Last updated: 2 November 2026
1. Introduction and Our Roles
KINDERSTART LTD ("we", "our", or "us") is committed to protecting your privacy and ensuring the highest standards of data security for early years settings.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, our legal role depends on the data being processed:
- As a Data Controller: We are the Data Controller for your direct account information (e.g., your name, subscription billing details, and your business contact info).
- As a Data Processor: When you use the KinderStart app to log information about the children in your care (e.g., attendance, EYFS observations, parent details, and safeguarding logs), you are the Data Controller. We act strictly as your Data Processor, processing this highly sensitive information solely on your instructions to provide the Service to you.
1.2 Data Processing Agreement (DPA)
By creating a KinderStart account and using our Services to process personal data relating to children and parents, you are entering into a legally binding Data Processing Agreement with us. This Privacy Policy, combined with our Terms of Service, forms the complete DPA required by Article 28 of the UK GDPR, legally binding us to protect your data.
2. Information We Collect
2.1 Information You Provide
We collect information that you provide directly to us, including:
- Account Information: Name, email address, password
- Profile Information: Target launch date, registration progress
- Application Data: Certificate numbers, expiry dates, training records, DBS check details
- Documents: Uploaded policies, certificates, and other registration documents
- Communications: Messages you send us via email or contact forms
- Client Data (Processed on your behalf): To provide our childcare management tools, we host data entered by you regarding the children in your care. This includes children's names, dates of birth, EYFS developmental progress, dietary/medical requirements, attendance records, safeguarding logs, parent/carer contact details, and photographs taken within the setting.
- Families who ask about a place (processed on your behalf): A childminder can keep the contact details of families on their waiting list, and the details of the child they ask about, and send them quotes from KinderStart. The childminder is the controller of this data; we process it for them.
2.2 Automatically Collected Information
When you use our Service, we automatically collect:
- Usage Data: Pages visited, features used, time spent on pages
- Device Information: Browser type, operating system, device type
- Log Data: IP address, access times, referring URLs
- Cookies: See our Cookie Policy for details
- Referral Attribution: If you sign up through a colleague's referral link, we store the referral code (and a 30-day cookie on kinderstart.co.uk) and a device identifier so we can credit the referral and prevent self-referral. The person who referred you sees only your first name and the initial of your surname, and the status of the referral. We never share your email address, phone number or any other detail with them.
- Parent App Activity: If you are a parent, the childcare setting you are linked to can see the date you last used the app, and when you opened something they sent you through it: a noticeboard post, daily diary, observation, invoice, contract, document or form, questionnaire, weekly menu or planned activity. Opening an anonymous questionnaire is not recorded
3. How We Use Your Information
3.1 Artificial Intelligence (AI) Processing
KinderStart provides AI-assisted tools (such as the receipt scanner or observation assistant) to reduce your administrative burden.
- All AI processing is conducted via secure, enterprise-level APIs.
- Zero Training Policy: We have strict contractual guarantees in place ensuring that no personal data, child data, or photographs entered into KinderStart are ever used to train public or third-party AI models. Data processed by our AI tools is not retained by the AI provider after the immediate request is fulfilled.
3.2 General Data Use
We use your information for the following purposes:
- Provide Services: To create and manage your account, track your registration progress, and provide guidance
- Communication: To send you service updates, daily inspection questions, and important notifications
- Improvement: To analyse usage patterns and improve our Service
- Security: To protect against fraud, unauthorized access, and security threats
- Legal Compliance: To comply with legal obligations and enforce our Terms of Service
Legal Basis (UK GDPR):
- Contract Performance: Processing necessary to provide our services
- Legitimate Interests: Improving our services, security, and fraud prevention
- Consent: Marketing communications (where applicable)
- Legal Obligation: Compliance with laws and regulations
4. Data Sharing and Disclosure
We do not sell your personal information. We may share your information with:
- Service Providers: Companies that process data for us (our sub-processors), listed by type below
- Legal Requirements: When required by law or to protect our rights
- Business Transfers: In connection with a merger, sale, or acquisition
4.1 Companies that process data for us
- Cloud hosting and storage — London, UK. Photos may be served from nearby locations so they load faster
- AI features — EU data centres
- Error reports — Germany
- Push notifications and app updates — USA
- Support requests — USA
- Payments and subscriptions — UK, EU and USA
- Website hosting and spam protection — Worldwide, nearest to the visitor
- Website fonts, and website analytics only if you accept cookies — USA
- Measuring how well our adverts work — USA
- Videos on our website — USA
All of these companies must keep data secure and use it only as we instruct. Section 9 explains how we protect data that leaves the UK.
The full list of the companies we use is on our sub-processors page.
4.2 Other organisations we send data to
These organisations decide for themselves how they use the data (they are separate data controllers):
- HMRC (Making Tax Digital): When a childminder connects to HMRC, we send their National Insurance number, income and expense totals, the tax returns they choose to submit, and the device and connection details HMRC requires to prevent fraud.
- HMRC and NS&I (Tax-Free Childcare): When a parent links a Tax-Free Childcare account, we send the child's payment reference and date of birth to link it, and the payments the parent asks us to make.
- Apple and Google: App store downloads, in-app purchases and delivering push notifications to phones.
5. Tax-Free Childcare Payments
If you are a parent, you can link your child's Tax-Free Childcare account to KinderStart and pay your childminder's invoices from it. KinderStart connects to HMRC's Tax-Free Childcare service as an External Payment Provider.
You sign in to your Government Gateway account on HMRC's own website and give KinderStart permission to make Tax-Free Childcare payments for you. We never see your Government Gateway user ID or password.
5.1 What we hold
- Your child's Tax-Free Childcare payment reference, which you enter.
- Your child's name as HMRC holds it, which HMRC sends back so you can check you linked the right child.
- The access keys (tokens) HMRC gives us so we can act for you. We encrypt them with a key used only for Tax-Free Childcare.
- For each payment, HMRC's payment reference and the date the money is expected, saved on the invoice.
We get your account balance from HMRC each time you look at it, and we don't store it. We use your Tax-Free Childcare data only to link the account, show your balance and send the payments you ask for. We never use it for marketing, analytics or AI features. It is stored only on AWS servers in London, UK, and is not sent to any other provider in section 4.1.
5.2 Legal basis and who we share it with
We process this data because it is needed to provide the payment service you ask for (contract, Article 6(1)(b) UK GDPR). We send it to HMRC and NS&I, who run Tax-Free Childcare, to link the account, check the balance and make payments. They are separate data controllers. Your childminder sees that an invoice was paid through Tax-Free Childcare and the payment reference, but not your balance.
5.3 How long we keep it, and unlinking
- When a child is unlinked: we delete that child's payment reference and HMRC name straight away. If no other child of yours is still linked, we also delete your HMRC access keys. HMRC doesn't offer a way for us to cancel your permission on their side, so deleting our copy of the keys ends our access.
- When you delete your KinderStart account: we delete all of your Tax-Free Childcare data.
- Payment records: the payment reference and date on an invoice are part of your childminder's business records and are kept for up to 7 years.
- Logs and backups: our logs never contain your payment reference or access keys and are deleted after 90 days. Backups are deleted after 35 days.
6. Data Retention
We retain your personal information for as long as necessary to provide our services and comply with legal obligations:
- Account Data: Until you delete your account, plus 30 days
- Documents: Until you delete them or close your account
- Usage Logs: 90 days
- Legal Records: As required by law (typically 6-7 years)
- Children's and Parents' Data: Because you (the childminder) are the Data Controller, you determine the retention periods for the children in your care (e.g., retaining safeguarding records until a child reaches 21, as per your own setting's policies). KinderStart provides you with the tools to securely export this data for your archives and permanently delete child profiles from our active servers at your discretion. If you cancel your KinderStart subscription, all Client Data is securely and permanently wiped from our systems after 30 days.
- Waiting lists: When a family on a childminder’s waiting list says no or loses touch, we delete their details 24 months after the entry was last changed, unless the childminder reopens it.
7. Your Rights (UK GDPR)
Under UK GDPR, you have the following rights:
- Right to Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a portable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent for marketing communications
To exercise these rights, including requesting a full data dump (Data Access Request) or the permanent deletion of your account and all associated information (Right to Erasure), please contact us at [email protected]
For security purposes, we will verify your identity before fulfilling any data-related requests.
8. Data Security and Safeguarding Compliance
We implement enterprise-grade technical and organisational measures to protect your data, specifically designed to help you meet Ofsted and EYFS safeguarding requirements:
- Secure Infrastructure: All data and files are hosted securely on Amazon Web Services (AWS) using S3 and DynamoDB, which hold rigorous ISO 27001 security certifications.
- Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest.
- Two-Factor Authentication (2FA): Access to the app is secured using your device's hardware-level security (e.g., FaceID, TouchID, or passcode).
- EYFS Device Compliance (In-App Camera): To comply with strict EYFS regulations regarding personal devices, any photographs taken using the KinderStart app are uploaded directly to our secure cloud and are never saved to your personal device's local camera roll.
- Breach Protocol: In the highly unlikely event of a data breach, we have a strict incident response protocol and will notify you (the Data Controller) without undue delay, well within the ICO's 72-hour mandate, allowing you to fulfill your own regulatory obligations.
9. Data Hosting and Location
Your data, including children's records and photos, is stored on AWS servers in London, UK. Some of our providers process data outside the UK: AI features run in AWS data centres in the EU, error reports are stored in Germany, and some providers are based in the USA. When personal data leaves the UK, we only use providers covered by UK adequacy regulations or by the ICO's approved data transfer contract terms.
10. Children's Privacy
Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. Continued use after changes constitutes acceptance.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights:
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):