Data processing and purposes
Clear, proportionate and secure handling of personal data
Tiny Acorns Ltd, based in Hemel Hempstead, processes personal data only for specified and legitimate purposes such as client care, administration and safeguarding. We handle information to deliver children's services, manage bookings and billing, meet statutory safeguarding duties and communicate with families and staff.
This page sets out the categories of personal data we process, the lawful bases we rely on, our retention approach and the safeguards we require when third parties process data on our behalf.
Categories of personal data we process include contact and identity details (names, addresses, dates of birth), emergency and family contact information, health and medical information (allergies, medication, care plans), attendance and session records, photographic records where consent is given, financial and billing information, safeguarding records and staff personnel records. Lawful bases we use are the performance of a contract (to provide childcare services), legal obligation (to meet safeguarding and accounting duties), vital interests (in emergency medical situations), legitimate interests (for administration and the reasonable management of our services) and consent (for optional marketing or photography). Retention periods are applied according to category and legal obligations: client care and session records are retained for seven years after the end of a client relationship unless a safeguarding record requires longer retention; safeguarding records are retained for the longer of statutory requirements or until the child reaches their twenty fifth birthday where relevant; financial and accounting records are retained to satisfy HMRC and accounting requirements; staff records are retained for a period consistent with employment and tax obligations. Where an individual withdraws consent for non-essential processing (for example, marketing photographs), we will cease that processing and remove the relevant materials unless retention is necessary for safeguarding or legal compliance.
When we use third-party processors—such as payroll providers, cloud storage and email services, DBS/Disclosure checks or IT support—we put contractual safeguards in place by way of a written Data Processing Agreement that sets out the processor’s obligations and security measures. We limit transfers outside the United Kingdom and, where international transfers are necessary, require appropriate safeguards such as UK adequacy assurances, standard contractual clauses with any required UK addendum, strong encryption and minimisation of data transferred. Privacy by design principles are embedded in our services: we apply data minimisation, role-based access controls, encryption in transit and at rest, retention schedules and staff training. We conduct data protection impact assessments for any new system or process that is likely to result in a high risk to individuals’ rights and freedoms, and we keep records of processing activities to ensure accountability and transparency.
How Tiny Acorns Ltd protects your data
Proportionate security, clear responsibility and local accountability in Hemel Hempstead
Tiny Acorns Ltd protects personal data through proportionate security measures, focused staff training and clear lines of accountability.
As a Hemel Hempstead-based provider working with children, families and local partners, we adopt practical safeguards to reduce risk, preserve confidentiality and maintain the trust of parents, carers and partner organisations across the town and the wider community.
Technical and physical safeguards at Tiny Acorns Ltd include encryption for electronic records both in transit and at rest, role-based access controls on our management systems, unique user credentials with regular password changes and multifactor authentication where appropriate.
Paper records are held in locked storage within our premises and securely destroyed when no longer needed.
Third-party suppliers who process data on our behalf are selected on the basis of suitable security measures and must meet our contractual data protection requirements.
We minimise the personal data we collect, retaining only what is necessary for child related delivery, safeguarding and statutory reporting.
Every data collection activity has an identified lawful basis, most commonly consent, contractual necessity or safeguarding obligations, and we explain these bases clearly in our privacy notices provided to families and partners in Hemel Hempstead.
Retention schedules are applied so personal information is retained only for as long as required and then securely disposed of.
Staff training and accountability are central to our approach.
All employees and regular volunteers complete mandatory data protection training as part of induction and receive regular refresher sessions tailored to their role.
We maintain named data leads responsible for day-to-day compliance and a senior manager with overall accountability for data protection and information governance at Tiny Acorns Ltd.
To ensure our practices remain effective, we conduct regular internal reviews and audits of data handling and security controls and commission external audits when new systems or processes are introduced.
We also carry out data protection impact assessments for activities that may present higher risk.
In the event of a data incident, we have an incident response procedure to assess, contain and, where required, report matters to the Information Commissioner’s Office and affected individuals.
These measures together help Tiny Acorns Ltd safeguard personal data, support confidentiality and maintain the confidence of the families and partner organisations we serve in Hemel Hempstead and beyond.
Contact us and your rights
Use the contact form to exercise your rights or to ask about our policies.
Tiny Acorns Ltd, based in Hemel Hempstead, accepts requests relating to personal data held by us and will treat each enquiry seriously and professionally.
You can request access to the personal data we hold about you, request correction of inaccurate data, request erasure (the right to be forgotten), request restriction of processing, request portability of your personal data, or object to our processing where applicable.
To make a request, complete the contact form on our website and clearly state which right you are exercising and the specific information or action you require.
To help us process your request promptly and securely, please provide your full name, the email address or contact details we hold for you (where known), and sufficient detail about the personal data or processing you are asking us to address.
We may ask for proof of identity and proof of address so we can verify that we are responding to the correct person.
Acceptable evidence may include a photographic identity document and a recent utility bill or bank statement showing your name and address.
We aim to respond to valid requests promptly and, in any case, within one month of receipt. If your request is complex or numerous, we may extend this period by a further two months and will inform you of any extension and the reasons for it within the initial one-month period.
Most requests are dealt with free of charge. Where a request is manifestly unfounded or excessive, particularly if it is repetitive, we may charge a reasonable fee or refuse to act on the request; we will explain our reasons in writing.
If you are not satisfied with our response, you may raise the matter with us using the contact form and we will review your case.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO), which is the UK supervisory authority for data protection.
Tiny Acorns Ltd in Hemel Hempstead is committed to clear, timely resolutions for all enquiries.
Use the contact form on our website to submit your request or ask for further information about how we handle personal data and our privacy policies.