Privacy Policy

This privacy policy explains what personal information we collect from you, how we use it and what your rights and options are. It includes the following information:

How to contact usNipperbout’s responsibilitiesYour rightsHow we collect your personal informationWhy we collect your personal informationWhat personal information we collectHow we share your personal informationHow we store your personal informationHow you can access, correct and delete your informationUse of Data ProcessorsNon-personal information collected automaticallyCookies, analytics and web storage

Policy overview

General information

Nipperbout is committed to safeguarding your privacy. If you’ve trusted us with your personal information we promise to treat it respectfully and in accordance with the General Data Protection Regulation (GDPR). This privacy policy explains when and why we collect personal information from you, how we use it, the limited conditions under which we may disclose it to others and how we keep it secure.

Our Privacy Policy and procedures are reviewed annually and updates are communicated to all relevant parties via our website, employee training days and the Staff News page in the Purple People section of our website.

This policy was last updated in September 2018.

Nipperbout’s Privacy Policy is printed and made available onsite at each setting. An electronic copy has been made available on this page.

Nipperbout’s Privacy Policy is aimed at external parties only, ie. service users (clients/parents/children), suppliers etc. Nipperbout’s Privacy Policy for Employees covers our internal processes. Our Privacy Policy for Employees forms part of their induction pack and a copy can be found onsite at every setting in the Purple People folder.

Applicants seeking to be employed by Nipperbout will be covered under this Privacy Policy until such time as an offer of employment is made when they will then fall under the Privacy Policy for Employees.

Contacting us

If you wish to contact us you can call us on +44 (0)1296 712 658, e-mail us at or contact us by post at Six Lords, Buckingham Road, Singleborough, Bucks, MK17 0RB.

Nipperbout’s responsibilities

Nipperbout’s Privacy Policy is subject to the laws relating to the Data Protection Act (DPA) 2018, Freedom of Information Act 2000, Privacy and Electronic Communication Regulation (PECR) and General Data Protection Regulation (May 2018). We understand the importance of confidentiality surrounding personal information and acknowledge the rights of individuals to have access to this information and ‘the right to be forgotten’.

Nipperbout is registered with the Information Commissioner’s Office.

Nipperbout is a Data Controller which means we determine the purposes and means of processing your personal information.

Parents and employees are welcome to view our policies and procedures upon request. A copy is held on site at every setting. Event Managers are on hand to explain any of our operating procedures if required or parents can contact the company Directors for further information.

Nipperbout collects and processes personal information in order to comply with our legal obligations (for example to OFSTED and child protection). We seek consent from individuals before processing their personal information and maintain transparency about how this information is used, retained and shared.

Nipperbout has clear procedures for identifying, recording, reporting and managing any personal data-breaches. We understand our duty to report certain breaches to the ICO and to the individuals involved.

Your rights (these are applicable to both adults and children)

Right to be informed

Individuals have the right to be informed about the collection and use of their personal information. We must inform you as to our reasons for collecting your personal information, how long we store it for and who we will share it with.

For further information about your right to be informed please visit

Right of access

Individuals have the right to access their personal information.

You may request copies of information we hold about you either verbally or in writing. We must respond to you without undue delay and in any event within one month.

For further information about your right to see copies of data held about you please visit

Right to rectification

Individuals have the right to ensure that inaccurate personal information held about them is rectified or completed if it is incomplete.

You can make a request for this to be done verbally or in writing. We must respond to you in one calendar month.

If you request inaccurate information to be rectified and/or incomplete information to be completed, Nipperbout must take reasonable steps to inform others we have disclosed this information to, expect where this would be impossible or involve disproportionate effort.

For further information about your right to correct your data please visit

Right to erasure

Individuals have the right to have their personal information erased. This is also known as ‘the right to be forgotten’.

You can make a request for us to delete your information verbally or in writing. We must respond to you in one month of your request.

Your right is not absolute and only applies in certain circumstances. Please be aware Nipperbout is bound by Ofsted Regulations which may override this right in some instances.

For further information about your right to have your data deleted please visit

Right to restrict processing

Individuals have the right to restrict or suppress the use of their personal information. This right is not absolute and only applies in certain circumstance.

You may make a request to restrict the processing of your information verbally or in writing. We must respond to you in one calendar month.

For further information about your right to limit how organisations use your data please visit

Right to data portability

Individuals have the right to obtain and reuse their personal information for their own purposes across different services. This allows you to move, copy or transfer personal information easily from one IT environment to another, safely and securely, without affecting its usability.

This right only applies to information you have provided to us and which is held electronically. It does not apply to paper files.

We will provided personal information in a structured, commonly used and machine readable format.

We will respond to requests for data portability within one month.

For further information about your right to data portability please visit

Right to object or withdraw consent

Individuals have the right to object to the processing of their personal information including an absolute right to stop their data being used for direct marketing.

Individuals have the right to withdraw consent at any time. For example, if you have given consent for Nipperbout to send you marketing material, you can choose to stop receiving this at any time.

You may make an objection and/or withdraw consent verbally or in writing. We must respond to you in one calendar month.

For further information about your right to object to the use of your data please visit

Rights related to automated decision-making including profiling

Automated decision-making refers to decisions made without human involvement, i.e solely by automated mean.

Profiling is the automated processing of personal information to evaluate certain things about an individual. This may be part of an automated decision-making process.

Your rights relating to automated decision-making are covered by Article 22 of the GDPR and we must inform you if any way we process your information falls under Article 22. At present, Nipperbout does not use automated decision making or profiling.

For further information about your rights relating to decisions being made about you without human involvement please visit

Right to complain

Individuals have the right to lodge a complaint with the supervising authority.

You may make a complaint to Nipperbout using the same contact details listed under Contacting us

You may make a complaint about Nipperbout to the Information Commissioner’s Office
+44 (0)303 123 1113

You may make a complaint about Nipperbout to OFSTED
+44 (0)300 123 4666

A note of the rights of individuals under the age of 18 years

All data subjects, including those under 18 years old, share the above listed rights. Young People may exercise these rights on their own behalf as long as they are competent to do so.

The GDPR recognises that children aged 16 years and over are capable of giving consent and under this age consent of the parent is required, however the Data Protection Act 2018 reduces the age of consent to 12 years in Scotland and 13 years in England, Wales and Northern Ireland. It is presumed that children ages 12 or 13 years, respectively, are of sufficient age and maturity to exercise their data protection rights, unless otherwise is shown.

Where a company deems a person under the age of 18 years competent to provide consent on their own, it is reasonable to assume the person is also competent to exercise their own data protection rights.

Nipperbout requires parents/carers (over the age of 18 years) to be responsible for giving consent and providing personal information on behalf of children (under the age of 18 years) who use our services and settings.

Nipperbout respects the data protection rights of individuals under the age of 18 years and will treat requests and objections or complaints made by children or young people, with the same importance as those made by an adult.

How we collect your personal information

Nipperbout may collect information about you in the following ways:

  1. Personal information you voluntarily provide to us, for example information you input onto our Online Registration System form or by phone/email.
  2. Personal information Nipperbout observes or is verbally given by you or your child whilst attending our setting, for example in relation to the EYFS, child protection, medical needs, emotional wellbeing, baby needs etc.
  3. Non-personal information collected automatically by the website

Nipperbout records and stores personal information about you when you contact us by phone, post, e-mail or our using online contact form and when you subscribe to our newsletter. We may also do so after you message us on social media or through other channels.

Why we collect your personal information (how it’s used & legal basis for processing)

Nipperbout is regulated by Ofsted therefore we have developed this policy and our procedures in line with Ofsted regulations and best practice guidance.  Ofsted regulations dictate what information we collect and how long it should be stored.

We collect personal information about you to:

  • reply to you in person when you’ve asked us to, or when it seems appropriate
  • if you’ve agreed, to email you about our services we think may be of interest to you
  • to allocate a place for your child/ren at a Nipperbout setting
  • to assign an appropriately skilled/qualified Purple Person (Nipperbout staff member) to care for your child
  • to care for and accommodate the needs of your child/ren, including putting additional measures in place where necessary (for example ordering a dairy free meal or sourcing particular equipment)
  • to engage additional services, facilities or skilled personnel to care for or accommodate the needs of your child (for example an NHS nurse or to arrange a break-out room)
  • to complete reports, such as accident, incident or child protection reports when required
  • to keep a record of any intimate care Nipperbout Purple People have given to your child, for example nappy changes, toilet assistance or first aid in order to safeguard your child and our employees
  • to contact you and/or the third-party contacts you provide during an event in an emergency or if you child is not collected
  • to contact you during or after an event, in relation to the event your child attended, for example if your child is unwell or if you/your child has left a personal possession a tour setting
  • to contact your child’s school, at your request, to assist with obtaining ‘authorised absence’ for your child, to support with homework and/or to gain a base line for children within the Early Years Foundation Stage.

What personal information we collect

Nipperbout collects, shares and stores your personal information in line with Ofsted Regulations and Child Protection laws. Additional data, not dictated by Ofsted, may be collected, shared and stored in order to help Nipperbout provide the best possible care for your child, for example, if your child is feeling upset due to a recent bereavement, when they arrive at our setting this will be recorded on their Communication Booklet and shared with their Key Worker. By giving us this information you agree that we may store it on our systems. We collect the following information:

From our websites

Our contact form on our website asks for your name and e-mail address. You may choose to provide us with you telephone number and/or other details about you / your event / your child in your message.

Our website will note your computers IP address.

When you use a contact form on our website, your submitted details are also saved on the servers of our hosting partners, Webflow and Majichost. We control that data in our account and can respond in the same way as described in the section ‘how you can access, correct and delete your personal information’. Details about Webflow’s or Majichost’s data processing can be found in their Privacy Policy.

From the Online Registration System website

Account login – your full name, email, personal password

Your device – our website automatically detects what device you are using so you can view our site in the best possible layout.

From the Online Registration System form (on the above website)

About you – Title, full name, email address, telephone numbers, statement of legal responsibility for each child registered, relationship to each child.

Your child – Full name, date of birth, gender, address, home telephone, medical information, dietary information, details of special educational needs, details of additional needs (including baby needs)

Third parties – Emergency contact name, number and relationship to child, name and number of the child’s legally responsible adult (if different to registrant), doctors name, number and surgery address, child’s school, number and email address.

The above information is stored on your account. Each time you register for a new event you will be asked to choose which child/ren you wish to register for this event. This means only personal information belonging to the child/ren you have chosen will be visible for this event.

Consents and permissions – We will ask you to complete consents and permissions each time you register for an event. These consents and permission are only stored in relation to the event, not your account.

Admission criteria – The admission criteria for an event is set by the event organiser (not by Nipperbout). This criteria will vary for each event but may include requests such as your union membership number and details about who you will be attending the event with. You will always be asked to confirm that you have read the Nipperbout terms and conditions and whether you have legal responsibility for the child/ren you are registering. This information is shared with the event organiser (see ‘how we share your information’ for more details). Please contact your event organiser for information about how they set & use the admission criteria.

Consents – You will be required to indicate yes, no or not applicable for a variety of statements. Each request details exactly what we are asking you to give consent for, for example the ability for Purple People to administer first aid to your child/ren if required.

From the Child Registration Card (printed document)

The printed Child Registration Card contains all information provided by you on the Online Registration System form. A copy of the Consents (not the Admission Criteria) is also included on the print out.

If you have not [fully] completed the Online Registration System form, you will be asked to complete all sections of the Child Registration Card when you arrive at the Nipperbout setting. There is also space for you to provide additional information you think will help Purple People care for your child.

There is a space to provide the name of any other people whom you give permission to collect your child on your behalf (a first name only, is acceptable).

Nipperbout requires a password to be recorded on the card and will ask for this password to be given verbally when you or anyone else comes to collect your child.

There is a Record of Attendance on the card which you will be required to sign each time you drop off or collect your child. This includes the date, time and your signature. Any other person dropping off or collecting your child on your behalf will also be required to provide their signature on this record.

Please note as the Record of Attendance is on the back of the Child Registration Card, any adults given permission by you to sign your child/ren in or out of Nipperbout’s care will have access to the information on the Child Registration Card and may also be shown your child/ren’s Communicate Booklet.

From the Communication Booklet (printed document)

Your child’s Communication Booklet contains the following personal information retrieved from information provided by you on the Online Registration System form

  • full name
  • the event they are attending
  • your telephone number (mobile at event)
  • baby needs (where applicable)
  • medical needs
  • special education needs
  • additional needs
  • dietary requirements
  • any other usual full information you have provided

If you have not [fully] completed the Online Registration System form, you will be asked to complete all sections of the Communication Booklet when you arrive at the Nipperbout setting.

Once at the event you will be given the opportunity to add further information about your child that may be useful for their Key Worker to know (e.g: favourite toys, recent bereavement, homework to be completed).

If your child is in the Early Years Foundation Stage (EYFS) you will be asked to provide information about their skills and abilities to help their Key Worker plan for and record their learning and development during their stay with Nipperbout.

If your child is a baby or toddler their Key Worker will record information about their feeds, sleeps and toileting during their time with us.

For all ages of children, Key Workers will use the Communication Booklet to note down information about the activities your child enjoyed and/or their emotional wellbeing during the day.

Children are encouraged to use the communication booklet to write their own notes/thoughts/feelings too.

From our Job Application forms

Nipperbout operates a robust recruitment procedure in line with Safer Recruitment guidelines, ACAS, child protection laws, Ofsted regulations and The Employment Practices Code published by the Information Commissioner.

Nipperbout has a four-stage recruitment process. Stages one, two and three require applicants to provide minimal personal information which is used for contacting candidates (i.e full name, e-mail and contact numbers). In line with recruitment guidance, the application form given at stage two asks candidates to detail the last 5 years of their employment history and to explain any gaps in employment.

The contact details, application form and interview notes of unsuccessful candidates who do not reach stage four of our recruitment process will be kept for 6 months and then destroyed.

Once candidates reach stage four (employment offer) of our recruitment process they will fall under Nipperbout’s Privacy Policy for Employees. In summary:

  • Personal information relating to candidates who reach stage four but a) are unsuccessful, b) choose to withdraw or c) never start work, will be kept for 12 months
  • Personal information relating to employees (i.e a person who works for Nipperbout for one or more days) will be kept for 6 years following their leaving date.

How we share your personal information and with whom

Nipperbout Purple People and Agency Creche Workers

All Purple People/Agency Creche Workers working at the specific event your child/ren are attending, will have access to your child/ren’s Child Registration Card and associated lists (such as the Key Needs list). The Key Needs list is sent to these individuals in advance of the event, via an encrypted and password protected email. This is so they can familiarise themselves with the names and needs of their Key Children. At large events Purple People/Agency Creche Workers are sent individual Key Needs lists which only include the details of the children in their Key Group. At smaller events, where the team is more likely to share responsible for the care of all children, Purple People/Agency Creche Workers may be sent a Key Needs list containing information about all the children attending that event. Purple People/Agency Creche Workers are required to sign a declaration confirming that they will not share or copy this information and they will delete the Key Needs list file (and any other documentation) from all their devices at the end of the event. All Purple People/Agency Creche Workers are required to sign Nipperbout’s confidentiality agreements as part of our recruitment process.

Please note: Purple People/Agency Creche Workers will not have access to personal information about children who were not registered as attending the event they are working at.

Operations team and Agency Ops Workers

Nipperbout does not directly share any of your or your child’s personal information with our Operations teams however Operations staff members / Agency Ops Workers do have access to the Child Registration Cards and associated lists during the set up and breakdown of our settings. All documentation is stored inside closed folders and containers during transit, set up and break down. Nipperbout ensures Operations personnel and Agency Ops Workers hold a DBS check or have under gone a List 99 check and are supervised by a DBS checked staff member. All Operations personnel/Agency Ops Workers sign a copy of Nipperbout’s confidentiality agreements.

Nipperbout does share anonymous and/or non-personal information, such as numbers of children in attendance, their ages and any special needs/requirements with Operations staff members / Agency Ops Workers in order to assist in the selection and layout of equipment/resources.


Nipperbout may share personal information about your child with the venue team in order to accommodate specific needs or requests you/your child may have, for example where a break out room is required. When liaising with venues, Nipperbout ensures only essential information is shared, i.e. we may share details about the type of Special Educational Need your child has but would avoid sharing their/your name where there is no necessity to do so.


Nipperbout provides catering teams with the numbers and ages of children who require catering and a break-down of their dietary requirements. For example “3x 4-7 years, 2x halal only”.

While onsite at an event, Nipperbout Purple People may identify a specific child by sight to assist waiters in delivering specially ordered meals (e.g. dairy free) to the correct children.

Our clients (your event organiser)

Nipperbout shares the numbers, ages and needs of children with clients (by phone or e-mail) in order to identify staffing levels/special arrangements required for the event. For example, “2x 0-3 years, 3x 4-7 years, 1 child with autism requires 1:1 care”.

Nipperbout will sometimes share your name and the age of your child/ren with our clients (by phone or e-mail) in order to identify your attendance or absence from an event.

Clients are given a unique login code & password for each event in order to administer applications for childcare places. When they log in they will be able to view your full name, the answers you have given to the admission criteria questions and the full name, age and date of birth of each child you have requested a childcare place for.

Your child’s school and doctor

Nipperbout will contact your child’s school at your request to inform them that your child will be attending our setting for the dates of the event they are registered to. Your child’s full name will be shared in this correspondence.

Nipperbut may contact your child’s school in relation to child protection incidents and may share personal information accordingly.

Nipperbout may contact your child’s doctor in relation to child protection incidents and/or medical incidents. We may share personal information accordingly.

Nipperbout may share the contact details of your child’s doctor with relevant authorities in the event of a medical emergency e.g. when an ambulance is called.


‘Authorities’ refers to organisations or governing bodies such as the police, local safeguarding board and Ofsted.

Nipperbout has a duty to record and report child protection concerns. We will share personal information about you and your child when requested to do so by relevant authorities.

How we store your personal information

Nipperbout retains and stores your personal information in line with

  • GDPR regulations
  • Ofsted regulations
  • The Statute of Limitations Act (1991)
  • RIDDOR (1995)
  • COSHH (1999)
  • Chartered Institute of Personnel and Development recommendations
  • Companies Act (2006)

Records are stored for the following amount of time:

Child Registration Card – 6 years after the year in which the event was held

Accident/Incident reports (children) – Until the child’s 21st birthday

Accident / incident report (adult) – 3 years from the date of report

Accident/medical report (as specified by COSHH) – 40 years from the date of report

Safeguarding (Child Protection) reports – Until the child’s 24th birthday

Intimate care reports (e.g. nappy change) – 6 years after the year in which the event was held

HR records (employees) – end of tax year, 6 years after employment ceases

HR records (recruitment) – 6 months (usually where applicant withdraws) to one year (usually where applicant is unsuccessful)

Accounting records – end of tax year, 3 years from the date on which the record was made

Printed documents are stored at the Nipperbout office in a secure location, in line with GDPR regulations

Printed documents containing personal information that we do not need to store are destroyed at the Nipperbout office.

Electronic copies of reports/lists Nipperbout has generated using your/your child’s personal data (e.g. Key Needs list) are stored as a password protected file on the Nipperbout server for 3 years after the date of the event and then destroyed.

Information input on the Online Registration System will remain on your account until you delete or amend it.

Nipperbout will delete your Online Registration System account and its associated information if:

  • your account has been inactive for 25 months (i.e. you have not registered for an event in that time).
  • once your child turns 18 years old. Please note, if your account contains more than one child, we will only delete the child record, not the account itself.

Nipperbout has the following security measure in place:

  • Encrypted user passwords
  • Secure password requirement - users are required to create a password which is a minimum of 8 characters long and includes at least one capital letter, special character and number.
  • Https protocol
  • Firewall protection on our servers and networks
  • Local server-side encryption (this means the information on the server is encrypted)

Nipperbout’s internal servers and the host server for the Online Registration System are consistently backed up.

How you can access, correct or delete your personal information

Accessing, correcting and deleting information on the Online Registration System

You will create a username and password when you set up an account on the Nipperbout Online Registration System. This enables you to access your information at any time of the day and correct or delete information. Nipperbout encourages parents to check and update the information they have stored about their child/ren each time they register for a new event.

If you wish to have your account removed from the Nipperbout Online Registration System, please contact us on 01296 712 658 or to make the request. Nipperbout will endeavour to reply to you within 14 working days. Please note, this request will only cover information stored on the Nipperbout Online Registration System. Nipperbout is bound by Ofsted regulations in regard to the storage of our printed documents e.g the Child Registration Card, accident reports etc.

Accessing, correcting and deleting information we have printed

If you would like to access printed records we hold for you while onsite at a Nipperbout setting, please speak to a Purple Person at the registration desk.

If you wish to access printed records we have stored at the Nipperbout office please contact us on +44 (0)1296 712 658 or to make the request. Nipperbout will reply to you within one calendar month.

If you would like to correct or delete personal information on our printed documentation you can do so at the registration desk of the Nipperbout setting you are attending. Please note, to make a permanent correction to this information you will need to revisit the Online Registration System and amend these details online.

Accessing, correcting and deleting information if you are under 18 years old

Individuals under the age of 18 years are entitled to the same rights as adults in regard to the collection, processing and storage of their personal information. This means that you can also make a request to Nipperbout to access, correct or delete personal information relating to you which may have been provided to us by your parent or carer.

If you are attending a Nipperbout setting, you can request to access and amend printed records (such as your Child Registration Card) by speaking to a Purple Person. Please note, the Purple Person may need to refer the request to the Nipperbout Event Manager or Company Directors.

If you are not at a Nipperbout setting, you can make a request by telephone (+44 (0)1296 712 658), email ( or post (Six Lords, MK17 0RB). Nipperbout will respond to requests within one calendar month.

Please aware that Nipperbout may not be able to action a request to amend or delete personal information if it conflicts with our obligations to Ofsted or laws and regulations. See ‘How we store your personal information’ for details on how long we must retain our records.

Where Nipperbout has been unable to amend or delete your personal information, as requested, we will work with you to find an alternative, achievable solution. For example, by limiting the number of people who have access to your personal information or by changing the way this information is presented.

Marketing and Newsletter

If you have agreed to receive marketing messages from us or subscribed to the Parent or Staff Newsletter, you may opt out at a later date by clicking the ‘Unsubscribe’ link in the message or by e-mailing us.

Do we use Data Processors?

Nipperbout is a Data Controller. A Data Processor is responsible for processing personal information on behalf of a Data Controller.

Nipperbout does not engage third parties as a Data Processor. All your personal information is collected, processed and stored by Nipperbout.

Non-personal information collected automatically

We use third party services to help us run our website, improve the way we communicate through it and to provide tools to visitors to share our website’s content on social media. These providers collect and store non-personally identifiable information about your visit and your behaviour using cookies and similar technologies.

Our websites automatically log your visit to our site and may collect standard non-personal information including browser type (eg Google Chrome), browser version, browser size, computer operation system, computer operating system version.

Cookies, Analytics and Web Storage

Cookies are text files placed on your computer. Similarly, Web Storage stores content information and preferences in your browser. These technologies allow website owners and their partners to, for example, collect information about website use, visitor behaviour and remember a visitor’s preferences.

There are a variety of tools you can use to control the data collected by cookies and similar technologies. For example:

  • Private Browsing – this is where your browser will not save your search history and will save cookies to your computer on a temporary basis only, i.e. when you close the web page the cookies will be deleted
  • Blocking Third Party Cookies – under preferences in your browser you can enable the option to block third party cookies, this means that cookies from other websites won’t be stored on your computer.

For further information visit or uses Local Storage to remember that you have chosen to accept our Website Terms and Privacy Policy, and the use of cookies. We will then not ask you to accept this again. Settings in modern browsers allow you to prevent this choice from being stored and remembered by your browser.

We use Google Analytics to allow us to analyse the traffic to our site and to review the statistics regarding our visitors. To do this, cookies are placed on your computer. These do not track visitors across multiple sites and don’t collect any personal data. Read more about Google Analytics Privacy Policy. To opt out of being tracked by Google Analytics across all websites visit

Our web pages use social media ‘share’ and ‘follow’ tools provided by, owned by Oracle. These plugins store and access cookies (including cookies by their third-party partners) in order to collect non-personally identifiable information for the purposes of delivering targeted advertising, personalising content and user experience, and analysing use and traffic. Read more about the AddThis Privacy Policy and how to opt out from being tracked by them.

Both, Google Analytics and AddThis tools are widely used. If you normally browse the Internet these providers will likely have placed cookies on your browser through other sites.