Privacy Notice
How Young Modern Makers collects, uses and looks after personal information — for our interest list, our classes, and anything you send us.
On this page
Who we are
Young Modern Makers is a trading name of That's Child's Play Ltd, a company registered in England and Wales, company number 16177194. We run after-school clubs in London primary schools where children learn craft, textiles, mending and practical life skills.
That's Child's Play Ltd is the data controller for the personal information described in this notice, which means we decide how and why it is used.
You can contact us about anything on this page by email at info@youngmodernmakers.com. We will give you a postal address on request.
We are registered with the Information Commissioner's Office as a data protection fee payer, registration reference ZC247961.
We are a small organisation and are not required to appoint a Data Protection Officer. Data protection questions are handled by Naomi Mahendran, Founder.
This notice covers information collected through our interest list, class booking and registration, emails and enquiries you send us, and attendance at our classes and events. If you are a parent or carer booking for a child, it covers both your information and your child's.
What we collect, and why
If you join our interest list
| What we collect | Why | Lawful basis |
|---|---|---|
| Your first name and email address | To email you when classes open for booking, and occasional news about new terms, timetables and events | Consent (UK GDPR Art. 6(1)(a)); electronic marketing under PECR reg. 22 |
| Optional: child's first name, age group, school and year group, preferred days, free-text comments | To plan class sizes, times and venues | Consent |
Your name and email are needed to join the list — without them we cannot contact you. Everything else is optional and you can leave it blank. You can withdraw your consent at any time; see Your rights.
If you book a class
| What we collect | Why | Lawful basis |
|---|---|---|
| Parent or carer name, email, phone number and address | To administer the booking and contact you about your child's class | Contract (Art. 6(1)(b)) |
| Child's name, age, and school or year group | To place your child in the right group and keep accurate registers | Contract |
| Emergency contact details | To reach someone if your child is unwell or injured | Legal obligation and vital interests (Art. 6(1)(c), (d)) |
| Payment records | To take payment and keep required financial records | Contract and legal obligation |
| Attendance records | To run registers and account for children in our care | Contract and legitimate interests |
| Allergies, medical conditions, dietary needs, SEN or additional support needs | To keep your child safe and include them properly | Explicit consent (Art. 9(2)(a)); in an emergency, vital interests (Art. 9(2)(c)) |
| Photo and video permission, recorded separately and opt-in | Only if you agree — for our website, social media or printed materials | Consent |
Health, disability and SEN information is special category data and gets extra protection. We collect only what we need to keep your child safe, share it only with the staff who need it, and never use it for marketing. You may decline photo permission and it will make no difference to your child's place.
Safeguarding
If we have a concern about a child's welfare, we may record and share information with the local authority, children's social care, or the police, without your consent. We do this on the basis of legal obligation and substantial public interest in safeguarding children (Art. 9(2)(b) and (g), and Schedule 1 Part 2 of the Data Protection Act 2018). Wherever it is safe and appropriate to do so, we will tell you.
Children's information
Our classes are for children, but bookings are made by a parent or carer aged 18 or over. We do not knowingly collect information directly from a child, and we do not send marketing to children. If you believe a child has given us their details without your knowledge, email us and we will delete them.
Who we share your information with
We do not sell your information, and we never share it with third parties for their own marketing.
We use the following service providers, who handle data only on our instructions and under written contracts:
| Provider | What for | Where data is held |
|---|---|---|
| Google (Workspace: Forms, Sheets, Drive, Gmail) | Interest list, records and email | UK, EU and USA, under the UK Addendum to the EU Standard Contractual Clauses |
| Cloudflare | Hosting this website and its domain | Global network, under the UK Addendum to the EU Standard Contractual Clauses |
When we begin taking bookings we will add our booking, payment and mailing providers to this table before we start using them.
We may also share information with the schools and venues we work in, where they require a register of who is on site; with our insurers or legal advisers, if there is a claim or incident; with emergency services or medical staff, if your child needs urgent care; and with regulators and authorities, including the Information Commissioner's Office, a local authority or the police, where we are legally required to.
Transfers outside the UK
Some of our providers store data outside the UK. Where they do, the transfer is protected by either an adequacy decision or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, so your information keeps equivalent protection. You can ask us for details of the safeguards used.
How long we keep it
| Information | How long |
|---|---|
| Interest list details | Up to 12 months from your last interaction with us, then deleted |
| Marketing consent records | For as long as we hold your details, plus 12 months, so we can show consent was given |
| Unsubscribe records | Indefinitely, but only your email address, held solely so we don't contact you again |
| Booking, attendance and contact records | 3 years after your child's last class |
| Accident, incident and medical records | Until the child is 25, or longer if required |
| Safeguarding records | In line with local safeguarding partnership guidance, usually until the child is 25 |
| Financial and payment records | 6 years plus the current financial year, as HMRC requires |
When a retention period ends we delete the information securely, or anonymise it so it can no longer identify anyone.
How we keep it safe
- Access is limited to the people who need it, and reviewed each term
- All accounts holding personal data are protected with two-step verification
- We don't keep registers or contact lists on personal devices or in messaging apps
- Class emails are always sent so that other recipients' addresses are not visible
- We keep a record of what we hold, who we share it with, and when it is due for deletion
- If there is a data breach that puts anyone at risk, we report it to the Information Commissioner's Office within 72 hours and tell those affected
Your rights
Under UK data protection law you have the right to:
- Be informed — this notice
- Access a copy of the information we hold about you
- Rectification — have inaccurate information corrected
- Erasure — ask us to delete your information
- Restriction — ask us to pause how we use it
- Object — including an absolute right to stop us using your details for direct marketing
- Data portability — receive information you gave us in a portable format
- Withdraw consent at any time, where we rely on consent. Withdrawing does not affect anything we did before you withdrew
You also have the right not to be subject to automated decision-making. We do not use automated decision-making or profiling.
To exercise any right, email info@youngmodernmakers.com. We will respond within one month. It is free, and we will not ask why. If your request is unusually complex we may extend by two months, and we will tell you if so.
To unsubscribe from our emails, use the unsubscribe link in any email, or just reply and ask.
Complaints
If you are unhappy with how we have handled your information, please tell us first — email info@youngmodernmakers.com and we will try to put it right.
You also have the right to complain directly to the Information Commissioner's Office, the UK's data protection regulator, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Their helpline is 0303 123 1113, and you can complain online at ico.org.uk/make-a-complaint.