Privacy policy

1. Who we are

Farrly is the trading name of Farrer Group Ltd, a company registered in England and Wales under company number 17561309. In this policy, “Farrly”, “we”, “us” and “our” refer to Farrer Group Ltd.

Our registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA. You can contact us about privacy at [email protected].

2. Our role and childcare providers

Farrly provides software to childcare providers and account access to their authorised staff, parents and carers. Our data protection role depends on why information is being used.

• Farrly as controller. We decide how and why we use information for account administration, platform security, service communications, provider onboarding, billing, support and the operation of our own business.
• Childcare providers as controllers. A provider normally decides why child, family, booking, attendance, collection and childcare records are created and used. The provider is responsible for its own privacy information, lawful basis, access decisions and retention requirements.
• Farrly as processor. Where we store or handle provider-controlled records only to supply the platform, we act on the provider's documented instructions.

If your question concerns a childcare record, contact the relevant provider first. We will assist the provider where required and will not disclose private records unless access is authorised.

3. Information we use

Depending on how you use Farrly, we may process:

• Account and identity information: name, email address, account identifiers, confirmation status, roles, organisation membership, site assignments and permissions.
• Provider information: organisation and legal names, provider type, site addresses, public contact details, services, schedules, capacity, policies, team access and commercial plan information.
• Child and family information: a child's preferred or display name and date of birth; parent, carer and authorised-contact names, email addresses and telephone numbers; relationships, invitations, permissions and collection authority.
• Booking and attendance information: selected services, dates, times, sites, prices, cancellations, credits, check-in, supervised transfers, check-out, collection verification and corrections.
• Account and payment information: balances, charges, credits, refunds, arrears, payment references and limited Stripe identifiers and statuses. Farrly does not store full payment-card details.
• Support and communications: messages, enquiries, notices, email delivery status and records needed to investigate or resolve a request.
• Technical and security information: sign-in and security events, device or browser information, IP address, request logs, timestamps and diagnostic information.

We receive information from you, childcare providers, other authorised account users, Stripe, and the systems used to operate and secure Farrly.

4. Why we use information

Where a childcare provider is the controller, the provider determines the lawful basis for its use of the information. Providers may need to rely on legal obligation, public task, contract, vital interests, legitimate interests or another lawful basis depending on their circumstances. Consent is not automatically the appropriate basis.

5. Children's information

Farrly is designed for use by adult childcare professionals, parents and carers. Children do not create Farrly accounts or use the platform directly. Adults enter and manage children's information to arrange and administer childcare.

Children's information requires particular protection. We use role and site permissions, keep booking and actual attendance distinct, limit access to authorised users, and do not use children's information for behavioural advertising or sell it.

A child has data protection rights in their own information. Depending on the child's age, understanding and circumstances, a parent, carer or other representative may be able to exercise those rights on the child's behalf. Requests are considered case by case and should normally be directed to the childcare provider responsible for the record.

6. Who we share information with

We share information only where needed for the purposes described in this policy, including with:

• the childcare provider and its specifically authorised staff;
• parents, carers and contacts whose access has been authorised for the relevant child or account;
• suppliers that provide hosting, database, security, support and transactional-email services under contract;
• Stripe and relevant banks or card networks for provider onboarding, payment processing, refunds and disputes;
• professional advisers, insurers, auditors and potential corporate transaction parties subject to appropriate confidentiality; and
• regulators, courts, law-enforcement bodies or safeguarding authorities where disclosure is required or permitted by law.

Some suppliers may process information outside the UK. Where UK data protection law requires it, we use an adequacy regulation or approved contractual safeguards and assess whether further protections are needed.

We do not sell personal information.

7. Cookies and similar technology

The public website does not currently use advertising or non-essential analytics cookies. The application uses essential technology to keep users signed in, protect forms, remember short-lived invitation state and maintain security. These features are necessary for the service to work and cannot be switched off through a cookie preference tool.

If we introduce non-essential cookies, we will update this policy and request consent where required.

8. How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including contractual, safeguarding, tax, accounting, dispute and legal requirements.

Provider-controlled records are kept in accordance with the provider's instructions and retention responsibilities. When a provider's service ends, we delete or return those records as agreed, except where the law requires continued storage or limited information must be retained to establish or defend legal claims. Back-up copies are removed through the normal secure rotation process.

Retention periods vary by record type. Contact us or the relevant provider if you need the period that applies to a particular record.

9. Security

We use technical and organisational measures intended to protect personal information, including access controls, encrypted connections, secure account credentials, audit records, environment separation and restricted administrative access. No internet service can guarantee absolute security. Please tell us promptly if you believe an account or record has been compromised.

10. Your rights

Depending on the circumstances, you may have the right to:

• receive information about how your personal information is used;
• request access to it and a copy of it;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased or its use restricted;
• object to processing based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent where consent is the lawful basis, without affecting earlier lawful use.

These rights are not absolute. We may need to verify your identity and authority before acting. If a childcare provider controls the record, we may pass the request to that provider or ask you to contact it directly.

Farrly does not make decisions producing legal or similarly significant effects about children or account users solely by automated means.

11. Changes to this policy

We may update this policy when our service, suppliers or legal obligations change. We will publish the updated version here and change the date above. We will provide a more prominent notice where a change materially affects how we use personal information.

12. Contact and complaints

For questions or requests about Farrly's use of information, email [email protected]. For provider-controlled childcare records, contact the relevant provider first.

You can also complain to the Information Commissioner's Office. Visit ico.org.uk/make-a-complaint or telephone 0303 123 1113. We would welcome the opportunity to address your concern before you contact the ICO.