How booking information is used

Who is responsible?

Nicola Holman is the controller for customer booking information. Little Spaces provides the booking service as the business’s processor and follows its documented instructions. Little Spaces is separately responsible for the limited account, security and service-administration information it uses to operate the platform.

Little Spaces privacy enquiries: privacy@littlespaces.co.uk.

Information collected

• The customer’s name and email address, plus a mobile number where provided.
• For an individual nursery booking, the child’s first name and confirmation that the selected place is suitable.
• For a long-term care application, the child’s first name, birth month and year, preferred start, requested weekdays and times, and whether alternatives may be considered.
• The requested booking, its price, progress and cancellation/refund outcome.
• The version and time of the relevant booking or application terms acceptance.
• Payment status and Stripe references. Neither Little Spaces nor the business receives bank-login credentials or full card details.
• Limited security information, including pseudonymous rate-limit records, to prevent abuse.

Little Spaces does not ask for health, medical, allergy, dietary, safeguarding, photographs, funding evidence or detailed family information in a long-term care application. Provide information required for later onboarding directly to the business through its established process.

Why it is used

The information is used to review requests, manage waiting lists, prevent duplicate or over-capacity short-term bookings, take payment where relevant, send transactional messages, demonstrate accepted terms, respond to rights requests and protect the service.

The business determines its lawful bases, which normally include taking steps at the customer’s request, performing the booking contract, legal obligations and legitimate interests in managing requests securely. Auto-confirm applies only to individual availability the nursery deliberately publishes. Long-term care applications remain manual nursery decisions; Little Spaces does not make automated eligibility or capacity decisions for them.

Service providers

• OpenAI Sites and Cloudflare provide hosting, database, file storage and security infrastructure.
• Microsoft sends transactional emails from a Little Spaces business mailbox. Little Spaces does not access business inboxes.
• Stripe connects the business’s own Stripe account and processes payments, refunds and fraud checks.

Little Spaces maintains a subprocessor list and requires appropriate contractual and transfer safeguards. Booking information is not sold or used for advertising.

Retention

• Pending, declined, expired and other unsuccessful unpaid individual booking requests are deleted after 90 days.
• Approved, closed and withdrawn long-term care applications are automatically deleted 18 months after they enter that final state.
• Active and waitlisted applications are reviewed after 12 months. The nursery has 30 days to confirm that an application is still active; otherwise it closes automatically and then follows the 18-month deletion rule.
• Private application links expire after 18 months.
• Confirmed, paid and refunded booking records are deleted 12 months after the appointment, session or event.
• Booking status links expire 30 days after the booking.
• Stripe and the business’s accounting systems may retain financial records longer where law requires.

Rights

Customers can ask the business to find, correct, export or delete personal information where the relevant right applies. The secure business dashboard provides tools to carry out those actions and record the outcome. The business may retain limited information where a legal obligation or properly assessed exemption applies.

Contact info@buttercupsnursery.uk. The business may need to confirm identity before acting. A complaint may also be made to the Information Commissioner’s Office.

Anonymous page activity

The business can see daily counts of public booking-page views and the first booking form opened on each page load. These totals contain no customer or child details, form contents, referral URLs, private links or visitor identifiers. They do not use cookies, browser storage or cross-site profiles. Supported Do Not Track and Global Privacy Control signals are honoured for these optional events; separate security rate limiting still applies. Counts are approximate activity, not unique people, and do not extend personal-record retention.

Cookies, security and changes

The public booking page does not use advertising or analytics cookies. Essential authentication and security cookies may be used for staff access. Private booking and application-status pages are unguessable, time-limited, uncached and excluded from search engines.

The date above changes when this notice is materially updated.