Privacy Policy

1. Who We Are

NIB Group Ltd, trading as Nursery in a Box, provides nursery management software and related services.

NIB Group Ltd
Company number: 12271143
Beck House, King Street, Knutsford, Cheshire, WA16 6DX
Email: support@nurseryinabox.com
Telephone: 01253 49 50 51

We are:

• A data controller for our own business data (accounts, billing, marketing).
• A data processor for nurseries using our platform (child, parent and staff data).

2. The Information We Process

2.1 Information provided by nursery owners, managers and staff

• Name
• Contact details
• Login details
• Billing and subscription information
• Support requests
• Usage and audit logs
• HR Admin staff records

2.2 Information provided about children and parents

(Processed on behalf of the nursery)

• Child name, DOB and profile details
• Parent and guardian contact details
• Attendance, funding and booking data
• Medical notes, allergy details and care information
• Accidents, incidents and safeguarding-related records
• Photos and observations (if uploaded)

2.3 Technical and usage data

Automatically collected when you use the service:

• IP address
• Device information
• Browser type
• Pages accessed and interactions
• Error logs and diagnostic data

2.4 Job applicant information (HR Admin)

• Contact details
• CVs and application data
• Interview notes

3. How We Use Your Information

3.1 To deliver and support the platform

Lawful basis: Performance of a contract

• Account creation
• Childcare management functions
• HR Admin tools
• Mobile apps
• Support and troubleshooting

3.2 For security and system monitoring

Lawful basis: Legitimate interests

• Fraud prevention
• Access control
• Service performance monitoring

3.3 For legal and regulatory requirements

Lawful basis: Legal obligation

• Safeguarding records
• Financial records and invoices
• Tax-Free Childcare integrations (if used)

3.4 For communications and updates

Lawful basis: Consent for marketing
You can opt out at any time.

3.5 Special category data

We process medical and health information such as allergies, medication, accidents or SEN notes.
Lawful basis under Article 9:

• Substantial public interest relating to safeguarding
• Employment obligations (HR data)
• Explicit consent where required

4. Sharing Your Information

We may share information with:

• Nurseries (where they are the controller)
• Our service providers listed in our Sub-Processors Register
• Payment providers
• Email and SMS providers
• Hosting and data-centre providers
• OpenAI (for AI Guardian features)
• Government bodies where legally required (for example HMRC or safeguarding authorities)

We do not sell personal data.

5. International Transfers

Some providers process data outside the UK, including the United States.

Where this applies, we use approved safeguards such as:

• The ICO’s International Data Transfer Agreement (IDTA)
• UK Addendum to EU Standard Contractual Clauses
• Provider-specific transfer safeguards

6. Data Security

We use a combination of technical and organisational measures including:

• UK-based data centres certified to ISO 27001
• AES-256 encrypted storage
• Encrypted data in transit (TLS)
• Access controls and audit trails
• Multi-factor authentication options
• Regular penetration and vulnerability testing

7. Data Retention

We keep data only for as long as necessary. Typical periods include:

• Child attendance and funding records: 7 years (or longer if required for safeguarding)
• Accident and incident logs: 21 years
• Financial records and invoices: 6 years
• Support logs: 3 years
• HR staff records: 6 years after employment ends
• Job applications: 12 months
• Backups: held securely for limited periods on a rolling cycle

Nurseries may set their own internal retention rules.

8. Cookies and Tracking Technologies

We use cookies for:

• Login sessions
• Preferences
• Analytics
• Security
• Performance

Users can control cookies through their browser settings. A full cookies policy is available separately.

9. Your Rights

Depending on your role (parent, staff member, nursery administrator or account holder) you have the right to:

• Access your data
• Correct inaccurate data
• Delete your data (where applicable)
• Restrict processing
• Object to certain uses
• Port your data
• Withdraw consent
• Complain to the ICO

To exercise any rights, email: support@nurseryinabox.com

10. Changes to This Policy

We may update this policy to reflect changes in our services or legal requirements. Material updates will be posted on our website with the updated date.

11. Contact Us

NIB Group Ltd
Beck House, King Street, Knutsford, Cheshire, WA16 6DX
Email: support@nurseryinabox.com
Telephone: 01253 49 50 51

Last updated: 10th December 2025