Privacy notice

Who we are

Gentleshaw Forest School is the data controller. Contact us through the contact form on this site. We are registered with the Information Commissioner’s Office.

What we collect and why

• Your name, email and phone number, so we can run your account, confirm bookings and reach you on the day. Lawful basis: contract.
• Your child’s first name, surname and date of birth, for the register, group placement and insurance. Lawful basis: contract.
• Medical conditions, allergies and additional needs, so we can keep your child safe. This is special category data. Lawful basis: your explicit consent, which you can withdraw, and vital interests in an emergency.
• Two emergency contacts, so we can reach someone if we cannot reach you. Lawful basis: legitimate interests in the child’s safety.
• Photo consent, recorded as yes or no. We take no photos of a child without it.
• Payment records. Card details are handled by Stripe and never reach us. We keep the amount, date and receipt.

We do not collect your home address, and we do not profile, track or advertise to anyone.

How it is protected

• Medical notes, additional needs and emergency contacts are encrypted before they are saved, using a key held separately from the database.
• Everything is stored on servers in the UK or the EU, and backups are encrypted.
• Only the leader can see your child’s records. A second adult sees a printed day sheet for that session only, which is destroyed at the end of the day.
• Every view of a child’s record is logged.
• Your account is protected by a password, and by a code sent to your email when you sign in from a new device.

Who we share it with

Stripe (payments), our email provider (confirmations and reminders), and our hosting provider. Each has a contract with us that limits what they can do with the data. We share with the emergency services or safeguarding authorities if a child’s safety requires it. We never sell data.

How long we keep it

• Child records: deleted 12 months after your last booking, unless you keep your account open.
• Booking and payment records: 6 years, for tax, with child details removed after 12 months.
• Accident and incident records: until the child is 21, or 3 years after the incident if later, as required by insurers.
• Safeguarding records: in line with the Staffordshire Safeguarding Children Partnership’s retention guidance.

Your rights

You can see what we hold, correct it, download it, or ask us to delete it. You can delete your own account from within it. You can withdraw consent for medical notes or photos at any time, although without medical information we may not be able to accept a booking. You can complain to the ICO at ico.org.uk or on 0303 123 1113.

Cookies

This site uses no advertising or tracking cookies. Signing in sets one cookie that keeps you signed in.