Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the nursery that subscribes to KinderHive (the controller) and Purple Hive Group Limited (the processor). It forms part of our Subscription Terms and applies whenever we process personal data on the nursery’s behalf.

It is made to meet Article 28 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Words such as “personal data”, “processing”, “data subject” and “personal data breach” have the meanings in the UK GDPR.

• Subject matter and purpose: providing KinderHive, the nursery management and parent app, to the nursery, including storing, displaying, sharing with authorised users, backing up and securing the nursery’s records.
• Duration: for as long as the nursery uses KinderHive, and afterwards until the data is returned or deleted under section 10.
• Data subjects: children attending the nursery; their parents, carers and authorised collectors; the nursery’s managers and staff; other people the nursery records (for example visitors or professionals).
• Types of personal data: names, dates of birth, contact details, attendance and sign-in records, daily diary entries, photos and videos, learning and development records, accident and incident records, invoices and fees, staff employment, shift and training records, messages, and sign-in and security logs.
• Taking fees online: when the nursery connects its own Stripe account, KinderHive sends it, on the nursery’s instruction, the parent’s name and email and the amount and reference of each invoice it collects. Stripe is the nursery’s own provider under its own agreement with the nursery, not our sub-processor.
• Special category and sensitive data: health, allergy, medical and dietary information, special educational needs, and safeguarding information, as the nursery chooses to record. Staff DBS check details.

We process the nursery’s personal data only on its documented instructions. Those instructions are this DPA, theSubscription Terms, and what the nursery’s managers and staff do in KinderHive. We will not use the nursery’s data for our own purposes, sell it, or use it for advertising.

If the law requires us to process the data in another way, we will tell the nursery first unless the law forbids it. If we think an instruction breaks data protection law, we will tell the nursery.

• having a lawful basis for the personal data it records, including any consent needed (for example for photos);
• giving parents, carers and staff the privacy information the law requires;
• deciding who it invites to KinderHive and what access their role gives them;
• deciding how long its records are kept, and meeting legal retention periods for safeguarding, accident and other records.

Everyone at Purple Hive who can access the nursery’s personal data is bound by confidentiality and only accesses it when needed to provide, support or secure KinderHive, for example when the nursery asks for help.

We keep appropriate technical and organisational measures in place to protect the data, including:

• encryption of all connections (HTTPS) and of stored data by our hosting providers;
• database rules that check every request, so each user only reaches their own nursery’s records and what their role allows;
• private storage for photos, videos and documents, opened only through links that expire;
• two-step sign-in for managers and staff, hashed PINs that lock after wrong attempts, and paired devices for classroom tablets and kiosks;
• audit logs of important actions, and regular backups.

The nursery gives general authorisation for us to use sub-processors. We use the ones below, each under a written contract with data protection obligations no less protective than this DPA. We remain responsible to the nursery for their work.

We will tell the nursery’s managers at least 30 days before adding or replacing a sub-processor. If the nursery has a reasonable data protection objection, it can tell us; if we can’t resolve it, the nursery may cancel its subscription and we will refund any fees paid for the period after the change.

Where personal data is processed outside the UK, we make sure it is protected by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

• Data subject requests: KinderHive lets the nursery find, correct, export and archive records. If we receive a request about the nursery’s data directly, we will pass it to the nursery and not answer it ourselves unless the nursery asks us to.
• Personal data breaches: we will tell the nursery without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting its data, with the information it needs to meet its own reporting duties.
• Impact assessments: we will give reasonable help with data protection impact assessments and any consultation with the Information Commissioner’s Office.

When the nursery’s subscription ends, we keep its data safely so it can come back or ask for a copy. At the nursery’s request we will return the data in a common, machine-readable format, or delete it.

We will not delete the data because a subscription ended without giving the nursery’s managers at least 30 days’ notice and the chance to receive a copy, unless the nursery asks us to or the law requires otherwise. Deleted data is removed from backups as they expire. We may keep data where the law requires us to.

We will make available the information reasonably needed to show that we meet this DPA, and allow for and contribute to audits by the nursery or an auditor it appoints, on reasonable notice, at reasonable times and subject to confidentiality. We may first answer with written information and our providers’ independent security certifications.

The limits on liability in our Subscription Terms apply to this DPA, as far as the law allows. We may update this DPA to reflect changes in the law or our sub-processors, and will tell the nursery’s managers about significant changes. If this DPA conflicts with any other agreement between us about personal data, this DPA applies.