Privacy Policy

Last updated: 24 September 2026

1. Who we are

[E-Star Nursery Ltd], of [registered address], is the "data controller" for the personal information described in this policy — the organisation that decides why and how it's processed. We are not yet registered with the Information Commissioner's Office (ICO); our registration number will be added here once that's complete, as required for organisations that determine the purposes of processing personal data.

2. What information we collect

This website currently collects personal information in exactly two places: the tour/enquiry form on the homepage, and the form on our Contact page — and nowhere else. There's no newsletter sign-up, no account creation, and no tracking of what you browse.

When you submit an enquiry or tour request, we ask for:

• Your name
• Your email address
• Your phone number, if you choose to give it (optional)
• Your child's age, or expected due date
• Which room you're interested in, if you know
• Anything you choose to tell us in the free-text message field

We deliberately do not ask for your child's name, date of birth, or any other identifying detail about your child at this enquiry stage. That level of detail is only collected in person, later, once a family chooses to move ahead with registration — under its own separate lawful basis and its own retention rules, set out directly in registration paperwork rather than on this public website.

3. How we use your information

We use the details you submit for exactly one purpose: to respond to your enquiry, arrange a tour, and answer whatever question you sent. We don't use it for marketing unless you separately and explicitly ask to hear from us, and we never sell or rent it to anyone.

4. Our lawful basis for processing

Under UK GDPR, every use of personal data needs a lawful basis. Ours are:

• Taking steps at your request, prior to a contract — responding to your enquiry and arranging a tour is us taking steps, at your request, that may lead to a childcare contract between us.
• Legitimate interests — where we need to keep a short record of enquiries to run the setting properly (for example, following up on a tour request), we rely on our legitimate interest in doing so, balanced against your right to privacy.
• Consent — for anything beyond responding to your specific enquiry (such as marketing updates), we would only proceed with your clear, separate consent, which you can withdraw at any time.

5. Your child's personal data

UK GDPR gives children's personal data extra protection, and we take that seriously even though this website itself is used by parents and guardians, not children. Once a family enrols, a separate, more detailed privacy notice — covering the records an Early Years provider is legally required to keep under the EYFS framework, safeguarding information, and any photography or observation records — is provided directly as part of registration. That notice sits outside this website and will be reviewed with the same care as this one before it's used.

6. Cookies

This website does not currently set any cookies — no analytics, no advertising, no tracking of any kind. See our Cookie Policy for the full detail, including what would change (and what we'd do about it) if that ever changes.

7. Who we share information with

We share the minimum necessary with a small number of processors who help us run this website and respond to enquiries, and never for their own marketing purposes:

• Website hosting — Hostinger, who host the website's files and any form submissions in transit.
• Email / booking system — [not yet selected], once the enquiry forms above are wired up to an actual inbox or booking system.

We do not share your information with advertisers, data brokers, or anyone outside the small set of processors above, and we never sell personal data.

8. Where we store your information

We aim to keep information within the UK/EEA wherever possible. If a processor we use stores or accesses data outside the UK, we'll only use one with appropriate safeguards in place (such as the UK's International Data Transfer Agreement, or an adequacy decision), and will name that processor and country here.

9. How long we keep your information

We intend to keep enquiry details for around 12 months if a tour or registration doesn't go ahead, then delete them — confirm this with whoever manages your booking system and update the figure to match what actually happens, rather than leaving it as an aspiration.

10. Keeping your information secure

We use reputable, secure hosting and keep access to enquiry details limited to the people who need it to run the setting. No method of transmission over the internet is completely secure, but we take reasonable steps appropriate to the modest amount of data this site collects.

11. Your rights under UK GDPR

You have the right to:

• Access the personal information we hold about you
• Rectify it if it's inaccurate or incomplete
• Erase it ("the right to be forgotten"), in certain circumstances
• Restrict how we use it, in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a portable, machine-readable format, where it applies
• Withdraw consent at any time, where consent is the basis for processing
• Not be subject to a decision based solely on automated processing — we don't make any such decisions

To exercise any of these, contact us using the details in section 14. We'll respond within one month, as UK GDPR requires.

12. How to complain

We'd genuinely rather you raised a concern with us first, so we can put it right — see our Complaints Procedure. You also have the right to complain directly to the UK's data protection regulator at any time:

Information Commissioner's Office (ICO)
Helpline: 0303 123 1113
Website: ico.org.uk

13. Changes to this policy

We'll update this page whenever what we actually do changes, and update the "last updated" date at the top. For material changes, we'll look at more prominent ways of letting current families know.

14. Contact us

For anything relating to your personal information, contact [data protection contact name/email], or write to us at [registered address].