Data processing agreement
Last updated October 2026
This agreement is made under Article 28 of the UK GDPR between the childcare setting holding a BeehiveKin account (the controller) and TO BE CONFIRMED (the owner of BeehiveKin, full legal name), a sole trader trading as BeehiveKin, of TO BE CONFIRMED (business address) (the processor). It forms part of the terms of service and takes effect when the account is created. Version 2026-10-20.
Your local authority may ask to see a written arrangement with anybody processing data on your behalf. This is that document. You do not need to sign anything: it applies to every account, and you can download or print this page.
1. Roles
You are the controller of the personal data you keep in BeehiveKin about children, their guardians and your staff. You decide what is held and why. We are your processor and act only on your instructions, which are given by your use of the service and by anything you ask us in writing. We will tell you if we think an instruction breaks data protection law.
We are a controller in our own right only for your account itself, which our privacy notice covers.
2. What we process (Annex 1)
Subject matter and duration
Providing BeehiveKin to you, for as long as your account is active, plus the deletion window in clause 9.
Nature and purpose
Storing, organising, retrieving and displaying your records; generating contract and consent PDFs; emailing signing links to the guardians you name; keeping your attendance register and learning journal; and producing exports when you ask for them.
Categories of data subject
- Children in your care.
- Their parents, guardians and emergency contacts.
- You and anyone you give access to your account.
Categories of personal data
- Children: name, date of birth, gender, address, photograph, key person, and the observations and attendance you record.
- Guardians: name, relationship, whether they hold parental responsibility, email, phone and address.
- Contracts and consents, their signature images and the generated PDFs; documents you upload.
Special category data
Allergies, dietary requirements and special educational needs or disability information, which is health data under Article 9. It is held because a setting cannot keep a child safe without it, on the lawful basis you have established as controller.
3. Our obligations
- Process the data only on your instructions, and only to provide the service.
- Never sell it, share it for marketing, or use it to train machine-learning models.
- Keep it confidential. Access is limited to the people who need it to run or support the service, each under a duty of confidence.
- Help you meet your own obligations under Articles 32 to 36.
4. Security (Annex 2)
The measures we have in place today:
- Passwords hashed with Argon2id; the password itself is never stored or visible to us.
- Two-step sign-in available for account owners, with lockout after repeated failed attempts and biometric lock on the mobile app.
- Strict separation between settings: every query and every file link is scoped to one account, and routes refuse access by default rather than granting it.
- Data encrypted in transit with TLS, and at rest by our hosting providers.
- Time-limited signed links for every file download, so no file URL is public.
- A three-node replicated database with provider-managed backups, and an audit record of actions taken through our support console.
We will keep these under review and will not weaken them while you are a customer. We do not currently hold ISO 27001 or a SOC 2 report, and we will not imply otherwise.
5. Sub-processors
You authorise the suppliers below. Each is bound by terms no weaker than these.
| Sub-processor | What for | Where |
|---|---|---|
| Railway | Application hosting, and Redis for sign-in sessions and rate limits | European Union |
| MongoDB Atlas | The database holding child, guardian, contract and consent records | Ireland (eu-west-1) |
| Amazon Web Services (S3) | Signed PDFs, photographs and uploaded documents | London (eu-west-2) |
| Resend | Sending invitations, signing links and account emails | European Union and United States |
| Sentry | Crash reports from the mobile app, with personal data switched off | European Union |
We will give you at least 30 days’ notice by email before adding or replacing one. If you object on reasonable data protection grounds, you may end your subscription and export your records, and we will refund the unused part of the period.
6. International transfers
Your records are held in the United Kingdom and Ireland. Ireland is in the EEA, which the UK’s adequacy regulations cover. Resend, which delivers our email, may process message content in the United States under the UK extension to the EU-US Data Privacy Framework and standard contractual clauses. We will not move your records outside the UK or the EEA without telling you first.
7. Helping you with data subject requests
If a parent or guardian asks you for a copy of their child’s records, asks for a correction, or asks for deletion, you answer them: the records are yours. The product is built so you can do it without us. An account owner can export everything the setting holds, at any time, from the app, and can correct or delete individual records directly.
If a request reaches us instead, we will refer the person to you and tell you within five working days. Where you need more help, we will give it without charge for a reasonable volume of requests.
8. Personal data breaches
We will tell you without undue delay, and in any event within 48 hours of becoming aware of a breach affecting your data. We will say what happened, which categories of data and roughly how many people are affected, what we are doing about it, and what we suggest you do. The 72 hour deadline for notifying the ICO is yours as controller, which is why ours is shorter.
9. Return and deletion
- Export at any time, by the owner, from the app. We never hold your records hostage to an unpaid invoice.
- Deleting your account schedules the deletion rather than performing it: nothing is destroyed for 30 days, and you can call it off in that window.
- After that window we delete your records from the live systems. Backups age out on our providers’ schedules, after which no copy remains.
- Invoices and payment records are the exception, kept six years for HMRC. They contain your business details, not children’s records.
- You decide how long your statutory records must be kept, because that duty is yours. Export before you delete.
10. Audit
On reasonable notice, and no more than once a year unless a breach or a regulator requires it, we will answer your written questions about how we handle your data and provide the evidence we have. We will accept an inspection by you or an auditor you appoint where a regulator or a documented local-authority requirement calls for one, at your cost, arranged so that other customers’ data stays private.
11. Liability and law
The liability provisions in the terms of service apply, except that the cap does not limit what we owe you for our own breach of this agreement. This agreement is governed by the law of England and Wales.
Contact
Data protection questions, breach reports and audit requests: community@beehivekin.com. TO BE CONFIRMED (the owner of BeehiveKin, full legal name), trading as BeehiveKin, TO BE CONFIRMED (business address).