Privacy Policy

1. Who We Are

Waslink is a software-as-a-service platform for early-years nurseries and childcare providers. The data controller for your account data is Waslink. Each nursery using Waslink is an independent data controller for the data of their children, parents, and staff.

Contact: privacy@kindernest.app

2. Data We Collect

We collect the following categories of personal data:

• Account holders (directors, practitioners): name, email address, password hash, role
• Children: full name, date of birth, gender, room assignment, allergies / medical notes, avatar
• Parents / guardians: name, email address, phone number, relationship to child
• Daily reports: mood, meal rating, nap duration, bathroom visits, activities, notes
• Attendance records: present / late / absent / excused status per day
• Photos: images uploaded by staff, subject to explicit photo consent from parents
• Invoices: amount, status, dates — no payment card data is stored on our servers
• Incident records: date, type, severity, summary
• Messages: content of messages between staff and parents

3. Lawful Basis for Processing

We rely on the following lawful bases under UK/EU GDPR:

• Contractual necessity — to deliver the service your nursery has subscribed to
• Legitimate interests — account security, fraud prevention, service improvement
• Consent — photo uploads (parents must explicitly grant photo consent from their account)
• Legal obligation — retaining records where required by law (e.g. safeguarding)

Children's data is processed on behalf of the nursery (the data controller), who must have an appropriate lawful basis under applicable law (e.g. safeguarding duty of care).

4. Data Retention

We retain personal data for as long as your nursery's subscription is active. Upon cancellation:

• You may export your data at any time from the settings page
• Account data is deleted within 30 days of subscription end
• Anonymised aggregate statistics may be retained indefinitely
• Photos are deleted according to the retention period you configure (default: 90 days)

5. Third Parties & Sub-processors

We use the following sub-processors. A full list is available in our Data Processing Agreement:

• Cloud infrastructure — hosting and database
• Email delivery — transactional emails (invites, magic links, reports)
• File storage — photo uploads
• Payment processor — subscription billing (we never see card details)

We do not sell personal data to third parties. We do not use personal data for advertising.

6. Children's Data

We treat children's personal data with the highest level of care. Key protections:

• Photos of children are only stored when a parent has explicitly granted photo consent
• Children's data is never shared outside the nursery tenant
• Parents can view all data held about their child via their portal account
• Parents can request deletion of their child's data by contacting their nursery

7. Your Rights

Under GDPR you have the right to: access your data, correct inaccurate data, erasure ("right to be forgotten"), data portability, object to processing, and lodge a complaint with your supervisory authority (ICO in the UK: ico.org.uk).

To exercise any right, email privacy@kindernest.app. We will respond within 30 days.

8. Security

We use industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, and regular security reviews. All staff with access to production data are bound by confidentiality obligations.

9. Changes to This Policy

We will notify account holders by email and in-app notification at least 14 days before any material changes take effect.