Privacy notice

Happy Little Guests is an event crèche for weddings and corporate events, run by Charlotte Pennington as a sole trader. Charlotte Pennington trading as Happy Little Guests is the controller of your personal information: she decides how it is used and is responsible for keeping it safe. In this notice “we”, “us” and “our” mean Charlotte Pennington trading as Happy Little Guests.

Controller

Charlotte Pennington trading as Happy Little Guests

Based in

Redditch, Worcestershire. Our full postal address is on every booking agreement and invoice, and we will give it to anyone who asks.

Email

hello@happylittleguests.com

Website

happylittleguests.comhappylittleguests.co.uk redirects here.

This notice covers everyone whose information we handle: clients who enquire or book, parents and guardians who register a child, the children themselves, other adults named to us (such as emergency contacts and venue contacts), carers who work with us, and anyone who visits this website or emails us. As a small business we have not appointed a data protection officer; Charlotte deals with privacy questions herself.

If you enquire or book (clients)

• Enquiry: your name, email address and phone number (optional), the type of event, its date and how many hours you need, the venue's name and postcode, how many children are coming in each age group, and any notes you add. We save this with the quote the calculator produced.
• Booking: any changes agreed when Charlotte speaks to you, your booking reference, invoices, the payments you make, and a copy of the emails we send about your booking (who they went to, when, and what they said).
• Booking agreement: when you sign online you give us your address and phone number, the venue's street address and the time our carers should arrive, and we record the name you type, the date and time, and the IP address of your connection, and we keep a signed PDF copy.
• Questionnaire: timings for the day, details of the room and parking, the name and mobile number of the venue's contact and of someone we can call if we cannot reach a parent, how many children are coming and their ages, and anything else you tell us. It does not ask about any child's health: each parent gives us that when they register their own child.

If you book for a company or organisation, we collect the same details from the person making the booking.

About children, from their parents

A parent or guardian registers each child with a short form. We ask for:

• the child's full name and date of birth;
• allergies, dietary needs, medical conditions we should know about, additional needs and what helps, and their routine (naps, nappies, comforters and what settles them);
• whether to keep the child out of all photos and videos;
• anything else the parent would like us to know.

We never collect information directly from children. On the day we also keep a register of when each child arrives and is collected, and a record of any accident or incident.

About parents and other trusted adults

• the parent or guardian's name, mobile number and (optionally) email address;
• a second emergency contact's name and mobile number;
• the names of any other adults allowed to collect the child, and a collection password.

If you give us someone else's details, please let them know and point them to this notice.

Where the information comes from

Most of it comes from you. A child's registration details, and the parent, emergency and collection contacts, come from the child's parent or guardian. The children expected, the venue contact and the day contact come from the person who booked, through the questionnaire. Payment details come from our bank, and carers give us their own details.

Payments

We are paid by bank transfer only and never take or see card details. Our booking system connects to our own Monzo bank account through Monzo's API so it can match payments to invoices. For each payment into the account it saves the amount, the date, the payer's name as the bank shows it, and the payment reference and description. It does not store your account number or sort code. Because the connection reads every incoming payment, this includes payments that are not for a booking.

Carers who work with us

Your name, email address and phone number; whether you are a lead carer; whether you hold a paediatric first aid certificate and when it expires; your DBS certificate number and issue date and whether you use the DBS Update Service; whether you are qualified to care for under 2s; the shifts you claim and when, with the pay for each; and records of when you sign in. Our system does not store a copy of your DBS certificate or what it says. When you take a shift, other carers who look at that event can see your name.

When you visit the website or email us

• Our hosting provider processes your IP address and basic technical details (such as your browser type) to deliver pages and keep the service secure.
• When you type the venue postcode into the quote form, and again when you send an enquiry, our server sends that postcode (or the part you have typed so far) to postcodes.io, a free postcode lookup, to suggest postcodes and work out the travel distance. Nothing else is sent, and your browser does not contact it directly.
• If you email us, we keep your message and our reply.
• We do not use analytics, advertising or tracking tools of any kind.

The law says we must have a valid reason, called a lawful basis, for each way we use personal information. Ours are:

Giving you a quote and replying to your enquiry

Steps you asked us to take before entering into a contract (UK GDPR Article 6(1)(b)).

Confirming and running your booking: the agreement, invoices, payments, questionnaire and emails about the event

Contract (Article 6(1)(b)). If you book for an organisation, our legitimate interests (Article 6(1)(f)) in dealing with its representative.

Recording your name, the time and your IP address when you sign

Contract, and our legitimate interests in being able to show who agreed the booking and when.

Children's names, dates of birth, everyday routines and photo preferences

Legitimate interests: caring for each child safely and in the way their parent has asked.

Parents' contact details, emergency contacts, authorised collectors and collection passwords

Legitimate interests in keeping children safe and handing each child only to the right adult. In an emergency, vital interests (Article 6(1)(d)).

Children's health and dietary information

Legitimate interests in caring for each child safely, together with the parent's explicit consent, and vital interests in an emergency. See section 4.

The sign-in register, accident and incident records, and safeguarding concerns

Legitimate interests in keeping children safe and keeping proper records, and legal obligation (Article 6(1)(c)) where the law requires us to report or keep something. Where we must share a safeguarding concern, we rely on the safeguarding condition in the Data Protection Act 2018.

Notifying Ofsted before an event

Legal obligation (Article 6(1)(c)) under the Childcare (Exemptions from Registration) Order 2008.

Matching bank payments to invoices

Legitimate interests in knowing who has paid, and legal obligation to keep accounts.

Keeping accounts and tax records

Legal obligation (Article 6(1)(c)).

Offering shifts to carers, checking qualifications and DBS details, and paying them

Contract with the carer, and legitimate interests in making sure everyone who works with children is suitable. Where DBS details count as criminal offence data, we use them only under a condition in Schedule 1 to the Data Protection Act 2018.

Photos at our events

Legitimate interests in showing our work. You can object at any time, and parents can opt out at registration. See section 6.

Running and securing the website, and staff sign-in

Legitimate interests in a secure, working website.

Answering emails

Legitimate interests, or contract when it is about your booking.

Where we rely on legitimate interests, we have weighed our interests against yours and only use the information in ways you would reasonably expect. We do not send marketing emails, and we never sell personal information.

Allergies, medical conditions, additional needs and some routine details are health information, and a dietary need (for example halal or kosher) can reveal a family's religion. The law calls these special category data and gives them extra protection. We use them only to care for the child safely on the day.

• Explicit consent (UK GDPR Article 9(2)(a)), given by the child's parent or guardian by ticking the consent statement on the registration form, which cannot be sent without it. You can withdraw it at any time by emailing hello@happylittleguests.com.
• Vital interests (Article 9(2)(c)) if there is an emergency and we need to give a child's medical or allergy information to paramedics or a hospital before a parent can be asked.
• Legal claims (Article 9(2)(f)) for any health details recorded in an accident or incident record.

The questionnaire filled in by the person who booked asks only how many children are coming and their ages, never about their health. Allergies, medical and additional needs come only from each child's own parent, at registration.

Our staff do not give medication. The only exception is an emergency auto-injector (such as an EpiPen) that a parent has provided, shown us how to use and recorded at registration.

• Children's details come from their parent or guardian, never from the child. The person who booked may also tell us the names and ages of the children expected.
• Only Charlotte, anyone helping her run the business, and the carers working at that event can see a child's registration details, and only so they can care for the child on the day.
• The person who booked the crèche can see the name and age of each registered child and the name of the parent who registered them, so they can check everyone is registered. They cannot see contact details, health information or collection passwords.
• The registration link is private to each event. Anyone with the link can register a child, so please share it only with the families coming to the event.
• We never use children's details for marketing and never sell them, and we delete registration details 30 days after the event (see section 9).
• Children have the same rights over their information as adults. A parent or guardian can use those rights for a young child; older children can ask us themselves.

We take photos and short videos at our events to show what we do, and may use them on our website and social media.

• We never show a child's face: children are photographed from behind, from a distance, or with faces out of shot.
• We never use children's names.
• Parents can tick a box at registration to keep their child out of every photo and video, and we will.
• We are happy to share event photos with the client afterwards.
• Photos we prepare for our social media are stored on our system only until they are posted (deleted the next day at the latest, or after 14 days if never posted), with any location details removed. Before posting, our AI assistant checks each one for a visible child's face.

If you change your mind after the event, email hello@happylittleguests.com and we will stop using any photo your child appears in.

We share personal information only where we need to, and never sell it or share it for marketing.

People involved in your event

Carers working the event

The registration details they need to look after each child on the day. Carers who have not taken a shift see only the date, times, area and the number and ages of children, so they can decide whether to work it. The full venue address is shown only once a carer holds a shift.

The person who booked

The name and age of each registered child and who registered them, as explained in section 5.

Ofsted

Before most events we email Ofsted the notification the law requires. It contains our own business details, the venue's name and address, and the date, times and type of event. It does not include clients' or children's names or details. Ofsted's own privacy notice explains how they use it.

Emergency services, the police or children's services

Only when a child's safety or the law requires it, for example calling 999 or reporting a safeguarding concern.

Our insurer and professional advisers

Only if there is an incident, a claim or a legal question that needs it.

HMRC, courts and other public bodies

Only where the law requires us to share information.

Service providers who handle information for us

These companies store or send information on our behalf. Monzo is also our bank, so it handles payment information under its own privacy notice as well.

Railway

Hosts this website, the booking system and its database.US company. Servers in the US East region (Virginia, USA).

Resend

Sends our emails, including quotes, agreements, invoices and sign-in links.US company.

Namecheap

Our domain registrar and DNS provider. It forwards email sent to our address to our inbox.US company.

Google (Gmail)

Our business inbox, where forwarded emails and copies of booking emails are kept.US company.

Monzo

Our bank. The booking system reads incoming payments from our account through Monzo's API to match them to invoices.UK bank.

Anthropic

Its AI (Claude) helps write our social media posts and checks our event photos for visible children's faces before we post them. It does not use them to train its models.US company. Receives only the photos and words of posts we are preparing.

Meta (Instagram and Facebook)

Where we publish our social media posts, including event photos that never show a child's face.US company. Receives only what we choose to post.

postcodes.io

Suggests postcodes as you type and looks up the venue postcode to work out travel distance.Receives the postcode, or the part typed so far, from our server only.

Our website and database are hosted by Railway on servers in the United States (Virginia). Railway, Resend, Namecheap, Google, Anthropic and Meta are US companies, so your information is transferred to, or can be accessed from, the United States.

When personal information leaves the UK we make sure it stays protected:

• where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK's adequacy regulations for that framework;
• otherwise, we rely on the provider's data protection terms, which include the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Email hello@happylittleguests.com if you would like more detail about these safeguards.

Enquiries that do not become bookings

12 months from the enquiry.

Booking, invoice and payment records, including bank payment details

6 years after the end of the financial year they relate to, to meet tax and accounting rules.

Signed booking agreements

6 years after the event.

Child registration details (including health information), collection passwords, the sign-in register and the event questionnaire

Deleted 30 days after the event, unless something is needed for an accident or incident record.

Accident and incident records

As long as the law requires. For an injury to a child this is usually until the child turns 21, because the time limit for a claim runs until 3 years after their 18th birthday.

Carers' records

For as long as you work with us, plus 6 years.

Emails

For the same period as the record they relate to.

Staff sign-in

Sign-in links expire after 15 minutes. A signed-in session lasts up to 30 days, or until you sign out.

Photos

For as long as we use them, unless you ask us to stop.

When a period ends we delete the information or make it anonymous.

• Every page and form is sent over an encrypted (HTTPS) connection.
• The booking agreement, questionnaire and registration pages are reached through private links containing a long random code that cannot be guessed.
• Staff sign in with single-use email links that expire after 15 minutes, and we store sign-in codes and sessions only in scrambled (hashed) form.
• Access is limited by role. Only Charlotte, and anyone helping her run the business under her instructions, can see the whole booking system. Carers see only what they need for the events they work.
• We never take card payments, so we never hold card details.
• If there is a data breach, we will report it to the ICO within 72 hours where the law requires, and tell you without delay if it puts you at high risk.

You have the right to:

• access your information and get a copy of it;
• rectification: have inaccurate or incomplete information corrected;
• erasure: ask us to delete it;
• restriction: ask us to limit how we use it;
• object to us using it where we rely on legitimate interests, including for photos;
• portability: receive information you gave us under a contract or with your consent in a common electronic format, or have it sent to someone else;
• withdraw consent at any time, without affecting anything we did before you withdrew it.

Some rights have limits. For example, we cannot delete booking and payment records that tax law requires us to keep, and we may not be able to look after a child safely without their registration details.

If you are unhappy with how we have handled your information, please tell us first at hello@happylittleguests.com so we can put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time:

Online

ico.org.uk/make-a-complaint

Helpline

0303 123 1113

• Clients: we need your name, email address, the event details and the venue postcode to give you a quote, and the details in the booking agreement to take a booking. Your phone number and notes are optional.
• Parents: the starred fields on the registration form (your child's name and date of birth, your name and mobile, a second emergency contact and a collection password) are needed for us to care for your child, and we may have to decline a child whose registration is missing. The other fields are optional, but please tell us anything that affects your child's safety, especially allergies.
• Ofsted notification is a legal requirement for most bookings, so we cannot take those bookings without sending it.
• Carers: we need your contact details, qualifications and DBS details before you can work with children.

We do not make decisions about anyone by automated means alone, and we do not profile anyone. The quote calculator only works out a price from the hours, children and distance entered; Charlotte reviews every enquiry personally and decides whether to confirm it.

We do not use analytics, advertising or tracking cookies, so you will not see a cookie banner here. We use only these cookies, and none is ever set for clients, parents or other visitors:

hlg_session

Keeps staff and administrators signed in. It is set only when someone signs in to the staff area, never for clients or parents.

Strictly necessary, secure and not readable by scripts. Lasts up to 30 days, or until you sign out.

monzo_oauth_state

Set only when an administrator connects our bank account to the booking system, to check that the bank's reply is genuine.

Strictly necessary and not readable by scripts. Deleted once the connection completes, and expires after 10 minutes in any case.

facebook_oauth_state, instagram_oauth_state

Set only when an administrator connects our Facebook Page or Instagram account, to check that Meta's reply is genuine.

Strictly necessary and not readable by scripts. Deleted once the connection completes, and expires after 10 minutes in any case.

Because these cookies are strictly necessary for a service the user asks for, the law (the Privacy and Electronic Communications Regulations) does not require consent for them. Our fonts and images are served from our own website, so your browser does not contact Google or any other third party when you visit.

Counting visits. To see which pages help people and where they found us, our own website counts visits without cookies and without storing anything on your device: the page, how long it was open and how far down it was scrolled, the website or link that brought you (for example Instagram or a Google search), the type of device, and the town your internet connection appears to be in. Your IP address is used for a moment to estimate that town and to tell visits apart within a single day, then thrown away; it is never stored, and the code we count visitors with changes every day, so we cannot recognise you from one day to the next or work out who you are. Nothing goes to Google or any other third party, and visits are deleted after 13 months. If you ask us for a quote, we note which of these sources the enquiry came from. We do not count visits when your browser asks sites not to track you (Do Not Track or Global Privacy Control), and you can turn counting off for this browser here:

We review this notice whenever the way we use information changes, and the date at the top shows when it was last updated. If we make a significant change that affects a booking you have with us, we will tell you by email. Our terms explain how bookings work.