Privacy notice

1. Who we are

This notice explains how Awake Early Years Consultancy Ltd (“Awake”, “we”, “us”) uses personal data. We are the controller of the personal data described here, which means we decide how and why it is used. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB879150.

If you have any questions about this notice or your personal data, email info@awakeconsultancy.com or write to us at 84 Turnpike Link, Croydon, CR0 5NY. We have not appointed a data protection officer because the law does not require us to, but a named member of our team deals with every data protection request.

2. Who this notice covers

This notice applies to you if you:

• visit www.awakeconsultancy.com or contact us by the website, email, phone or WhatsApp;
• create an account or use our member portal, whether you own a childcare setting or work in one (for example as a manager or practitioner);
• subscribe to our newsletter, register for training or a webinar, or send us a testimonial;
• use our consultancy services; or
• apply for a job or register with our recruitment service.

Our services are for childcare providers and the adults who work for them. If you use the portal on behalf of a setting, the setting is responsible for any information it chooses to share with us about other people, such as its staff, children or families (see section 6).

3. The personal data we collect

Information you give us

• Contact and identity details — your name, email address, phone number and job role.
• Account details — your sign-in email address and password. Your password is stored only in a securely scrambled (hashed) form by our sign-in provider; we can never see it.
• Setting details — your setting’s name, type, address, contact details, website, Ofsted unique reference number and number of registered places. For a childminder these details can also identify you personally.
• Membership and billing — your plan, membership status, renewal dates, amounts paid and invoices. Payment card and bank details are entered on, and held by, our payment provider Stripe; we never receive or store your full card details.
• Information you add to the portal — Health Check answers and evidence, action plans and updates, Quality Mark applications and evidence, consultancy requests, messages and attachments, questions and replies in “Ask the Awake Man”, AI policy writer requests and saved drafts, webinar topic suggestions, and training bookings.
• Communications — enquiries and messages you send us, your newsletter preferences, and testimonials you submit with your permission to publish them.
• Recruitment information — your CV, work history, qualifications, right to work, references and interview notes and, only where a role requires it, criminal record (DBS) information.

Information we collect automatically

• Technical information — your IP address, browser and device type, and the pages you request. Our servers record these for security, to stop abuse (for example, limiting repeated sign-in attempts) and to fix faults. We do not use analytics or advertising trackers.
• Activity records — a record of important actions in the portal (for example, changes to a membership or a Quality Mark decision) and of the emails we send you, such as when they were sent and whether they were delivered.

Information from other people

• A colleague at your setting may give us your name and email address so that you can be given access to the portal.
• Stripe tells us whether your payments succeed.
• For recruitment, we may receive information from your referees and, where a role requires it, the DBS.

4. How we use it and our lawful bases

We only use personal data where UK data protection law gives us a lawful basis to do so:

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more information about this, and you can object (see section 14).

5. Sensitive information

We do not ask for special category data (such as health, ethnicity or religious beliefs) through our website or portal, and we ask you not to include it in anything you send us unless it is needed. For recruitment we may need health information (for example, to make reasonable adjustments) and, for roles working with children, criminal record information. We only use this where the law allows — including for employment and safeguarding purposes under the Data Protection Act 2018 — and we apply the extra safeguards the law requires.

6. Children’s personal data

Our services are for adults. Accounts are only for people aged 18 or over, and we do not knowingly collect personal data from children.

Please do not enter children’s names, photographs or any other information that could identify a child, a family or a member of staff into the portal — including Health Check evidence, community posts and the AI policy writer — unless it is genuinely necessary for the service you are asking for.

If your setting does share information about other people with us (for example, as part of a consultancy assignment), your setting must have a lawful basis for doing so and must tell the people concerned. We will use that information only to provide the service and will keep it secure.

7. The AI policy writer

When you ask the AI policy writer for a draft, the details you enter in the form (and any existing policy you paste in) are sent to Google’s Gemini service, provided by Google LLC, which writes the draft. The draft is saved to your setting’s account so you can edit and download it. We do not use what you enter to train AI models.

Google processes these requests under its Gemini API terms. Depending on the terms that apply to our account, Google may keep request content for a limited period to detect misuse and may use it to improve its services, and it may be reviewed by people at Google. This is why the form asks you not to include names or other personal details — the writer does not need them to draft a policy.

AI drafts are a starting point only and are not legal advice. Our terms and conditions explain your responsibilities when using them.

8. Emails and the newsletter

• Service messages about your account, membership, payments, bookings and requests are part of the service. You cannot switch them off while you have an account, but we keep them to what is necessary.
• The monthly newsletter is a benefit of membership, so members receive it. Anyone else only receives it if they sign up on our website. Every newsletter has an unsubscribe link, and you can unsubscribe at any time.
• When you unsubscribe we keep your email address on a “do not email” list, so that we do not add you again by mistake.

We do not sell personal data, and we do not share it with other organisations for their own marketing.

9. Who we share it with

We use trusted service providers to run our website and services. They act on our instructions under contracts that require them to keep personal data secure and use it only to provide their service to us:

We may also share personal data with:

• Stripe as an independent organisation — Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.
• WhatsApp — if you choose to message us on WhatsApp, WhatsApp (Meta) handles that conversation under its own privacy policy.
• Prospective employers, referees and the DBS — for recruitment, and only as needed for the role you are applying for.
• Professional advisers — such as our accountants, lawyers and insurers, where they need it to advise or protect us.
• Authorities — where the law requires or allows it, for example regulators, HMRC, the police or, if we have a concern about a child’s safety, the relevant local authority or safeguarding partnership.
• A buyer or successor — if all or part of our business is sold or reorganised, in which case your data would remain protected in line with this notice.

10. Transfers outside the UK

Some of our providers store or process personal data outside the UK, including in India, the USA, Japan and the European Economic Area. When this happens, we make sure the data is protected as UK law requires — by relying on UK “adequacy” regulations (including the UK–US data bridge, where the provider is certified under it) or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which are part of our providers’ data processing terms. You can ask us for more information about these safeguards.

11. How long we keep it

We keep personal data only for as long as we need it:

12. How we protect it

We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS) for every page, encrypted storage by our providers, strict access controls so that each person sees only their own setting’s information, limited and role-based staff access, protection against repeated sign-in attempts, and secure password handling. No system is completely secure, but if a personal data breach happens we will deal with it promptly and tell you and the ICO where the law requires.

13. Cookies and device storage

We only use cookies and device storage that are strictly necessary for our website and portal to work. We do not use analytics, advertising or social media tracking cookies, so we do not ask for your consent to cookies. If that ever changes, we will ask for your consent first.

Our videos are shown using YouTube’s privacy-enhanced mode (youtube-nocookie.com). If you play a video, Google may store information on your device under its own privacy policy. You can control cookies through your browser settings, but the portal will not work without the sign-in cookies.

14. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct it if it is wrong or incomplete — you can update most account details yourself in the portal;
• delete it in some circumstances — you can ask us to close your account at any time;
• restrict how we use it in some circumstances;
• object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
• data portability — receive information you gave us in a commonly used electronic format, or have it sent to another organisation; and
• withdraw your consent at any time where we rely on it (this does not affect what we did before).

To use any of these rights, email info@awakeconsultancy.com. We may ask you to confirm your identity. We will respond within one month; if your request is complex or you make several, we may need up to two more months and will tell you why. There is normally no charge. Some rights have exceptions — for example, we must keep financial records even if you ask us to delete them — and we will explain if one applies.

15. Automated decisions

We do not make decisions about you that have legal or similarly significant effects using only automated means. The Health Check calculates scores automatically to help you plan improvements, but decisions such as awarding a Quality Mark are made by our team.

16. Questions and complaints

If you have a concern about how we use your personal data, please contact us first at info@awakeconsultancy.com so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

17. Changes to this notice

We may update this notice when our services or the law change. The date at the top shows when it was last updated. If we make a significant change, we will tell members by email or in the portal before it takes effect.