Privacy Policy

Welcome to Bloom Kidz.

Bloom Kidz is a nursery management software platform operated by Owl Corporations Ltd.

We take the privacy and security of personal information seriously, particularly because our platform may be used by nurseries and childcare providers to manage information relating to children, parents, carers and nursery staff.

This Privacy Policy explains:

• what personal information we collect;
• how we use it;
• why we use it;
• who we may share it with;
• how we protect it;
• how long we may keep it; and
• the rights individuals have in relation to their personal information.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant privacy legislation.

Bloom Kidz is a nursery management software platform operated by:

For the purposes of this Privacy Policy, references to "Bloom Kidz", "we", "our" or "us" mean Owl Corporations Ltd in connection with the Bloom Kidz service.

Bloom Kidz provides digital nursery management tools designed to help nurseries and childcare providers manage their day-to-day operations.

Depending upon the services selected by a nursery, Bloom Kidz may be used for purposes including:

• children's registration;
• parent and carer information;
• attendance records;
• daily diaries;
• children's learning and development;
• observations;
• photographs and videos;
• meal and dietary information;
• sleep records;
• toileting records;
• accidents and incidents;
• medication records;
• allergies;
• medical information;
• SEND and additional-needs information;
• safeguarding information;
• permissions and consents;
• nursery-parent communication;
• staff information;
• staff rotas;
• invoices and payments;
• funding records;
• reports; and
• other nursery administration.

This is an important distinction.

Where a nursery or childcare provider uses Bloom Kidz to store information about its children, parents, carers or employees, the nursery will normally be the Data Controller.

This means the nursery decides why the information is collected and how it should be used.

In these circumstances, Owl Corporations Ltd/Bloom Kidz normally acts as a Data Processor, processing the information on behalf of the nursery.

If you have questions about information that your nursery has entered into Bloom Kidz, you should normally contact your nursery first.

There are circumstances where Owl Corporations Ltd acts as the Data Controller.

This may include information concerning:

• Bloom Kidz customers;
• nursery owners and managers;
• individuals requesting demonstrations;
• people contacting our support team;
• website visitors;
• prospective customers;
• account administrators;
• billing contacts; and
• individuals who have agreed to receive our marketing communications.

The personal information processed through Bloom Kidz will depend on how each nursery uses the platform. Information may include:

• full name;
• preferred name;
• date of birth;
• age;
• gender;
• home address;
• photograph;
• room or class;
• attendance;
• arrival and collection times;
• authorised collection persons;
• emergency contacts;
• learning observations;
• assessments;
• development information;
• progress records;
• photographs;
• videos;
• daily activities;
• meals;
• dietary requirements;
• allergies;
• sleep;
• toileting information;
• accidents;
• incidents;
• medication;
• illnesses;
• medical conditions;
• disabilities;
• SEND or additional needs;
• safeguarding information;
• funding information; and
• other information entered by the nursery.

We may process information entered by a nursery relating to parents, carers and family members, including:

• name;
• home address;
• email address;
• telephone number;
• relationship to the child;
• emergency contact information;
• authorised collection information;
• communication preferences;
• permissions;
• consents;
• messages;
• invoices;
• payment records;
• funding-related information; and
• account login information.

Where a nursery uses Bloom Kidz for staff administration, the platform may process:

• employee name;
• contact information;
• job title;
• nursery location;
• qualifications;
• training information;
• attendance;
• working hours;
• rotas;
• holiday records;
• compliance records;
• DBS-related information where appropriate;
• safeguarding records where required;
• performance or supervision information where entered by the nursery;
• system access information; and
• account activity.

The nursery remains responsible for determining what employee information it needs to collect and the lawful basis for doing so.

Some information stored within Bloom Kidz may be particularly sensitive and legally classified as special category data. This may include information concerning:

• health;
• disabilities;
• allergies;
• medical conditions;
• racial or ethnic origin;
• religious beliefs;
• dietary requirements linked to religion or health; and
• other sensitive information.

Bloom Kidz has been designed for use within the childcare and early-years sector.

We recognise that children require particular protection when their personal information is processed. We aim to apply strong privacy protections to children's information. In particular:

• children's information should only be collected where necessary;
• access should be limited to authorised users;
• privacy should be considered when designing new Bloom Kidz features;
• children's information should not be used for unrelated purposes;
• children's personal information will not be sold;
• children's information will not be used by Bloom Kidz for behavioural advertising;
• children's information will not be used for direct marketing to children;
• data-minimisation principles will be applied; and
• appropriate technical and organisational security measures will be maintained.

Where we introduce services that children can access directly, we will assess any additional requirements relating to children's privacy before introducing those services.

If you are a nursery owner, manager or other Bloom Kidz business customer, we may collect:

• your name;
• business name;
• nursery name;
• business address;
• email address;
• telephone number;
• job title;
• account information;
• subscription information;
• billing details;
• payment information;
• enquiries;
• correspondence;
• customer support records;
• demo requests;
• training records; and
• information about how you use Bloom Kidz.

When you visit the Bloom Kidz website or use our online services, we may automatically collect certain technical information. This may include:

• IP address;
• device type;
• browser;
• operating system;
• pages visited;
• date and time of visits;
• approximate location derived from technical information;
• login information;
• session information;
• referral source;
• cookie identifiers; and
• security information.

We may use this information to operate, secure and improve our website and services.

Depending on the circumstances, we may use personal information to:

• provide Bloom Kidz services;
• create and maintain accounts;
• provide nursery-management functionality;
• store information entered by nursery customers;
• provide technical support;
• provide demonstrations;
• respond to enquiries;
• process subscriptions;
• process payments;
• manage contracts;
• communicate service updates;
• maintain system security;
• detect suspicious activity;
• prevent fraud;
• troubleshoot technical problems;
• maintain backups;
• improve Bloom Kidz;
• understand how customers use our services;
• comply with legal obligations;
• respond to regulatory requests;
• maintain financial and tax records;
• establish or defend legal claims; and
• send permitted marketing communications.

Where Owl Corporations Ltd acts as a Data Controller, we will only process personal information where we have an appropriate lawful basis. Depending on the circumstances, we may rely upon:

Where processing is necessary to provide Bloom Kidz services or take steps before entering into a contract.

Where we must process information to comply with the law.

Where processing is reasonably necessary for our legitimate business interests and those interests are not overridden by the rights and interests of the individual. Examples may include:

• maintaining security;
• preventing fraud;
• improving our services;
• managing customer relationships; and
• protecting our legal rights.

Where we have asked for and received valid consent. Where consent is relied upon, it may normally be withdrawn at any time.

In exceptional circumstances, information may be processed where necessary to protect someone's life.

When a nursery enters children's, parent or staff information into Bloom Kidz, the nursery is responsible for determining the appropriate lawful basis for processing that information.

Bloom Kidz does not determine the nursery's lawful basis merely by providing the software platform.

Nurseries may choose to upload photographs or videos to Bloom Kidz. The nursery is responsible for:

• establishing its lawful basis;
• obtaining any permissions or consents it determines are required;
• managing parents' preferences;
• deciding who can access photographs or videos; and
• deciding when photographs or videos should be deleted.

Bloom Kidz will process these files only in accordance with the relevant nursery's instructions and our contractual obligations.

Nurseries may use Bloom Kidz to record medical information necessary for the safe care of children. This could include:

• allergies;
• medication;
• medical conditions;
• dietary restrictions;
• healthcare plans; and
• accident and incident information.

This information is particularly sensitive and access should only be provided to individuals who genuinely require it.

We do not sell children's, parents' or nursery customers' personal information.

Information may be shared where necessary with carefully selected service providers who help us operate Bloom Kidz. These may include providers of:

• cloud infrastructure;
• hosting;
• databases;
• backups;
• email services;
• communications services;
• payment processing;
• cybersecurity;
• analytics;
• customer support systems;
• software development services; and
• professional services.

These organisations may only process information in accordance with applicable contractual and legal requirements.

Where Bloom Kidz acts as a Data Processor, we may use other organisations known as sub-processors to help us provide our services. Where required, we will:

• carry out appropriate due diligence;
• put appropriate contracts in place;
• require appropriate confidentiality and security measures; and
• maintain information regarding our relevant sub-processors.

A current sub-processor list may be made available to Bloom Kidz customers.

Some organisations supporting our services may process information outside the United Kingdom. Where personal information is transferred internationally, we will take appropriate steps to ensure the transfer complies with applicable UK data protection legislation.

Depending upon the destination and circumstances, these safeguards may include:

• UK adequacy regulations;
• an International Data Transfer Agreement;
• an approved UK Addendum to relevant Standard Contractual Clauses; or
• another legally permitted transfer mechanism.

Bloom Kidz uses appropriate technical and organisational measures designed to protect information against:

• unauthorised access;
• loss;
• misuse;
• alteration;
• disclosure;
• destruction; and
• cyber threats.

Our measures may include:

• encryption in transit;
• appropriate encryption of stored information;
• secure hosting;
• restricted access;
• role-based permissions;
• secure authentication;
• password controls;
• security monitoring;
• logging;
• backups;
• software updates;
• vulnerability management;
• employee confidentiality obligations;
• access reviews; and
• incident response procedures.

No online system can guarantee absolute security. We continually review our security arrangements and take reasonable measures appropriate to the risks involved.

Users are responsible for maintaining the confidentiality of their login credentials. Users should:

• choose strong passwords;
• not disclose passwords to other people;
• avoid using shared accounts unless specifically authorised;
• log out of shared devices;
• report suspicious activity immediately; and
• notify their nursery or Bloom Kidz support if they believe an account has been compromised.

We only retain personal information for as long as it is reasonably required for the purpose for which it was collected or where we have a legal requirement to retain it.

For information controlled by nursery customers, the relevant nursery is responsible for deciding appropriate retention periods.

When a nursery stops using Bloom Kidz, we will handle its information according to:

• our agreement with the nursery;
• documented instructions from the nursery;
• applicable law;
• our backup arrangements; and
• legitimate security and legal requirements.

Information held within system backups may remain for a limited period before being automatically overwritten or securely deleted.

When a nursery terminates its Bloom Kidz account, arrangements may be made for authorised customer data to be exported, returned or deleted in accordance with the applicable contract.

Nurseries should ensure that they export information they are legally required to retain before account deletion where appropriate.

Depending upon the circumstances, individuals may have rights including:

• the right to be informed about how information is used;
• the right to access personal information;
• the right to have inaccurate information corrected;
• the right to have information erased in certain circumstances;
• the right to restrict processing;
• the right to object to certain processing;
• the right to data portability in certain circumstances; and
• rights relating to certain types of automated decision-making.

Not every right applies in every circumstance.

If you are a parent, carer, employee or other individual and your information has been entered into Bloom Kidz by a nursery, the nursery will normally be responsible for dealing with your data protection request.

You should therefore contact your nursery in the first instance.

If necessary, Bloom Kidz will provide reasonable assistance to the nursery in responding to your request.

If Owl Corporations Ltd controls your personal information directly, you may contact us to exercise your data protection rights.

We may need to verify your identity before providing information or making certain changes.

We maintain procedures to identify, investigate and respond to personal data breaches.

Where Bloom Kidz acts as a processor and becomes aware of a personal data breach affecting nursery-controlled information, we will inform the relevant nursery without undue delay and provide reasonable information and assistance.

Where Owl Corporations Ltd acts as the Data Controller, we will assess whether the incident needs to be reported to the Information Commissioner's Office or affected individuals.

Our website and online services may use cookies and similar technologies. These may be used for:

• essential website functionality;
• security;
• authentication;
• maintaining sessions;
• remembering preferences;
• analytics; and
• understanding how our services are used.

Where legally required, we will obtain appropriate consent before placing or accessing non-essential cookies or similar technologies.

You should refer to our Cookie Policy for more information.

We may contact nursery owners, managers or other business contacts with information about Bloom Kidz where permitted by law. Marketing communications may include information about:

• Bloom Kidz features;
• product updates;
• demonstrations;
• webinars;
• nursery-management resources;
• special offers; and
• related services.

You may unsubscribe from electronic marketing communications using the unsubscribe option provided or by contacting us.

We will not use children's personal information stored by nursery customers to market directly to children.

We may use analytics technologies to understand how our website and platform are used.

Where analytics involve cookies or similar technologies, we will comply with applicable consent and privacy requirements.

Where possible, analytics information may be aggregated or de-identified.

Bloom Kidz may introduce features using artificial intelligence or automated technology.

Before introducing features that process identifiable personal information, we will consider:

• privacy;
• children's rights;
• lawful basis;
• transparency;
• accuracy;
• security;
• fairness;
• potential discrimination;
• human oversight;
• data minimisation; and
• whether a Data Protection Impact Assessment is required.

We will provide further information where an AI feature materially affects how personal information is processed.

Bloom Kidz does not intend to make significant decisions about children solely using automated processing without appropriate legal justification and safeguards.

If this changes, relevant users and customers will be provided with appropriate privacy information.

Our website or software may contain links to third-party websites or services.

Bloom Kidz is not responsible for the privacy practices of independent third parties.

Users should review the privacy policies of those organisations before providing personal information.

If Owl Corporations Ltd or the Bloom Kidz business is involved in a merger, acquisition, restructuring, financing or sale of business assets, personal information may be transferred as part of that transaction.

Appropriate confidentiality, security and data-protection measures will be considered during any such transaction.

We may disclose personal information where reasonably necessary to:

• comply with applicable law;
• comply with a court order;
• respond to a lawful regulatory request;
• protect the rights of Owl Corporations Ltd;
• prevent fraud or cybercrime;
• establish or defend legal claims; or
• protect the safety of individuals where legally permitted.

Where Bloom Kidz acts as a processor, we will take account of the relevant nursery's role as Data Controller when responding to such requests.

Bloom Kidz aims to incorporate privacy considerations throughout the design and development of the platform. This includes considering:

• what information is genuinely required;
• who needs access;
• appropriate default settings;
• children's privacy;
• security controls;
• retention;
• data sharing;
• transparency; and
• risks associated with new technologies.

We will consider Data Protection Impact Assessments where processing could present a high risk to individuals.

We may update this Privacy Policy from time to time. Changes may be necessary because of:

• changes in legislation;
• regulatory guidance;
• changes to Bloom Kidz;
• new features;
• new suppliers;
• security improvements; or
• changes to how we process personal information.

Where changes are significant, we will take reasonable steps to bring them to the attention of affected customers or users.

The latest version will be available through the Bloom Kidz website or platform.

We would encourage you to contact us first if you have concerns about how Owl Corporations Ltd or Bloom Kidz has handled personal information.

You also have the right to make a complaint to the UK's data protection regulator:

If you have questions about this Privacy Policy or how Bloom Kidz handles personal information, please contact: