Toddler Town: Pop-Up Role Play ("we", "us", "our") is a sole trader business based in Tiverton, Devon. We are committed to protecting your privacy and handling your personal data responsibly. This privacy policy explains how we collect, use, store and protect your personal information when you use our website, book our services, or attend our events.
1. Who We Are
Toddler Town: Pop-Up Role Play is a sole trader business providing pop-up role play experiences for toddlers and young children across Devon and Somerset.
For any questions about this privacy policy or your personal data, you can contact us at: info@popup-toddlertown.co.uk.
2. What Data We Collect
We may collect the following personal information:
| Data | When & How |
|---|---|
| Name | When you submit our contact form, make a booking, or attend an event |
| Email address | When you submit our contact form or make a booking |
| Phone number | When you optionally provide it via our contact form or booking |
| Message content | When you submit an enquiry via our contact form |
| Booking details | When you book a session or party (dates, number of children, venue details) |
| Payment information | Processed securely by Stripe via Bookwhen — we do not store your card details |
| Allergy/health information | When you voluntarily disclose this for the safety of your child |
| Photographs | Only with your explicit consent at events, for marketing purposes |
| Website usage data | Automatically via Google Analytics and cookies (see section 7) |
3. How We Use Your Data
- To respond to your enquiries submitted via our contact form
- To manage and confirm bookings for sessions and parties
- To process payments (via our third-party providers)
- To ensure the safety and wellbeing of children at our events (e.g. allergy information)
- To communicate with you about your bookings, including reminders and updates
- To improve our website and services using anonymous analytics data
- To share marketing content such as photos from events (only with your consent)
4. Legal Basis for Processing
Under the UK General Data Protection Regulation (UK GDPR), we process your data on the following legal bases:
- Contract: Processing necessary to fulfil a booking or provide our services to you
- Legitimate interests: To respond to enquiries, improve our services, and manage our business
- Consent: For marketing communications and use of photographs. You can withdraw consent at any time by contacting us
- Legal obligation: Where we are required to retain data for tax, accounting, or legal purposes
5. Third-Party Services
We use the following third-party services which may process your data:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Formspree | Processes our contact form submissions | formspree.io/legal/privacy-policy |
| Bookwhen | Manages our session and party bookings | bookwhen.com/privacy |
| Stripe | Processes payments securely (via Bookwhen) | stripe.com/gb/privacy |
| Google Analytics | Collects anonymous website usage data | policies.google.com/privacy |
| Cloudflare | Hosts our website and provides security | cloudflare.com/privacypolicy |
We do not sell, rent, or share your personal data with any other third parties for their marketing purposes.
6. Data Retention
- Contact form enquiries: Retained for up to 12 months, then deleted
- Booking data: Retained for up to 24 months after your last booking, or as required for accounting and tax purposes
- Payment records: Retained for 6 years as required by HMRC
- Health/allergy information: Deleted promptly after the relevant session or party
- Photographs: Retained until you withdraw consent, at which point we will remove them from our marketing materials within a reasonable timeframe
- Analytics data: Anonymised and retained in accordance with Google Analytics' data retention settings
7. Cookies
Our website uses cookies to help us understand how visitors use the site and to improve your experience.
- Essential cookies — required for the website to function (e.g. Cloudflare security)
- Analytics cookies — Google Analytics uses cookies to collect anonymous data about page views, traffic sources and visitor behaviour. No personally identifiable information is collected.
You can control cookies through your browser settings. Disabling cookies may affect some functionality of the website.
8. Your Rights
Under the UK GDPR, you have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you
- Right to rectification — you can ask us to correct any inaccurate data
- Right to erasure — you can ask us to delete your data (subject to any legal obligations to retain it)
- Right to restrict processing — you can ask us to limit how we use your data
- Right to data portability — you can request your data in a portable format
- Right to object — you can object to our processing of your data
- Right to withdraw consent — where we process your data based on consent, you can withdraw that consent at any time
To exercise any of these rights, please contact us at info@popup-toddlertown.co.uk. We will respond to your request within one month.
9. Children's Data
Our services are designed for young children, but we collect personal data from parents and guardians rather than from children directly. Where health or allergy information is provided about a child, this is collected from and managed by the parent or guardian.
We do not knowingly collect personal data directly from children. If you believe we hold any data about a child that should be removed, please contact us immediately.
10. Photography at Events
We may occasionally take photographs or videos at our sessions and parties for marketing purposes. We will always ask for your explicit consent before including you or your child in any photographs. You can withdraw your consent at any time by contacting us, and we will remove the relevant images from our marketing materials within a reasonable timeframe.
Please note that other attendees at sessions may take their own photographs. We ask all attendees to obtain consent before photographing other people's children, as set out in our terms and conditions.
11. Data Security
- Our website is hosted on Cloudflare with SSL/HTTPS encryption
- Payments are processed securely through Stripe — we never see or store your card details
- Access to personal data is limited to those who need it to provide our services
- Third-party services we use are chosen for their security and compliance standards
12. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this page periodically.
13. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@popup-toddlertown.co.uk and we will do our best to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority. You can contact them at ico.org.uk or by calling 0303 123 1113.