Privacy Notice

1. What is this Notice About & Why Should You Read It?

We are committed to safeguarding the privacy of persons for whom we process personal data. In this privacy notice we explain how we will treat personal data processed by us, in accordance with data protection legislation.

This Privacy Notice applies to Parents Booking solely.

(If you are looking for Netmedia’s specific Privacy Policy, it is located separately here.)

2. What Types of Personal Data Do We Process and What are the Purposes of the Processing?

Parents Booking processes parent/carer, student and teacher data from schools (and/or local authorities) who subscribe to or trial Parents Booking. The customer (the school or local authority) are the data controllers, Parents Booking is the data processor.

Parents/carers who use Parents Booking may change the email address record, so that it is different from the record processed from the school. In these instances, the parent is providing this update and agreeing to Parents Booking processing this record (solely for the purposes of providing Parents Booking's service).

Parents Booking processes the following types and categories of personal data, but please be aware not all data is processed by all schools:

  • Title, forename and surnames of parents/carers
  • Email address and phone number of parent/carers
  • Forename and surname of pupils/students
  • Dates of birth of pupils/students
  • Title, forename and surnames of teachers
  • Teacher email address
  • Teacher telephone number (only where multi-factor authentication is required)
  • Room name
  • MIS database ID numbers for parents, pupils and teachers
  • Class name
  • Information which parents/carers enter into the appointment comment box (for teacher to read)
  • Usernames and passwords (e.g. for school staff, stored only as secure, salted hashes).
    • Parents commonly sign in using a single-use email link or single sign-on.
  • Translator/interpreter requirements
  • Personal data obtained through the usage of Cookies on our website – for more information, please view our Cookie Notice (at the bottom of this page)
  • Personal data enabling us to administer our website and ensure that our website is presented in the most effective manner for you, such as IP address, geographical location, browser types and version, operating system, referral source, length of visit, page views and website navigation paths
  • Unique ‘meeting ID’ numbers for any video meetings which take place
  • Booking records for events, clubs and wraparound childcare (for example the sessions, dates and extras booked) and related payment records, including the parent's account balance, payment references and any credits, vouchers or instalments. Card details are entered directly with the payment provider and are never received or stored by Parents Booking
  • Tax-Free Childcare payment references, where parents pay using their Tax-Free Childcare account (no Tax-Free Childcare account credentials or balances are stored)
  • Identifiers received from single sign-on providers (such as Apple, Google, Microsoft or MyAccount/MyGovScot), where parents or staff choose to sign in that way
  • Where a school has chosen to use our optional AI telephone booking agent for wraparound childcare: the caller's phone number, a recording and transcript of the call, and the details given during the call (the parent's name, the child's name and date of birth, used to verify the caller, and the booking requested)
  • Optionally, some schools sometimes process the following data:
    • Pupil premium, English as an additional language, gender and SEN information, and/or similar 'flags'. This data is only processed where the school intends to use it to prioritise certain families' invites/reminders and analyse uptake using these 'flags', in the pursuit of better engaging and supporting these families.

From time to time we may process special category data about people. We will only process special category personal data when allowed to do so by law, including where you have given us consent to do so, where it is necessary in order to enable us to carry out our obligations and specific rights in the field of employment, social security and social protection law, in order to protect a person’s vital interests, or if the data has already manifestly been made public by you. We may also process this type of data to establish, exercise or defend a legal claim. There are certain other exceptions which exist in law, and we reserve the right to rely on these exceptions, if and when required, but do not envisage such processing of special category personal data taking place within our organisation.

We will only process personal data which is adequate, relevant and limited to what is necessary for the processing purposes.

Our AI telephone booking agent is optional and is only used by schools that choose to take part in its pilot. It lets parents book, change or cancel wraparound childcare sessions, and hear their account balance, by phone. It does not make decisions about people: it only carries out booking requests that the parent confirms, using the same booking rules as the website. Parents can always use the website instead.

3. Where Do We Obtain Your Personal Data From?

3.1 Data Which We Collect From You Directly

The majority of the personal data which we process is obtained from the student’s school, but parents may provide us with additional personal data (such as a change in email address).

3.2 Data Which We May Obtain From Others

We routinely receive or process personal data about you from schools. We process such personal data in accordance with the law.

Please note that if you are disclosing personal data regarding another person to us, you must first obtain that person’s consent for both the disclosure and the processing by us of that personal data, unless another lawful basis exists for such a disclosure, such as a legal obligation. You are responsible for ensuring that you are authorised to disclose any such data to us.

4. What Lawful Bases Do We Have For Processing Your Personal Data?

When Parents Booking processes personal data on behalf of a school or local authority (which covers almost all of the personal data described in this notice), the school or local authority is the data controller and decides the lawful basis for that processing. Netmedia Ltd acts as its data processor and only processes the data on its documented instructions. The lawful basis will usually be one of the following:

  • Public task (UK GDPR Article 6(1)(e)), for state and local authority schools carrying out their education functions, such as communicating with parents and arranging parents' evenings and childcare;
  • Performance of a contract (Article 6(1)(b)), where a parent books and pays for services such as wraparound childcare, clubs or events under an arrangement with the school or provider;
  • Legitimate interests (Article 6(1)(f)), for independent schools and other organisations that are not public authorities;
  • Legal obligation (Article 6(1)(c)), for example keeping financial records for the periods required by law.

Please see your school's or local authority's own privacy notice for the lawful basis it relies on. Where special category data is processed (for example an optional SEN/ASN flag), the school or local authority is also responsible for holding the appropriate Article 9 condition.

Where Netmedia Ltd acts as a data controller in its own right - for example for visitors to our website, cookies, and the contact details of staff at schools we work with or are in discussion with - we rely mainly on our legitimate interests in running, promoting and supporting our services, and on the performance of our contracts with customers. Where we rely on consent (for example for non-essential cookies), you can withdraw it at any time.

5. What Rights Do You Have?

You have certain rights under data protection legislation, which you can generally exercise in respect of the data which we process about you by contacting us.

Your rights are summarised below:

  • Right of access – you can request a copy of the information that we hold about you
  • Right to rectification – you can ask us to correct any personal data which we hold about you if you think that it is inaccurate or incomplete. Please note that you are responsible for letting us know if the personal data which we hold about you needs to be corrected or updated.
  • Right to be forgotten – in certain circumstances you can ask us to delete the personal data which we hold about you
  • Right to restriction of processing – in certain circumstances you have a right to restrict us processing your personal data
  • Right of data portability – you can ask us to transfer the personal data that we hold about you to other organisations in certain circumstances
  • Right to object – you have the right to object to us processing your personal data in certain circumstances
  • Right to object to us making a decision about you based solely on automated processing, including profiling in certain circumstances

If you do not wish to use Parents Booking or its video meeting facilities, please contact your school so as to make alternative arrangements.

6. Who Do We Share Your Personal Data With and Why?

We may disclose your personal data to our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary, and in accordance with data protection legislation.

In particular, we use the following service providers (sub-processors) to deliver Parents Booking, each bound by data protection terms that meet UK GDPR requirements: Amazon Web Services (hosting, backups and Amazon SES email, in Ireland); Twilio (video meetings, one-time pass codes and the phone line for our AI telephone booking agent); and, only for schools using the AI telephone booking agent pilot, ElevenLabs (speech recognition, conversation handling using Google's Gemini language model, and synthetic voice), Vercel (the secure connection between the agent and Parents Booking) and Upstash (short-lived session data for each call), with Vercel and Upstash both in the UK (London). Our current list of sub-processors is set out in Schedule B of our Terms and Conditions.

Payment providers (Stripe, PayPal and ParentPay) and HMRC's Tax-Free Childcare service process payments as independent controllers under their own terms, and single sign-on providers act as independent controllers when you sign in with them.

We may also disclose your personal data:

  • with your consent;
  • to the extent that we are required to do so by law;
  • to protect the rights, property and safety of us, our customers, users of our websites and other persons;
  • in connection with any ongoing or prospective legal proceedings;
  • to the purchaser (or prospective purchaser) of any business or asset that we are (or are contemplating) selling;
  • to another organisation if we enter into a joint venture or merge with another organisations;
  • to any member of our group, which means those companies which are a subsidiary of our holding company, as defined by s.1159 of the Companies Act 2006.

If we wish or need to share your special category personal data with another organisation, we will only do so if we have either obtained your consent or we are required or allowed to do so by law.

7. Transferring Your Data Outside of the European Economic Area/The UK

Parents Booking uses Amazon AWS Cloud Hosting based in Dublin (Ireland) for all schools. All Parents Booking data, including backups, is currently hosted there. If we offer regional hosting for schools outside Europe in future, we will update this notice and notify the schools affected beforehand.

Some of our service providers are based in, or may access data from, the United States. In particular, where a school uses our optional AI telephone booking agent, call recordings and transcripts are stored by ElevenLabs on servers in the United States for 30 days and then deleted. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework and, where applicable, the UK International Data Transfer Addendum. Schools that require UK or EU data residency can choose not to use the AI telephone booking agent.

Where we need to transfer and/or share personal data to countries and/or organisations outside of the European Economic Area, we only do so in accordance with the UK General Data Protection Regulation (‘UK GDPR’).

8. How Long Do We Process Your Personal Data For?

We will only process your personal data for the purpose or purposes stated, and this data shall not be kept for longer than is necessary for such purpose or purposes.

Generally, we keep your data until the student, parent or teacher has left the school, and/or the school's account is closed or expires, whichever comes first. Data records are updated regularly, and Parents Booking searches for student leavers regularly to remove records in a timely fashion.

In particular: booking history is kept for 2 years; payment records for 6 years, to meet legal obligations; video meeting metadata for 30 days; system and security logs for 150 days; AI telephone booking agent call recordings and transcripts for 30 days; and backups for 12 months, after which they are automatically deleted. When a school's contract ends, its data is deleted on the expiry date of its subscription at the latest, except where we must keep records for longer by law.

9. Security of Personal Data

We will take reasonable technical and organisational measures and precautions so as to prevent the loss, misuse or alteration of your personal data.

We process all personal data using an encrypted, secure connection and data is encrypted at rest in our cloud servers. Staff passwords are stored only as secure, salted hashes (Argon2id), administrator accounts can be protected with two-factor authentication, and access by our own staff is restricted, protected by multi-factor authentication and logged. Only our UK-based staff can access live personal data.

Please note that the transmission of any type of information over the internet is inherently insecure. We therefore cannot guarantee the security of data sent over the internet, but every effort is made to provide the most secure service possible.

10. Are We Allowed to Change this Notice?

From time to time we need to make amendments to our Privacy Notice, which we will do by publishing a new version on our website. Please check this page occasionally so as to ensure that you are happy with any changes which we have made to the Notice.

11. What Should You Do If You Have Any Complaints or Want to Find out More?

We continuously seek to ensure that we adhere to the general principles of data protection legislation, including that your personal data will be processed lawfully, fairly, in a transparent manner, subject to the purpose limitation, is minimised, is accurate, is not stored for longer than is necessary for the purposes and is processed with integrity and confidentially, as appropriate.

If you wish to exercise any of your rights as a data subject, wish to receive any more information or wish to make a complaint, please contact our data protection officer. We will acknowledge any data protection complaint and respond without undue delay.

Our Data Protection Officer is William Mackenzie and he can be contacted using the details below.

We will always endeavour to resolve any queries which you may have, but please note that you also have the right to complain directly to the Information Commissioner’s Office and seek other legal remedies.

12. How Can You Contact Us?

We are Netmedia Ltd, registered in Scotland under registration number SC483579. Our registered address is at Old Drynie House, Kilmuir, North Kessock, Inverness IV1 3XG. Our principal place of business is at our registered address. Our company website address is http://netmedia.co.uk and our Parents Booking website address is https://parents-booking.com.

You can contact us in any of the following ways: