Privacy notice

When you register a child, we ask for:

• About your child — their name, any name they prefer, date of birth, school and year group, and a photograph.
• About your family — your home address and postcode, who lives with the child, and contact details for parents, guardians and emergency contacts.
• Health and care needs — allergies, medical conditions, medication, special educational needs, dietary requirements, and your child’s GP surgery.
• Collection arrangements — a collection password and the names of people who may and may not collect your child.
• Permissions — your answers on photographs, sharing information with the school, outings and first aid.

Health information is “special category” data under UK GDPR. We collect it because we cannot keep your child safe without it, and we hold it on the basis that it is necessary to protect your child’s vital interests and to meet our safeguarding obligations.

Registering a child creates a contract between you and the club, and we need your child’s details to perform it — to know who is in our care, who may collect them, and what to do in an emergency. That is our lawful basis for the core record, so it is not something you can opt out of while your child attends.

The permissions we ask for are optional and are genuine choices: photographs, sharing information with your child’s school, taking your child on outings, and administering first aid. You can change any of them at any time, and saying no to any of them does not affect your child’s place.

Only JellyBeans staff whose email address is on our administrator list. Staff accounts are created by us — there is no public sign-up — and every view or change of a child’s record is logged against the member of staff who made it.

We use a small number of service providers to run the site: Convex (database and file storage), Vercel (hosting), Clerk (staff logins), YourMail (the emails we send you) and Sentry (error reports). We do not sell your data, and we do not use it for marketing.

• An unfinished registration is deleted automatically about five weeks after you start it, if you never complete it.
• A completed registration is kept while your child attends the club. When we remove a record, it is scheduled for permanent deletion 30 days later — that window exists so an accidental deletion can be undone.
• Deleting a record permanently removes the child’s photograph, medical and GP details, consents, collection arrangements and contact details.

You can view and change your own registration at any time — your address, contacts, your child’s medical details, GP, permissions and collection arrangements — at the edit page. Enter your email address and we will send you a link.

You also have the right to ask us for a copy of everything we hold about your child, to have it corrected, to have it deleted, and to object to how we use it. Ask a member of staff or email us and we will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

To be completed by the club: the registered name and address of the data controller, a contact email address for data protection requests, and the club’s ICO registration number.