Privacy Notice

Please note: This Privacy Notice has been updated and the version below comes into effect on 19th August 2026. You can view the previous Privacy Notice or read a summary of the key changes.

Here at tiney, we take privacy rights seriously. We respect the privacy of all individuals we deal with, including our website visitors, childminders, families (including children) who use our services, suppliers, enquirers and anyone else we meet in our business.

This privacy notice sets out information about how we use, store and transfer personal data which we receive through our website tiney.co (the Site), through the tiney platform (the Platform, which we make available through the Site and through our app) or otherwise.

Personal data means any information about an individual from which that person can be identified. There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person's health or sexual orientation (as further explained below).

We are a data controller in relation to that personal data, which means we determine the purposes and means of the processing of that personal data.

We or us means Tiney Limited, trading as tiney, a company registered in the United Kingdom under number 11194291 whose registered offices are at International House, 12 Constance Street, London, E16 2DQ. We are a registered childminder agency.

We have appointed a data protection officer (DPO), Edd Read, who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights (see below), please contact the DPO at data-protection@tiney.co.

We’ve broken this Notice down to make it easier to navigate depending on your relationship with us.

• Information for childminders who register with us, or apply to register with us (Childminders);

• Information for parents or guardians who may use our Site and App and engage Childminders;

• Information for anyone else who we might deal with (like suppliers, referrers, local authorities, journalists, or anyone who contacts us with general enquiries, or people just browsing the Site).

If your child is of reading age, and will be looked after by one of our registered Childminders, then we have a child-friendly privacy notice which is set out at the bottom of this Notice.

Finally – in some places in this Notice we refer to the GDPR, which is the main law setting out our legal obligations and your rights in relation to personal data (although other laws apply too, including the UK Data Protection Act 2018). That’s kind of a shorthand reference – technically there’s a European GDPR and a separate UK GDPR (which is the same wording as the EU one, just transposed into UK law as part of the Brexit arrangements), and some other subsidiary legislation as well.

When we say GDPR, we mean the UK law as transposed from the European one and then updated.

Summary

Full details are set out in the relevant sections of this Notice below, but keeping it brief:

• we normally receive your personal data from you, but sometimes it might be from a third party with whom we are mutually acquainted (e.g. other users of the Platform or a reference provider such as Ofsted);

• if you are a parent, then we will process personal data relating to your children. We’ve included information for you in the section for parents below, but there’s also a child-friendly privacy notice if your child is of reading age;

• we do not normally review personal data relating to children, but might do so if we have quality or safeguarding concerns or in case of emergency;

• we use your personal data to deliver our services, conduct our business, keep appropriate records and meet our legal obligations;

• we only provide your personal data to third parties for our business purposes or as permitted by law;

• we store personal data for specified periods; you have legal rights in relation to your personal data which you can exercise on request;

• the Sites use cookies; and

• you can contact us to enquire about any of the contents of this Notice.

Importantly, this Notice relates only to the personal data which we receive and use. If you’re a parent engaging a Childminder, then you will likely provide personal data to them relating to yourself and your family. The Childminder’s use of that personal data will be governed by your own contract with them and by any privacy notice issued by them (although where copies of that data are stored in the Platform we might be a data controller together with the Childminder in connection with those copies).

This Notice supplements (and its terms apply in addition to) any other terms of use or other terms and conditions agreed between you and us from time to time, including but not limited to our General Terms of Use. It is important that you read and retain this policy, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.

By using our Platform, you acknowledge you have read and understood this privacy notice and agree to the collection and processing of your data as described below.

Direct marketing

We want to ensure that you are informed and aware of the best services and promotions that we can offer you. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving the marketing.

We may also analyse your personal data to form a view about which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out/unsubscribe links within any marketing communication sent to you or by contacting us at community@tiney.co.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to service availability notifications, order confirmations, updates to our terms and conditions, and checking that your contact details are correct.

TrustPilot Reviews

We may contact you via email to invite you to review any services and/or products you received from us in order to collect your feedback and improve our services and products (the “Purpose”). We use an external company, Trustpilot A/S (“Trustpilot”) (who acts as our data processor) to assist with sending our review invitation emails and collecting feedback on our behalf from people who have used our services. This means that we will share your name, email address and any reference number with Trustpilot for the Purpose. If you want to read more about how Trustpilot process your data, you can find their Privacy Policy here. We may also use such reviews in other promotional material and media for our advertising and promotional purposes. You can opt out of receiving review invitations at any time by following the unsubscribe link in those communications or by contacting us at any time.

Providing your personal data to others

In the ordinary course of our business we will disclose some information to third parties like our suppliers or advisors. This section explains when we might share your personal data with others.

Our advisors. We may disclose your personal data to our insurers and/or professional advisers to take professional advice and manage legal disputes.

Disclosures designated by you. We may disclose your personal data to third parties designated by you, such as other users of the Platform (like when we liaise between parents and Childminders).

Our service providers. We may disclose personal data to our service providers or subcontractors in connection with the uses we’ve described above. For example, we may disclose:

• any personal data in our possession to suppliers which host the servers on which our data is stored (including GDrive cloud storage providers), or which host third-party platforms we use to deliver our webinars (such as Zoom and Google Meet), or which provide community forum software (such as Insided.com) or call recording software (such as Aircall), or customer support tools (such as Intercom), or call scheduling/booking facilities (such as Calendly), or internal project and product management tools (such as Shortcut, Trello, Notion, Miro and Incident-io), or design and content management providers (such as Contentful), or to data warehousing and data and service automation providers (such as Stitchdata, Parabola and Zapier), and to web behaviour tracking providers (such as Hotjar), and to providers that process feedback forms on our behalf (such as Google Forms), or to freelance staff (including community childminder coaches) whose duties involve handling the relevant personal data, and to secure email platforms used by local authorities (such as Egress);

• contact details to providers of email, CRM, email marketing or physical delivery/courier services (including AirTable and HubSpot, based outside the UK), and to SMS messaging platforms (such as Twilio) and to Shopify (an e-commerce platform located outside the UK that we use to facilitate order processing and payments for childminder supplies and tiney-branded kit) and to providers of e-commerce order fulfillment (such as Huboo), and to venues running our events if they require it, and to Tigerlily Training Ltd who provides first aid training to trainees and to enable the redemption of any first aid voucher code purchased by a childminder (note that they are responsible for processing your personal data in accordance with their own privacy policy, which we recommend you review before using their first aid training);

• login credentials to cloud-based authentication and authorization services (such as Auth0) to manage user login and secure access to our services;

• payment and transactions data to our payment processing and banking as a service providers (such as Stripe and Modulr) and to platforms for referrals and rewards (such as Tremendous), to local authorities (where we process funded placements in affiliation with them), to Shopify in connection with purchases made via our Site, and to providers of e-commerce order fulfillment (such as Huboo). Any student finance reference number for a childminder (a ‘CCG’) is also shared with the parent in order for the parent to link the child with the childminder;

• discovery data (such as answers to qualifying questions) to scheduling platforms such as Calendly (based outside the UK), and information collected through home visits to internal communication and collaboration platforms (such as Slack), and to field service and client management tools (such as Jobber), and responses to customer satisfaction surveys to business intelligence tools (such as Metabase);

• check data such as identification documents to providers of database management tools (such as AirTable) and to Personnel Checks who acts as our third party processor and manager of DBS checks, and national insurance numbers may be shared with local authorities to enable them to perform funding eligibility checks;

• identity data (such as name, date of birth, address, contact details, nationality and gender) relating to childminders who hold a tiney wallet account (and, where a childminder operates through a company, its directors and company associates) to ComplyAdvantage (a Moody's Analytics company, based outside the UK) for anti-money laundering and compliance screening, as described under "Anti-money laundering and compliance screening" below;

• health data (childminder health declaration forms) may be shared with the childminder’s GP or nominated medical advisor and we may share childminder health data with RTW Plus Ltd (who provide practising GP and nurse clinicians to us) for their purposes in carrying out virtual health consultations with childminders, and to GPDQ (for their health check services);

• contact details (in hashed form), lifecycle stage information and conversion event data (unhashed) to advertising platforms (Meta, Google and TikTok) for advertising optimisation, conversion tracking, audience building and Lookalike Audience creation;

• usage data to providers of analytics services and advertising platforms (Meta, Google and TikTok) for conversion tracking, advertising optimisation and audience building purposes; and

• information relating to our childminders, like correspondence, account or check data, to third parties who provide benefits for those childminders (for example, insurers such as BHSF and Morton Michel) or who provide check services (like criminal record, local authority or credit checks). We will share information relating to you (or as applicable other members of your household) for check services purposes only to the extent sufficient to identify you (such as your name, address and date of birth) so that they can check their own records in relation to you (or as applicable other members of your household); and

• any personal data that we process when responding to data subject rights requests, handling complaints, investigating and managing safeguarding/quality concerns, conducting data protection compliance investigations or carrying out business intelligence analysis, to the providers of AI tools that assist us with those tasks (in particular Anthropic, whose Claude API processes data in the United States and retains it for a short period only), as further described under "Use of artificial intelligence (AI) tools" below, which sets out the safeguards that apply and confirms that we use special category data with these tools only for the rights-request, complaints and safeguarding/quality purposes, and not for business intelligence analysis.

We do not allow our data processors to use your personal data for their own purposes. We only permit them to use your personal data for specified purposes, in accordance with our instructions and applicable law.

Use of artificial intelligence (AI) tools

We use Intercom (customer support), which incorporates artificial intelligence (AI) features to support our customer experience. These features may use AI to interpret messages, analyse customer interactions, and assist with communication management. Intercom may process personal data (such as your name, contact details and communication history) in connection with its AI features. Intercom's AI providers implement a zero data retention policy on customer messages and responses, and do not use your data for training or fine-tuning of their models. We ensure that Intercom is contractually required to process your data in accordance with applicable data protection laws.

We may also use third-party AI tools, such as Google Gemini and Anthropic Claude, to support certain internal processes that may involve limited processing of personal data. In particular, we use the Anthropic Claude API to assist with: (a) responding to subject access requests and other data subject rights requests; (b) handling complaints and conducting data protection compliance investigations (for example, reviewing relevant records to resolve a complaint or enquiry); (c) managing and keeping records of safeguarding and quality concerns; and (d) carrying out business intelligence analysis of our operational data. AI processing of personal data only takes place for these defined purposes. We use special category data with these tools only for the purposes in (a) to (c) above, and not for the business intelligence analysis in (d). A trained member of our team always reviews the output of these tools before it is relied upon - AI is never the sole basis for a decision affecting you. We may also use Google Gemini on an ad-hoc basis to help with general internal tasks; we do not use it to process special category data, and where it involves other personal data the same safeguards described here apply. Where these tools are operated by providers outside the UK (Anthropic and Google both process data in the United States), the transfer is made under appropriate safeguards (see "International transfers of your personal data" below). We ensure that such tools are configured not to use our data to train or improve their models, that any personal data is retained by the provider for a short period only, and that all processing is subject to the provider's applicable data protection terms and safeguards.

Anti-money laundering and compliance screening

We operate the tiney wallet, an FCA-regulated e-money service that lets childminders receive payments and manage payouts. Because of this, we are legally required to carry out ongoing customer due diligence on childminders who hold a tiney wallet account. We use ComplyAdvantage (a Moody's Analytics company) to screen the identity data of those childminders - and, where a childminder provides their services through a company, the data of its directors and company associates - against global sanctions lists, politically exposed persons (PEP) databases and adverse media sources, both when an account is opened and on an ongoing basis. The identity data used for this purpose (such as name, date of birth, address, contact details, nationality and gender) is transferred to ComplyAdvantage in the United States under the safeguards described under "International transfers of your personal data" below. Screening results are reviewed by trained members of our team: automated checks are only used to dismiss obvious non-matches, and any decision that could affect a childminder's account always involves human review, as further explained under "Automated decision-making and profiling" below. We carry out this processing to comply with our legal obligations under the Money Laundering Regulations 2017, the Payment Services Regulations 2017 and the Sanctions and Anti-Money Laundering Act 2018. Where this screening involves special category data, we rely on the substantial public interest condition (Art. 9.2(g) GDPR), and where it involves personal data relating to criminal convictions or offences, we rely on Art. 10 GDPR, in each case meeting a condition in Schedule 1 to the Data Protection Act 2018 (in particular paragraph 10 (preventing or detecting unlawful acts) and paragraph 14 (preventing fraud)) and maintaining an appropriate policy document as required. We keep the records generated by this screening for five years after the end of our business relationship with the childminder, as required by the Money Laundering Regulations 2017.

Accessing your account to provide support

From time to time our customer care team may need to look at your account to help you with a query or to investigate a technical problem. To do this effectively, a trained member of our team can securely view the tiney app as you see it (a capability sometimes called "impersonation" or "view as user"). This lets us reproduce and resolve issues quickly, and guide you through the app, without needing to ask you for screenshots or lengthy explanations.

A few important points about how this works:

• It does not give our team access to any personal data that our support and administrative staff could not already access through our internal tools. As an additional safeguard, photographs in learning journals (which may show children) are automatically blurred during these sessions, so staff can see the layout and structure of a page without viewing the images themselves.

• Private messages between families and childminders cannot be viewed or sent during a support session, so the content of your conversations stays private (our position on messages, set out elsewhere in this Notice, is unchanged).

• Where our team needs to make a change to your account or your data on your behalf, they will only do so with your permission - ideally while we are in contact with you, so that you can confirm the change and see the result.

• Every such session is recorded in an audit log, including who accessed the account, when, and the reason for doing so (such as the support ticket being worked on), so that access is accountable and can be reviewed.

• Access to this capability is limited to trained members of our team, and is used only to provide you with support or to investigate and resolve issues - never for any other purpose. Extending it to other teams or purposes would be assessed separately.

We do this on the basis of our legitimate interests (Art. 6.1(f) GDPR) in providing you with effective customer support and keeping our Platform working properly, and, where the support relates to the services we provide to you, the performance of our contract with you (Art. 6.1(b) GDPR). During a session our team sees the app broadly as you see it, and accesses your information only so far as is needed to help with your request.

Events

We may capture photographs and videos during events we run, which may include identifiable images of attendees. We process photos and videos to document the event, promote future events, and share highlights with attendees and the public. We rely on your consent to use your images for promotional purposes. Where consent is not obtained, we may rely on our legitimate interests to document the event, provided this does not override your rights and freedoms. You will be informed and given the option to provide or withhold consent for photography and videography during registration or upon entering the event. You may withdraw your consent at any time by contacting us at data-protection@tiney.co. Images and videos may be shared publicly on our website and social media platforms.

Compliance

We may also disclose your personal data where necessary to comply with law (in particular if we become aware of any criminal activity or serious safeguarding concerns) including during emergency situations or where necessary to protect the safety of persons (for example we may need to share personal data with emergency services or social services).

Restructuring

If any part of our business is proposed to be sold or transferred, your personal data may be disclosed to the new owner or in connection with the relevant negotiations.

International transfers of your personal data

Some of the third parties to whom we may transfer your personal data, discussed above, may be located outside the UK and the EEA or may transfer your personal data to their own service providers located outside the UK and the EEA. If so, then we will ensure that transfers by our appointed data processors will only be made lawfully (e.g. to countries in respect of which the UK Secretary of State has made an adequacy decision, or with appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses). You may contact us if you would like further information about these safeguards.

In particular, personal data is transferred to the United States when we use the Anthropic Claude API to assist with the processing described in the "Use of artificial intelligence (AI) tools" section above, and when we use ComplyAdvantage for anti-money laundering and compliance screening (described above). The United States is not currently subject to a UK adequacy decision, so we make these transfers under appropriate safeguards, such as the IDTA or the UK Addendum to the EU Standard Contractual Clauses incorporated into our processors' data processing agreements, together with supplementary technical measures such as encryption of the data in transit and at rest.

We share data with advertising platforms including Meta, Google and TikTok, which may transfer your data internationally. These platforms have appropriate safeguards in place, including Standard Contractual Clauses and adherence to relevant data protection frameworks.

Personal data that you submit for publication on the Site or Platform or otherwise make visible to other users may be available, via the internet, to others around the world. We cannot prevent the use (or misuse) of such personal data by others.

Advertising Optimisation and Audience Building

We share certain information with advertising platforms including Meta (Facebook/Instagram), Google and TikTok to help us grow the childminding profession by reaching people who may be interested in becoming childminders or using childminding services. Before we share any personally identifiable information (such as your email address or phone number), we convert it into a scrambled code using a process called hashing (specifically SHA-256). This means the platforms never see your actual details — they only receive a securely coded version using industry standard cryptographic techniques. The platforms then check this coded version against their own similarly coded records to find matches.

What we share:

• Email addresses and phone numbers (always hashed — meaning converted into an unreadable code — before sharing)
• Customer lifecycle stages and conversion events (e.g., when someone becomes a registered childminder, completes training modules or engages our services)
• Interaction data with our website and Platform

Why we share it: Our mission is to grow the childminding profession and make quality childcare more accessible. We share this data to:

• Reach potential childminders who would benefit from joining tiney and help grow the childminding profession
• Connect families with local childminders by showing relevant advertisements to those who may need childcare
• Build “Lookalike Audiences” – groups of people on these platforms who share similar characteristics or interests with our existing childminders and families
• Improve the effectiveness and relevance of our advertising campaigns
• Understand which audiences are most likely to benefit from our services
• Optimise ad delivery and reduce wasted advertising spend
• Measure campaign performance and return on investment

Who we share with:

• Meta (Facebook/Instagram): Using Meta’s Conversions API, advertising tools and Lookalike Audience features
• Google: Using Google Ads conversion tracking and customer match features
• TikTok: Using TikTok’s advertising and conversion tracking tools

This may include data about customers and prospective childminders who have not directly interacted with our advertisements on these platforms. The platforms use the data we provide to match it with their user databases and create audiences for our advertisements. We do not share any personal data relating to children with advertising platforms. The platforms process the data we share in accordance with their own privacy policies (linked below), which may include uses beyond our advertising campaigns. We require that all data shared with these platforms is done so in compliance with applicable data protection law.

Legal basis: We rely on our legitimate interests (Art. 6.1(f) GDPR) in marketing our services effectively and efficiently, managing our business operations, growing the childminding profession, and reaching potential childminders and families who would benefit from our services. We have balanced these interests against your rights and freedoms and determined that this processing is proportionate and does not override your rights.

The advertising platforms process this data in accordance with their own data processing terms and privacy policies, which you can review at:

• Meta: https://www.facebook.com/privacy/policy
• Google: https://policies.google.com/privacy
• TikTok: https://www.tiktok.com/legal/privacy-policy

Your rights: You have the right to object to this processing at any time by contacting us at data-protection@tiney.co. You can also opt out of personalised advertising through the advertising platforms’ own privacy settings.

Data security

We have put in place appropriate security measures to protect your personal data. These include (but are not necessarily limited to) encryption, access controls, regular software updates and patching, firewalls and anti-malware software, data backup and recovery plans. We also have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where required by law.

Unfortunately, no transmission or storage system can be guaranteed to be completely secure, and transmission of information via the internet is not completely secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem.

Retaining and deleting personal data

We don’t keep personal data any longer than is needed to fulfil the purposes for which we collected it in the first place, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. This section describes how we retain and delete personal data.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We comply with our legal obligations in relation to the retention and deletion of personal data, and in particular ensure that personal data that we process is not kept for longer than is necessary for the relevant purposes. We maintain a retention policy, details of which are available on request.

We may retain your personal data longer where necessary to comply with law or in connection with any legal claim.

Our use of cookies

We use cookies and similar technologies to recognise you, improve our Site and services and for tracking purposes. For more information about the cookies we use and how to change your cookie preferences, please see our cookie policy.

Your rights

It’s important that you know your rights in relation to your personal data. This section should help you understand and exercise your legal rights.

You have rights under data protection law – they are complex, and subject to exemptions, and you can read guidance from the Information Commissioner’s Office at https://ico.org.uk/ for a fuller explanation of your rights. In summary, though:

• the right to withdraw consent: where our processing is based on your consent (as described above) you have the right to withdraw that consent at any time by notifying us, in which case we will stop the relevant use;

• the right to access: you have the right to confirmation as to whether or not we process your personal data and, where we do, to access to the personal data, together with certain additional information;

• the right to rectification: you have the right to have any inaccurate or incomplete personal data about you rectified or completed;

• the right to erasure: in some circumstances you have the right to the erasure of your personal data (for example, if the personal data are no longer needed for the purposes for which they were processed or if the processing is for direct marketing purposes);

• the right to restrict processing: you have the right to restrict the processing of your personal data to limit its use. Where processing has been restricted, we may continue to store your personal data and will observe the restrictions on processing except to the extent permitted by law;

• the right to data portability: you have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;

• the right to object to processing: you have the right to object to our processing of your personal data on the basis of legitimate interests (discussed above) or for direct marketing purposes and if you do so we will stop processing your personal data except to the extent permitted by law;

• rights regarding automated decision-making (see below): you have the right to request an explanation of how the decision was made, contest the decision and provide additional information for reconsideration, and request that a human reviews the decision instead of relying solely on the automated process; and

• the right to complain to a supervisory authority: if you consider that our processing of your personal data is unlawful, you have a legal right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Automated decision-making and profiling

We may carry out automated decision-making and profiling to evaluate a potential childminder’s health, qualifications and previous record to determine their suitability for the role. Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. Specifically, we use algorithms to analyse the answers you provide on these data points in the initial call booking form. This process is designed to ensure that applications are assessed fairly and consistently. The answers you provide in the form are automatically processed using predefined criteria to assess whether you meet the requirements for the role. If the results indicate that you do not meet the criteria, you may be informed that you are not suitable for the role at that early stage.

You will not be subject to decisions that will have a legal (or similarly significant) effect on you based solely on automated decision-making, unless we have a lawful basis for doing so. It is possible our processing of your data may significantly impact your employment opportunities, career progression and financial status, and may therefore constitute a significant effect under GDPR, meeting the criteria for automated decision-making. We rely on your explicit consent to conduct this processing, as required by law, unless the decision is necessary for the entry into, or performance of, a contract between you and us (i.e. for childminding services). Where we request your consent, we will provide clear information explaining that profiling will be provided, including its significance and the likely consequences.

We have implemented measures to safeguard your rights, freedoms, and legitimate interests, including periodic reviews of the automated decision-making process to ensure fairness, accuracy, and non-discrimination.

Separately, as part of our anti-money laundering and compliance obligations, we screen certain childminders (and, where relevant, their directors and company associates) against sanctions lists, politically exposed persons (PEP) databases and adverse media sources. This screening involves automated matching, but automated processing is only used to dismiss obvious non-matches. Any potential match that could affect you is always reviewed by a trained member of our team before any action is taken, so no decision producing legal or similarly significant effects is made solely by automated means. This screening is described more fully under "Anti-money laundering and compliance screening" above.

Exercising your rights

If you wish to exercise any of the rights set out above, please contact us at the contact details listed below (‘Contact Us’). You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Third Parties

The Site and App may contain links to third party websites and refer to third party service providers and other entities (including third party check providers such as DBS). If you follow a link to any third party website or deal with any third party referred to on the Sites, then they may have their own privacy and cookie policies, and we are not responsible for their use of any personal data which you may provide to them.

Amendments to this Notice and your duty to inform us of changes

We keep this Notice under regular review and may update it from time to time by publishing a new version on the Site and App. This version was last updated in July 2026 and comes into effect on 19th August 2026. You should check occasionally to ensure you are happy with any changes to this Notice, although we may notify you of significant changes to this Notice using the contact details you have given us, to enable you to review the changes before they become effective. If you object to any changes, you may close your account. Any changes will become binding on you upon your first use of our Site or services after the changes have been implemented.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Data protection registration

We are registered as a data controller with the UK Information Commissioner's Office. Our data protection registration number is ZA451440.

Contact Us

If you have any questions, comments or requests regarding this Privacy Notice or our use of any personal data you provide to us, please contact us at Tiney Limited, International House, 12 Constance Street, London, E16 2DQ or at data-protection@tiney.co

Last updated: 8th July 2026

Child-friendly privacy notice

Who are we?

We are tiney, a company which connects childminders with parents and guardians. We also provide an online platform which helps the childminder and parent or guardian make arrangements, make payments, and share information more easily when the childminder looks after the parent or guardian’s children.

We are registered as a childminder agency, which means we have to obey laws which apply to those sorts of agencies. Childminders also have to obey laws which apply to childminders.

If you have any questions about this notice you can contact us at data-protection@tiney.co – if you’re under 13 you should ask a parent or guardian to do this.

What is personal data?

“Personal data” means any information which relates to you. This could be your name or address, or it could be notes which relate to you (like a record of any allergies you may have, or your learning progress).

Why does tiney have your personal data?

We might receive personal data from your parent or guardian, or from the childminder who helps looks after you.

What personal data might tiney have?

We might have a few different kinds of personal data. Some of this is personal data which childminders are required to keep in order to comply with law. Our platform helps childminders and parents manage their childminding arrangements, and it’s helpful for that personal data to be stored on our platform. Some of this is personal data which might not be required by law, but which is useful to us when we provide our services connecting your parent or guardian and childminder. Here’s what we might have:

• Your name;

• Your date of birth;

• Your unique identifier;

• Your profile picture;

• Your address;

• Your language, gender and ethnicity;

• Your dietary requirements and health information, such as details of any allergies, treatments or special learning or physical requirements you may have;

• Details of your doctor;

• Details of any other educational settings you attend and contacts there;

• Details of any social worker you have;

• Details of your likes and dislikes, like favourite books, toys, interests or activities (or things you don’t like or want to do);

• Information relating to your parents or guardians, or friends or family members who have permission to drop you off and pick you up from your childminder, and who we would contact in an emergency;

• Records relating to your learning and other activities at your childminder, and when you were dropped off and picked up;

• Notes and messages which your parents or childminders might make or send on our platform, which might be about you;

• Photos which your parents or childminders might send each other through our platform, which might include you. If you or your parent or guardian have given consent for us, or for childminders, to do certain activities with you or to use photos for marketing, profile or journal purposes, we will have a record of that consent.

What do we do with your personal data, and why?

We mostly hold your personal data to help your childminder and parent or guardian make arrangements, make payments, and share information more easily when the childminder looks after you. Most of the time, we don’t look at that personal data ourselves because we don’t have any reason to. For example, if your parent sends a message to your childminder which says “Alex has a sore arm today, so please don’t do any physical exercise,” or if your childminder maintains a record of your allergies and emergency contact details, we won’t normally look at that information. However, we might review that information:

• if we have any reason to worry that childminding is not being conducted safely or properly. Because we are a registered childminder agency, we have to make sure that our childminders act properly. We also want to make sure that parents and guardians are happy with the childminding service.

• to help resolve any disagreements or questions between your parent or guardian and childminder.

• If there is an emergency. For instance we might need to check records relating to your health or who we can call in an emergency if you are hurt.

It is legal for us to hold and use this data for three main reasons:

• To comply with our legal obligations as a childminder agency.

• To provide our services and our platform to parents, guardians and childminders, which is useful to us (because that is what we do in our business) and to them (because our service is helpful to them). The childminder has to keep records to comply with their own obligations, and we help them manage that. The parents and guardians want to be able to set up and manage childminding arrangements easily, and we help them with that, too.

• If you or your parents have given consent (in relation to our use of photos, or some information relating to your health).

Where does your personal data go?

Your personal data will be shared between your parent or guardian and your childminder. We may also share it with companies who provide services to us, if needed for them to provide those services to us. Some of those companies might be located outside the UK, and even outside Europe. Finally, we may share personal data if we are required to by law.

How long do we keep your personal data?

We keep your personal data only as long as it is needed in order for us to use it for the purposes we’ve described. We have a detailed policy setting out different timings to delete different kinds of personal data.

Your rights. You and your parents or guardians both have the right to:

• be told how we use your personal data;

• ask to see the personal data we hold;

• ask us to change personal data if you think it is wrong;

• ask us to delete personal data when it’s not needed anymore;

• ask us to only use your personal data in certain ways; and

• complain to the regulator in charge of data handling in the UK, which is the ICO.

We have kept this notice short and clear. We have also provided a longer notice to your parent or guardian describing how we handle your personal data, and if you have any queries you can talk to them as well as us.

What to do if you have any questions:

If you have any questions, comments or requests regarding this Privacy Notice or our use of any of your personal data, please contact us at Tiney Limited, International House, 12 Constance Street, London, E16 2DQ or at data-protection@tiney.co, or by telephone at 020 4579 9034.

Last updated: 8th July 2026