Privacy Notice

This notice explains how Steps Systems Limited ("Steps", "we", "us") handles personal data across the Steps marketing website at stepsnursery.com and the Steps nursery management application (the "App") at app.stepsnursery.com.

We take your privacy seriously and process your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

Because the App is a multi-tenant system used by nurseries, there are different data protection roles to be aware of depending on the situation:

• When a nursery uses the App to record information about children, parents, staff, bookings, invoices and transactions, the nursery is the data controller of that information. Steps is the nursery's data processor: we store and handle the data on the nursery's instructions, and the nursery decides why and how it is used.
• When you sign up as a Steps customer, or we run our own business (billing, support, security), Steps is the data controller.
• When you visit the marketing website at stepsnursery.com and contact us through it, Steps is the data controller.

If you are a parent whose child attends a nursery that uses Steps, and you want to exercise your rights over your data (see section 5), you should contact the nursery first: they are the controller. We can only respond to individual requests where the nursery instructs us to.

2. Personal data we process

2.1 On behalf of nursery customers (as processor)

The App allows nurseries to record and process the following categories of personal data:

• Children: name, date of birth, dietary requirements, allergies and other medical information, room and key person, school and school year, funding code, attendance and booking records, invoice history.
• Parents and guardians: name, address, email, phone numbers, relationship to child, billpayer and emergency-contact flags, date of birth and National Insurance number (where the nursery records them).
• Emergency contacts: name and phone number.
• Nursery staff and users: name, email, role, hashed password, session and login activity.
• Financial: invoice records, bank transactions and cash transactions recorded by the nursery.

We process this data only on the nursery's instructions and for the purpose of providing the App to them.

2.2 As controller (relating to our own business)

• Customer account: the nursery's business name, address, primary contact name, email and phone.
• Billing: invoice records for our own charges to the customer, and payment references. Actual direct debit bank account details are held by our payment processor GoCardless, not by Steps.
• Support and communications: the content of emails and messages you send to us.
• Security and operations: server logs including IP addresses, browser type, and request details, retained for up to 90 days.

2.3 Visitors to the marketing website

• Contact form submissions: your name, email address, subject and message when you use the contact form or email us directly.
• Server logs: when you visit the site, our hosting provider records your IP address, browser type, pages viewed and the time of your visit. This is used for security and to keep the site running.

3. Why we process your data

As a processor for the nursery: because the nursery has instructed us to, in order to run its operations. The nursery is responsible for the underlying lawful basis (typically legitimate interests, contract, legal obligation, or vital interests, and the appropriate Article 9 condition where medical, dietary or allergy information is involved).

As a controller of our own business data: the lawful bases we rely on are:

• Contract: to provide the App to you and administer your Subscription.
• Legitimate interests: to keep the App and website secure, prevent fraud and abuse, respond to enquiries and support requests, follow up after enquiries, and improve our services.
• Legal obligation: to keep financial records required by UK tax and company law.

4. Who we share your data with

We share personal data with a limited set of trusted service providers acting as our sub-processors:

• Amazon Web Services EMEA SARL: hosting, database and file storage for the App, UK region (London / eu-west-2).
• Zoho Corporation B.V.: email inbox we use to receive and respond to customer and contact-form messages, EU region.
• Amazon Web Services (SES): outbound emails sent to parents on behalf of the nursery (invoice emails, notifications), UK region (eu-west-2).
• GoCardless Ltd: direct debit payment processing for our own Subscription Fees.
• Google Fonts and Tailwind CDN: used to load fonts and styling on the marketing website. When your browser loads these resources, your IP address is visible to those providers.

A live sub-processor list for the App is available at stepsnursery.com/subprocessors.

We do not sell personal data. We do not share it for advertising or marketing purposes.

5. Your rights

Under UK GDPR, you have rights to:

• Access a copy of your personal data.
• Rectify inaccurate data.
• Erase your personal data (subject to some exceptions).
• Restrict or object to processing.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent: where we rely on consent.

If you are a parent or child whose data is held by a nursery using the App, please contact the nursery first: they are the data controller and hold the primary responsibility for responding to your request. If they need assistance from us in order to respond, they will contact us.

If you are a Steps customer, a website visitor, or your request relates to our own business processing, email us at admin@stepsnursery.com. We will respond within one month.

6. Data retention

Data held on behalf of a nursery customer: retained for the duration of the Subscription. On termination we retain the data for up to 12 months (in case of reactivation), then permanently delete it from live systems within a further 30 days. Backups are purged in line with our backup rotation, and in any case within 12 months of live-system deletion. Nursery customers may request earlier deletion at any time, see the Terms of Service.

Our own business records: customer contact and billing records are retained for the duration of the Subscription and for 6 years after the last transaction, as required by UK tax law. Support correspondence is retained for up to 2 years after the last contact.

Website contact-form enquiries: up to 2 years from your last contact with us, then deleted.

Server logs: up to 90 days.

7. International transfers

The App and its primary storage sit in the UK (AWS London / eu-west-2). Some of our sub-processors are headquartered outside the UK. Where personal data is transferred outside the UK, we rely on adequacy decisions or the UK International Data Transfer Addendum with the EU Standard Contractual Clauses.

8. Security

We use appropriate technical and organisational measures to protect personal data, including:

• All web traffic encrypted in transit (TLS).
• Database in a private subnet with no public network access.
• Passwords stored hashed using industry-standard algorithms.
• Role-based access control within the App.
• Automated database backups with point-in-time recovery.
• Uptime monitoring and server logging.

9. Children

The App is designed for use by nursery businesses, not by children directly. It stores personal data about children as part of the nursery's operational records. The nursery is the controller of that data and is responsible for ensuring an appropriate lawful basis and Article 9 condition where the data is special-category (medical, allergy, dietary).

10. Cookies

The marketing website at stepsnursery.com does not set any first-party tracking or advertising cookies. Third-party services listed in section 4 (Google Fonts, Tailwind CDN) may set their own cookies or receive your IP address when your browser loads their content.

The App uses only essential session cookies required to keep you logged in and to protect against cross-site request forgery. It does not use analytics, marketing or advertising cookies.

11. How to contact us

Steps Systems Limited
36 Launde Road, Oadby, Leicester, Leicestershire, LE2 4HG
Company number: 16623592
ICO Registration reference: ZC226175
Email: admin@stepsnursery.com

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

13. Changes to this notice

We may update this notice from time to time. Material changes will be notified to customers by email. The "Last updated" date at the top will always reflect the most recent version.