in full.
- Nobody else
- We do not sell your information. We do not share it with advertisers, data brokers or other childcare settings. No enquiry is passed to anyone outside the business.
- Where your information is held
- The database sits in Ireland. The website itself will run in an EU region on Google Cloud Run. [VERIFY this line against the final deployment before publishing; nothing should leave the European Economic Area.]
This list is kept deliberately short and in one place. Anything added to the website that touches visitor information, an analytics tool, a booking system, a chat widget, has to be added here the same day it goes live.
10.How long we keep it
Two different rules are easy to mix up here, so they are set out separately.
Website enquiries
No retention period has been set. Nothing on this website deletes an enquiry, so an enquiry sent today would sit in the database until somebody removed it by hand.
[VERIFY] This is the largest open decision on the page. A period has to be agreed, for example twelve months from the last contact, or until the child starts with us or the family says they are no longer interested. Once it is agreed, a scheduled job has to be written to actually do the deleting. A policy that promises twelve months while the database keeps everything is worse than no policy at all.
Enrolment records are a separate thing
Irish early years regulations require a setting to keep enrolment records for two years after a child leaves. That rule covers the records the creche holds about children who attended. Website enquiries sit outside it, and the answer above is the one that applies to this form.
[VERIFY the exact regulation and its wording before quoting the two year rule in public, and keep it separate from the website answer above. The two are unrelated and should never be run together in one sentence.]
Everything else
- Staff sign-in accounts
- Kept while the person works here. [VERIFY who removes an account when someone leaves, and how soon after.]
- Staff profiles on the team page
- Published until they are taken down. [VERIFY what happens to a profile when an educator leaves.]
- Posts and photographs
- Kept for as long as they stay published. Older posts stay up unless there is a reason to remove them.
11.Your rights
GDPR gives you rights over the information we hold about you. Using them is free, and asking will never affect your place on any list.
- See it
- You can ask for a copy of what we hold about you. This is called a subject access request.
- Correct it
- If something is wrong, tell us and we will fix it.
- Delete it
- You can ask us to delete it. We will, unless there is a legal reason to keep it, and we will tell you if there is.
- Limit what we do with it
- You can ask us to hold it but stop using it while something is being sorted out.
- Take it with you
- You can ask for a copy in a common format that another organisation could read.
- Object
- You can object to us holding or using it, and tell us why.
- Change your mind
- Where we rely on your consent for something, you can withdraw it at any time. Withdrawing does not undo anything that was done before you withdrew it.
There is no automated decision making on this website. No system decides anything about your child. Every enquiry is read by a person.
Write to us and we will answer within one month, which is the deadline GDPR sets. If a request is complicated we can extend that, and we will tell you if we do.
We may ask you to confirm who you are before we act on a request. That is not us being difficult. It stops a family's details being handed to the wrong person.
[VERIFY the address or email that requests should go to, and who in the setting is responsible for answering them inside the month.]
12.Keeping it safe
The enquiry form can be written to by anyone and read by nobody except signed-in staff. That is enforced by the database itself rather than by the form, so there is no address you could visit to read other people's enquiries.
Staff sign in with a one-time link sent to their email. There are no passwords on this site to be guessed, reused or leaked.
Photographs have their hidden location data removed before they are saved.
No website is perfect. If something happens that puts your information at risk we will tell you, and we will tell the Data Protection Commission where the rules require it.
[VERIFY once a host is chosen: that the whole site is served over HTTPS, that the admin area is kept out of search results, who is told first when something goes wrong, and who reports a breach to the Data Protection Commission inside the 72 hours GDPR allows.]
13.Complaining to the Data Protection Commission
If you are unhappy with how we have handled your information, tell us first. We would far rather hear it from you and fix it.
You also have the right to complain to the Data Protection Commission, which is the Irish regulator for data protection. Their website is dataprotection.ie and it explains how to make a complaint.
[VERIFY: copy the current postal address, phone number and complaints email for the Data Protection Commission from dataprotection.ie and put them here. Do not publish contact details from memory.]
14.Changes to this policy
The date at the top of this page is when it last changed. If we change something that affects you, we will say so on the page rather than changing it quietly.
15.How to contact us about this policy
Ask us anything about this page and we will answer in plain English. If something here is unclear, that is a fault in the writing and worth telling us about.
[VERIFY the email address for data protection questions. None exists yet, and this page cannot be published without one.]