Privacy & Data Protection Policy

This policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, how we keep it secure, and the rights you have. It is written to align with the UK GDPR and the Data Protection Act 2018.

1. Who we are & scope

ActivityLane provides software that activity, sports, camp, club and childcare providers use to run bookings, registers, communications, staff and finance. This policy covers personal data we process about (a) providers and prospective providers who use, enquire about or visit the Service and this website, and (b) the parents, carers, children and staff whose information providers manage through the platform. It applies to our marketing website and the ActivityLane platform.

2. Controller & processor roles

Who is responsible for what depends on the data:

• Provider account data (your name, business details, login, billing, enquiries) — we are the controller.
• Tax-Free Childcare payment data (the child’s Tax-Free Childcare reference and the payment and balance details HMRC returns when a parent links their account and pays) — we are the controller, and we use it only to make the payment the parent asked for.
• End-User data a provider enters into the platform (parents, children and staff — bookings, attendance, allergies, safeguarding, payroll) — the provider is the controller and we are their processor, acting only on their documented instructions to deliver the Service. This is governed by our Data Processing AgreementSafeguarding.

If you are a parent, carer or member of staff and want to exercise your rights over data held by a provider, please contact that provider (the controller) first; we will support them in responding.

3. The personal data we collect & how

How we collect it. We collect data (a) directly from you when you enquire, book a demo, create an account, subscribe or contact us; (b) from providers, who enter their End-Users’ data into the platform; (c) automatically as you use the website/platform (via cookies and similar technologies — see section 7); and (d) occasionally from third parties such as our payment processor or a referral.

About providers & website visitors, we collect:

• Identity & contact — name, business name, role, email, phone, business address/postcode;
• Account & login — username and password (passwords are stored only as salted hashes by our authentication provider — we never see or store your plain password);
• Subscription & billing — plan, team size, billing status and transaction metadata (card numbers are handled by Stripe and are never stored on our systems);
• Bank/payout details where you enter them for your own payout configuration;
• Enquiry & support — messages, demo requests and support correspondence;
• Technical & usage — IP address, device/browser type, pages viewed, actions taken and approximate location, for security and to improve the Service;
• Marketing preferences — your consent choices.

On behalf of providers, the platform holds End-User data the provider enters, which may include: parent/carer names and contact details; emergency contacts; child names, dates of birth and booking/attendance records; dietary requirements and photo-consent preferences; special-category data the provider chooses to record such as allergies, medical needs, SEND information, medication and safeguarding/incident notes; and staff records (which may include DBS status, training, payroll and absence). We process this only as the provider’s processor.

4. How & why we use it (lawful bases)

Where we are the controller (provider account and website data) we rely on one or more of the UK GDPR lawful bases:

• Contract — to create and run your account, provide the Service, take payment and support you;
• Legitimate interests — to secure, operate, analyse and improve the Service, prevent fraud/misuse, and tell you about relevant features (we balance this against your rights);
• Legal obligation — to meet accounting, tax and other legal requirements;
• Consent — for optional marketing and any non-essential cookies, which you can withdraw at any time.

Where a provider is the controller, they determine the purposes and lawful bases for their End-User data (including the Article 9 condition for any special-category data), and we process it only under our contract with them as processor.

We may also create and use aggregated or anonymised data — which no longer identifies anyone — to understand usage trends, produce statistics and improve the Service. Such data is not personal data and is not subject to this policy.

5. Children’s & special-category data

Because the platform is used by activity and childcare providers, it may hold information about children and sensitive information such as allergies, medical needs, SEND and safeguarding records. We treat this data with particular care and apply additional safeguards around it. Providers are responsible, as controllers, for having a valid lawful basis and the appropriate Article 9 condition and consents for children’s and special-category data, and for issuing their own privacy notices to families. We provide the tools, access controls and security around that data and act strictly on the provider’s instructions.

The Service and this website are intended for businesses and adults (18+) and are not directed at children. Children’s personal data is only ever processed on the platform as a provider’s processor, on their instructions and under our Data Processing AgreementSafeguarding.

6. Marketing communications

We may send you information about the Service, features and offers where you have opted in, or where you are an existing provider and the law allows us to on a soft opt-in basis. Every marketing email includes an unsubscribe link, and you can opt out at any time by using it or contacting us — we action opt-outs promptly (normally within a few days). Opting out of marketing does not stop essential service messages (for example billing, security or important account notices), which we still need to send. We do not sell your data or share it with third parties for their own marketing.

7. Cookies & similar technologies

Cookies are small files placed on your device. We use:

• Strictly necessary cookies — required to sign you in, keep your session secure, remember your place in a flow and make the platform work. These do not need consent.
• Functional/preference cookies — to remember choices such as language or a collapsed panel.
• Analytics cookies (only if used) — to understand how the site is used so we can improve it; where these are non-essential we ask for your consent first.

You can control or delete cookies through your browser settings, but disabling strictly necessary cookies may stop parts of the Service working. Where we introduce any non-essential or third-party analytics, we will present a cookie choice and honour it.

8. Who we share it with

We do not sell personal data. We share it only with trusted service providers (sub-processors) who help us run the platform, under data-processing contracts that require them to protect it and act on our instructions:

• Google Cloud / Firebase — secure hosting, database and authentication (UK/EU regions);
• Stripe — payment processing (PCI-DSS certified; card data handled by Stripe);
• Resend — email delivery, to send transactional and (where consented) marketing email;
• HMRC — only if direct payment through HMRC is used for Tax-Free Childcare (not yet available);
• AI provider (currently Groq) — powers the in-app AI co-pilot and message-drafting features; text submitted to those features is processed to generate a response and is not used to train third-party models;
• Professional advisers and authorities — where required by law, to establish/exercise/defend legal claims, or to protect people’s safety; and
• A buyer or successor — in connection with a sale, merger or reorganisation of our business (subject to equivalent protection).

A current list of sub-processors is kept in our Data Processing Agreement.

9. International transfers

We aim to store and process personal data within the UK and/or European Economic Area. Where any transfer outside the UK/EEA is necessary (for example a sub-processor’s support function), we ensure an appropriate safeguard is in place — such as a UK adequacy decision, or the ICO’s International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses — so your data receives equivalent protection.

10. How we keep data secure

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure, in line with Article 32 of the UK GDPR. These include:

• Encryption in transit — all traffic is served over HTTPS/TLS;
• Encryption at rest — data is stored on infrastructure that encrypts data at rest;
• Access controls — role-based, least-privilege access, with logical tenant isolation so one provider cannot access another’s data;
• Secure authentication — passwords stored only as salted hashes; sensitive actions gated by permissions;
• Reputable hosting — the platform runs on Google Cloud / Firebase infrastructure holding recognised security certifications;
• Backups & resilience — redundancy built into our hosting infrastructure guards against loss;
• Monitoring & logging — to detect and respond to security issues; and
• People & process — staff are bound by confidentiality, trained on data protection and access data only where needed.

11. Personal data breaches

We maintain procedures to detect, investigate and respond to personal-data breaches. Where a breach is likely to result in a risk to people’s rights and freedoms and we are the controller, we will notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours, and affected individuals where required. Where we act as a provider’s processor, we will notify that provider without undue delay so they can meet their own obligations.

12. How long we keep it (retention)

We keep personal data only for as long as necessary for the purposes above, then delete or anonymise it. Our main retention periods are:

• Provider account & profile data — for the life of your account, then deleted within 90 days of closure (limited contact details may be kept longer to handle a dispute).
• Parent & family accounts — you can delete your account yourself in the app (My account → Delete my account) or at /delete-account. Your sign-in, profile, children’s profiles, photos and messages are erased straight away. Booking and payment records are kept for tax and accounting with your name, email, phone and address removed, and registers, accident, medication and safeguarding records are kept by the provider as the law requires. Providers keep a child’s activity records (bookings, registers, incidents) for safeguarding reasons, for the period the law requires.
• Financial & transaction records (invoices, payment metadata) — retained for 6 years after the relevant tax year, to meet UK accounting and HMRC requirements.
• Provider Personal Data we process on a provider’s behalf — kept while their account is active; on termination it is available for export for 30 days, then removed from live systems within 90 days, unless the provider or the law requires otherwise.
• Safeguarding, incident, accident & medication records — retained in line with the provider’s instructions as controller and applicable statutory guidance; such records often must be kept for extended periods (for example until a child reaches a specified age). The provider determines and is responsible for the retention period.
• Marketing & consent records — kept until you withdraw consent or object, plus a short period to evidence the request and honour suppression.
• Support communications — typically retained for up to 3 years.
• Backups & security logs — backups are cycled and overwritten on a rolling basis by our hosting provider; logs are kept for a limited period for security monitoring.

Where a legal hold, dispute or regulatory obligation applies, we may retain relevant data for longer until that obligation ends. We review our retention practices periodically.

13. Automated decision-making & profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We use limited automated features (for example basic analytics and reminders) to run and improve the Service, but a person is involved in any significant decision.

AI features. The Service includes AI-assisted features (such as an in-app co-pilot and help drafting messages), powered by a third-party AI provider (currently Groq). Text you submit to these features is sent to that provider only to generate a response, is not used to train third-party models, and you should review AI-generated output before relying on it.

14. Your rights

Under UK data-protection law you have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to processing; data portability; and to withdraw consent (for consent-based processing such as marketing). You also have rights in relation to automated decision-making (see section 13).

Job applicants. When a provider publishes a job application form, the platform holds what a candidate sends (answers and any uploaded PDF or photo) as the provider’s processor, visible only to that provider’s managers. A candidate ticks a consent before sending. Unless the provider chooses otherwise, the details of applicants who are rejected or withdraw are deleted automatically after six months; people who are hired move into the provider’s staff records. A candidate can ask the provider to see, correct or delete their details at any time.

To exercise a right over data we control (your provider account), contact us using the details below. For data a provider controls (parent/child/staff records), contact that provider; we will assist them as their processor. We may ask you to verify your identity before we act. There is normally no charge, and we aim to respond within one month (we may extend by two further months for complex requests, and will tell you if so).

15. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “last updated” date and, for material changes, give reasonable notice (for example by email or in-app).

16. How to complain

If you have a concern about how we handle your data, please contact us first and we will try to resolve it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO) — ico.org.uk, helpline 0303 123 1113. We would appreciate the chance to address your concern before you approach the ICO.

17. Contact & extra help

For any privacy or data-protection matter, contact Kaz James, Operations Manager at info@activitylane.com, K James Consultancy and Headship Ltd, 12 Corris Court, Broughton, Milton Keynes MK10 9NR.

If you need this policy in a different format (for example large print or plain text) to help you access it, let us know and we will do our best to help.