Faye's Sitters

    Data Processing and Sub-Processor Policy

    Faye’s Sitters Limited · Company number: 16715542

    1. Purpose of This Policy

    This policy explains how Faye’s Sitters Limited (“we”, “us”, “our”) processes personal data, the third party processors we use, and the safeguards in place to ensure compliance with UK data protection laws.

    This policy supplements our Privacy and Data Protection Policy and Babysitter Agency Agreement.

    2. Roles Under Data Protection Law

    For the purposes of UK GDPR:

    • Faye’s Sitters Limited acts as Data Controller for personal data collected through the platform
    • Babysitters act as independent Data Controllers for any personal data they process directly while providing childcare services
    • Third party service providers act as Data Processors or Sub-Processors where applicable

    3. Categories of Personal Data Processed

    We process the following categories of personal data:

    Babysitters

    • Identity and contact details
    • Full date of birth
    • DBS certificate numbers and verification status
    • Right to work verification records
    • Qualifications and experience
    • Booking history and platform activity
    • Safeguarding and incident records

    Customers

    • Identity and contact details
    • Home address where childcare services take place
    • Booking details and communications

    Children

    • Month and year of birth
    • Basic medical or care related information provided by parents or guardians

    No photographs are stored.

    4. Purposes of Processing

    Personal data is processed for the following purposes:

    • Operating and administering the Faye’s Sitters platform
    • Facilitating bookings between Babysitters and Customers
    • Verifying DBS, right to work, and safeguarding compliance
    • Managing payments and payouts
    • Maintaining safety, quality, and regulatory compliance
    • Managing complaints, incidents, and safeguarding concerns
    • Communicating platform updates, newsletters, and promotions

    5. Lawful Bases for Processing

    Processing is carried out under one or more of the following lawful bases:

    • Performance of a contract
    • Legal obligation
    • Legitimate interests, including safeguarding and fraud prevention
    • Consent, where required for marketing communications

    6. Data Storage and Security Measures

    Personal data is stored primarily in Airtable, with access restricted to authorised personnel only. Appropriate technical and organisational measures are in place, including:

    • Role based access controls
    • Secure authentication
    • Limited access to safeguarding records
    • Regular review of permissions

    Payment and bank account details are processed and stored exclusively by Stripe. We do not store bank account or card details ourselves.

    7. Approved Sub-Processors

    We use the following third party processors to support our services:

    7.1 Airtable

    • Purpose: Secure storage and management of platform data
    • Data processed: Babysitter data, Customer data, safeguarding records
    • Location: May involve processing outside the UK, subject to appropriate safeguards
    • Safeguards: Standard contractual clauses and Airtable’s GDPR compliance measures

    7.2 Stripe

    • Purpose: Payment processing and payouts
    • Data processed: Payment information and bank account details
    • Location: May involve international data transfers
    • Safeguards: PCI DSS compliance and GDPR compliant processing agreements

    7.3 UCheck

    • Purpose: DBS checks and identity verification
    • Data processed: Identity information and DBS related data
    • Location: United Kingdom
    • Safeguards: Regulated DBS provider with GDPR compliant processing arrangements

    8. International Data Transfers

    Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including:

    • UK approved standard contractual clauses
    • Adequacy decisions where applicable
    • Processor level GDPR compliance commitments

    9. Data Retention

    We retain personal data in accordance with our retention policy:

    • Babysitter account data: duration of the relationship plus 2 years
    • DBS certificate numbers and right to work records: duration of the relationship plus 2 years
    • Safeguarding and incident records: 5 years
    • Customer account and booking data: duration of the relationship plus 2 years

    Data is securely deleted or anonymised when no longer required.

    10. Data Subject Rights and Requests

    We have procedures in place to respond to data subject rights requests, including access, rectification, erasure, and restriction. Requests should be directed to:

    Alys Gallagher
    Email: alys@fayes-sitters.com

    11. Personal Data Breaches

    We maintain internal procedures to identify, assess, and respond to personal data breaches. Where required, we will notify the Information Commissioner’s Office within 72 hours and affected individuals without undue delay.

    12. Babysitters’ Responsibilities

    Babysitters must:

    • Only use Customer and child personal data for the purpose of providing booked services
    • Keep such data secure and confidential
    • Not retain personal data longer than necessary
    • Report any actual or suspected data breach immediately to Faye’s Sitters Limited

    13. Review and Updates

    This policy is reviewed periodically and updated where necessary to reflect changes in law, technology, or processing activities.