Terms of Service

These terms form a legal agreement between you, the customer ("you" or "Customer"), and Steps Systems Limited, a company registered in England and Wales under company number 16623592, with its registered office at 36 Launde Road, Oadby, Leicester, Leicestershire, LE2 4HG ("Steps", "we", "us", "our").

By subscribing to the Steps service, you agree to these terms.

1. Definitions

• "Service" means the Steps nursery management software made available at app.stepsnursery.com and related APIs, mobile access and documentation.
• "Customer Data" means all data uploaded to, generated within, or transmitted through the Service by you or your Users, including data about children, parents, staff and financial transactions.
• "Subscription" means your right to access and use the Service under these terms.
• "Subscription Fee" means the monthly amount payable, as set out in section 5.
• "Effective Date" means the date on which you first subscribe to the Service.
• "User" means any individual you authorise to access the Service through your account (typically nursery staff).
• "UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law by virtue of the European Union (Withdrawal) Act 2018.

2. The Service

2.1 Steps provides multi-tenant nursery management software for managing children's records, bookings, registers, invoicing, transactions, parent communications and related administrative functions.

2.2 We grant you a non-exclusive, non-transferable, non-sublicensable licence to access and use the Service during the term of your Subscription, for your internal business purposes only.

2.3 We may improve, modify or add features to the Service at any time. We will not materially reduce core functionality without reasonable prior notice.

3. Your account

3.1 You must provide accurate registration information and keep it up to date.

3.2 You are responsible for all activity that takes place under your account, including all Users you authorise.

3.3 You must keep login credentials confidential and notify us immediately at admin@stepsnursery.com if you suspect unauthorised access.

3.4 You must ensure that all Users are trained appropriately and comply with these terms.

4. Customer responsibilities

4.1 You are responsible for the accuracy, quality and legality of Customer Data.

4.2 You are responsible for obtaining any consents or lawful bases required from data subjects (parents, staff, etc.) to enable you to enter their data into the Service.

4.3 You must comply with our Acceptable Use Policy.

4.4 You must comply with all applicable law in your use of the Service, including UK GDPR, the Data Protection Act 2018, the Childcare Act 2006 and safeguarding obligations.

5. Fees and payment

5.1 The Subscription Fee is £45 per calendar month, payable monthly in advance. Steps Systems Limited is not currently registered for VAT and no VAT is charged.

5.2 Payment is by GoCardless direct debit or bank transfer. Where you set up a direct debit, you authorise us to collect the Subscription Fee on or around the same day each month.

5.3 If a payment fails or is more than 14 days late, we may suspend access to the Service until payment is made. Repeated non-payment may lead to termination under section 7.

5.4 We may change the Subscription Fee by giving you at least 30 days' notice by email. If you do not accept the change, you may terminate under section 7 before the new price takes effect.

5.5 All payments are in pounds sterling.

6. Term

Your Subscription begins on the Effective Date and continues on a rolling monthly basis until terminated in accordance with section 7.

7. Cancellation and termination

7.1 You may cancel your Subscription at any time by emailing admin@stepsnursery.com. Cancellation takes effect at the end of the current paid month. No refunds are given for the remainder of a month.

7.2 We may terminate your Subscription:

• (a) with 30 days' notice by email for any reason;
• (b) immediately if you materially breach these terms and (where the breach is capable of remedy) fail to remedy it within 14 days of written notice; or
• (c) immediately if you become insolvent, enter administration, or cease to trade.

7.3 On termination:

• (a) your right to access the Service ends at the end of the current paid month (or immediately if we terminate for breach under 7.2(b) or 7.2(c));
• (b) you may request an export of your Customer Data in accordance with section 8;
• (c) accrued rights and liabilities survive.

8. Customer Data

8.1 Customer Data belongs to you. We claim no ownership of it.

8.2 We process Customer Data as your data processor in accordance with the Data Processing Agreement at Schedule 1 of these terms.

8.3 On termination and on request, we will provide an export of your Customer Data in the following formats:

• CSV for structured records (children, parents, bookings, transactions, users)
• PDF for invoices, limited to the most recent 12 months

Export requests must be made within 90 days of termination.

8.4 We will retain your Customer Data for up to 12 months after termination to allow for possible reactivation, after which it will be permanently deleted from live systems within a further 30 days. Backups containing your data are purged in accordance with our backup rotation, and in any case within 12 months of live-system deletion. We retain financial records relating to our billing of you for 6 years, as required by UK tax law.

8.5 You may request earlier deletion at any time by emailing admin@stepsnursery.com; we will action such requests within 30 days.

9. Acceptable use

You must comply with our Acceptable Use Policy at all times. Breach of the AUP is a material breach of these terms.

10. Intellectual property

10.1 We (and our licensors) own all rights in the Service, including software, design, documentation and trademarks. Nothing in these terms transfers those rights to you.

10.2 You retain all rights in Customer Data.

10.3 If you provide feedback or suggestions, you grant us a perpetual, royalty-free licence to use them.

11. Availability and support

11.1 We use commercially reasonable efforts to keep the Service available at all times. There is no formal service level agreement or uptime credit at this time.

11.2 We provide email support at admin@stepsnursery.com during Monday to Friday, 9am to 5pm UK time, excluding UK public holidays. We aim to respond within one working day.

11.3 Planned maintenance is normally carried out outside working hours and, where practical, we will give at least 24 hours' notice by email.

12. Warranties

12.1 We warrant that we will provide the Service with reasonable care and skill.

12.2 Except as expressly stated in these terms, and to the maximum extent permitted by law, all warranties, conditions and terms (whether express or implied by statute, common law or otherwise) are excluded, including any implied warranties of merchantability or fitness for a particular purpose.

13. Limitation of liability

13.1 Nothing in these terms excludes or limits either party's liability for:

• (a) death or personal injury caused by negligence;
• (b) fraud or fraudulent misrepresentation;
• (c) any other liability that cannot be excluded or limited under English law.

13.2 Subject to clause 13.1, and to the maximum extent permitted by law:

• (a) neither party is liable to the other for any loss of profits, revenue, business, anticipated savings, goodwill, or for any indirect or consequential loss;
• (b) each party's total aggregate liability arising out of or in connection with these terms in any 12-month period is limited to the total Subscription Fees paid by you to us in that period.

13.3 The limits in clause 13.2 do not apply to your obligation to pay Subscription Fees.

14. Indemnity

You will indemnify us against any losses, damages, costs and expenses (including reasonable legal costs) arising from any third-party claim relating to your Customer Data or your breach of these terms or the AUP.

15. Confidentiality

15.1 Each party will keep confidential all non-public information disclosed by the other party in connection with these terms.

15.2 This obligation does not apply to information that is or becomes publicly known through no fault of the receiving party, is independently developed, or is required to be disclosed by law.

16. Force majeure

Neither party is liable for any failure or delay in performing its obligations under these terms to the extent caused by events beyond its reasonable control, including internet outages, cyber-attacks affecting third-party infrastructure, natural disasters or government action.

17. Changes to these terms

We may update these terms from time to time. Non-material updates take effect on posting; material updates take effect on 30 days' email notice. Continued use of the Service after the effective date constitutes acceptance. If you do not accept a material change, you may terminate under section 7.

18. General

18.1 Notices. Notices must be sent by email, to you at the address on your account, and to us at admin@stepsnursery.com.

18.2 Entire agreement. These terms, together with the Schedules and Policies referenced in them, are the entire agreement between the parties on their subject matter and supersede any prior agreements or representations.

18.3 Assignment. You may not assign or transfer your Subscription without our written consent. We may assign these terms on notice to you, for example on a sale of our business.

18.4 No waiver. A failure or delay by either party to enforce any right under these terms is not a waiver of that right.

18.5 Severability. If any provision is held invalid or unenforceable, the rest continues in force.

18.6 No partnership. Nothing in these terms creates a partnership, joint venture or employment relationship.

18.7 Third-party rights. A person who is not a party to these terms has no rights under the Contracts (Rights of Third Parties) Act 1999.

18.8 Governing law and jurisdiction. These terms are governed by the laws of England and Wales. The English courts have exclusive jurisdiction to settle any dispute.

19. Contact

For any questions about these terms, contact us at admin@stepsnursery.com.

Schedule 1: Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Steps Systems Limited ("Processor") and the Customer ("Controller").

1. Definitions

Terms used in this DPA and not otherwise defined have the meanings given in the UK GDPR. In particular: "personal data", "process", "data subject", "controller", "processor" and "sub-processor".

2. Scope, roles and duration

2.1 The Controller instructs the Processor to process personal data on its behalf for the purpose of providing the Service under the Terms of Service.

2.2 This DPA applies for as long as the Processor processes personal data on behalf of the Controller in connection with the Service.

3. Subject-matter, nature and purpose of processing

3.1 Subject-matter: provision of the Steps nursery management software.

3.2 Nature of processing: storage, retrieval, display, generation of documents (invoices, registers, PDFs), transmission of emails to parents on behalf of the Controller, backup, and deletion.

3.3 Purpose of processing: enabling the Controller to run its nursery operations, recording children's attendance and care, invoicing parents, recording financial transactions, communicating with parents, and generating operational reports.

3.4 Categories of data subjects:

• Children attending the Controller's nursery
• Parents and guardians of those children
• Emergency contacts nominated by parents
• Staff members and other authorised Users of the Controller
• The Controller's own personnel who administer the account

3.5 Categories of personal data:

• Children: name, date of birth, dietary information, allergy and other medical information (where provided), key person, room, school, school year, funding code, attendance and booking records
• Parents/guardians: name, address, email, phone numbers, relationship to child, billpayer and emergency-contact status, date of birth and National Insurance number (where provided)
• Emergency contacts: name and phone number
• Users: name, email, role, hashed password, login activity
• Financial: invoice records, transaction records and bank account references recorded by the Controller (actual direct debit bank details for the Controller's Subscription with Steps are held by GoCardless, not by Steps)

3.6 Special category data: The Service allows the Controller to record medical, allergy and dietary information about children. Where such data is entered, it falls within the special categories under Article 9 UK GDPR. The Controller is responsible for identifying and satisfying an appropriate Article 9 condition for entering such data.

4. Processor obligations

The Processor will:

4.1 process personal data only on documented instructions from the Controller (which include the Terms of Service, this DPA, and use of the Service by the Controller's authorised Users), unless required to do otherwise by UK or EU law;

4.2 ensure persons authorised to process the personal data are under an obligation of confidentiality;

4.3 implement appropriate technical and organisational measures to protect personal data, as set out in Annex 1 to this DPA;

4.4 taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling requests from data subjects exercising their rights under UK GDPR;

4.5 assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments, prior consultation);

4.6 at the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of services, and delete existing copies unless UK or EU law requires storage (see section 8 of the Terms of Service for retention detail);

4.7 make available to the Controller all information necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits, as set out in clause 11 of this DPA.

5. Sub-processors

5.1 The Controller grants a general authorisation to the Processor to engage sub-processors. The current list of sub-processors is published at stepsnursery.com/subprocessors and updated as changes occur.

5.2 The Processor will inform the Controller of any intended addition or replacement of sub-processors, giving the Controller at least 14 days' notice by email to object.

5.3 If the Controller reasonably objects to a new sub-processor on data protection grounds, the parties will discuss in good faith. If no resolution is reached, the Controller may terminate its Subscription without penalty by giving notice before the new sub-processor is engaged.

5.4 The Processor will impose data protection obligations on each sub-processor equivalent to those set out in this DPA.

5.5 The Processor remains liable for the acts and omissions of its sub-processors.

6. Data subject rights

6.1 The Processor will notify the Controller without undue delay of any request received directly from a data subject (access, rectification, erasure, restriction, portability, objection).

6.2 The Processor will not respond to such requests directly except on the Controller's documented instructions.

6.3 To the extent the Controller cannot itself address a data subject request through the Service's built-in functionality, the Processor will provide reasonable assistance.

7. Personal data breach

7.1 The Processor will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller's personal data.

7.2 The notification will include, to the extent known: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed.

7.3 The Processor will cooperate with the Controller in investigating and remediating the breach.

8. Data protection impact assessments

The Processor will provide reasonable assistance to the Controller with any data protection impact assessments and prior consultations with the ICO required under Articles 35 and 36 UK GDPR, taking into account the nature of the processing and the information available to the Processor.

9. International transfers

9.1 The Processor primarily processes personal data within the UK, on infrastructure hosted in London (AWS eu-west-2).

9.2 Where personal data is transferred outside the UK to sub-processors, the Processor will ensure that appropriate safeguards are in place, including the UK International Data Transfer Addendum together with the EU Standard Contractual Clauses, or reliance on an adequacy decision.

9.3 The current list of sub-processors (clause 5.1) identifies the country of the processing operations.

10. Deletion or return of data

10.1 On termination of the Terms of Service, the Processor will delete personal data in accordance with section 8 of those Terms.

10.2 On written request from the Controller, the Processor will provide the Controller with a copy of the personal data before deletion, in the formats set out in section 8 of the Terms of Service.

11. Audit

11.1 The Processor will, on reasonable written request and no more than once per calendar year (except in the event of a personal data breach or regulatory investigation), make available to the Controller information reasonably necessary to demonstrate compliance with this DPA.

11.2 Physical, on-site audits are not offered by default given the multi-tenant infrastructure. In place of on-site audits, the Processor will provide reasonable written responses to security questionnaires.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.

13. Order of precedence

If there is any inconsistency between the Terms of Service and this DPA in relation to the processing of personal data, this DPA prevails.

Annex 1: Technical and Organisational Measures

Infrastructure and hosting

• Hosting on Amazon Web Services (AWS) in the London (eu-west-2) region.
• Database: Amazon RDS MySQL, private subnet, no public network access, automated 7-day point-in-time backups.
• Application server: EC2 instance behind nginx, with HTTPS enforced via Let's Encrypt certificates (auto-renewing).
• Regular platform-level security patches applied by AWS.

Access control

• Role-based access within the application (super_admin, admin, user).
• Session-based authentication with CSRF protection on state-changing requests.
• Administrative access to production infrastructure limited to Steps personnel using SSH keys.
• Database not publicly accessible; direct access is via SSH tunnel through the application server only.

Encryption

• All web traffic encrypted in transit using TLS 1.2 or higher.
• Passwords stored hashed using industry-standard algorithms.
• Backups encrypted at rest.

Monitoring and availability

• External uptime monitoring on the application's health endpoint.
• Server logs retained for security and operational monitoring.

Backup and recovery

• Automated daily database backups with 7-day retention (RDS automated backups).
• Application code and configuration reproducible from source control and container registry.

Confidentiality

• All persons with access to personal data are bound by written confidentiality obligations.

Sub-processors

• Contractual data protection obligations with all sub-processors.

Change control

• Application changes deployed via a controlled build-and-deploy pipeline.

Deletion

• Customer Data deleted on request or on the expiry of the retention period set out in the Terms of Service.