Privacy Policy

Last updated: 06/05/2026

This Privacy Policy explains how Nurturing Positive Beginnings (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit our website, create an account, book classes, or otherwise interact with us.

By using our website www.nurturingpositivebeginnings.com and our services, you agree to this Privacy Policy. If you do not agree, please do not use the website or our services.

Who we are
Nurturing Positive Beginnings provides baby massage courses, sensory play groups, and parenting support and baby workshops in Worcester and surrounding areas of Worcestershire, Bromsgrove, Redditch, and Tardebigge.

Nurturing Positive Beginnings is the controller of your personal data when you use this website and our services.

Owner: Gemma Laisley (qualified Health Visitor and Children’s Nurse)
Website: www.nurturingpositivebeginnings.com
Contact details for data protection queries:

Email: nurturingpositivebeginnings@hotmail.com

The ICO expects privacy notices to clearly identify the organisation responsible and provide contact details for data protection queries.

What personal data we collect
We may collect and process the following personal data about you:

Identity data: name, title, and (where relevant) your child’s name and age.
Contact data: email address, telephone number, and (if needed) postal address.
Account data: login details, password, and information in your profile or booking history.
Booking data: classes you book, dates and times, attendance, and any notes you provide that help us deliver the class.
Payment data: payment status, transaction references, and limited payment information processed via our payment provider (we do not store full card details).
Communication data: messages and enquiries you send by email, website forms, or social media.
Marketing data: your preferences for receiving updates, newsletters, or offers.
Technical and usage data: IP address, browser type, device identifiers, and information about how you use our website (collected via cookies and similar technologies).

UK GDPR requires that privacy notices describe the categories of data collected in clear, specific terms.
Special category data (e.g. health information)

In some cases, you may choose to provide information about your baby’s health or development (for example, colic, reflux, or other conditions) to help us adapt our classes and support you appropriately.
Where we process this type of information, it is considered special category data under UK GDPR, and we will only do so with your explicit consent and where necessary to provide our services (for example, to tailor activities or ensure your baby’s comfort and safety).

You do not have to share health information with us, but if you do, we will restrict access to it, store it securely, and keep it only for as long as necessary for the purpose it was collected.

How we collect your data
We collect data when you:

Browse our website.
Create an account.
Book a class or workshop online.
Complete forms, questionnaires, or feedback surveys.
Contact us by email, phone, social media, or via our website.
Sign up to receive news or marketing communications.

We also collect some technical data automatically through cookies and similar technologies when you use the website.

How we use your data
We use your personal data to:

Create and manage your account on our website.
Allow you to book and manage classes and workshops.
Process payments and send confirmations and reminders.
Provide you with information and support related to your booking or enquiry.
Personalise and improve our services and website.
Send updates and marketing communications (where permitted).
Maintain records for tax, accounting, and legal obligations.
Help keep our website and services secure and prevent fraud or misuse.

Privacy notices should explain the purposes of processing in a way that is clear and meaningful for users.
Lawful bases for processing

Under UK GDPR, we must have a lawful basis for each way we use your personal data.

We rely on the following lawful bases:

Contract: to register your account, manage bookings, take payments, and provide the classes and support you have requested.
Legitimate interests: to improve our services, respond to enquiries, run our business, keep the website secure, and send service-related communications that are not marketing.
Legal obligation: to keep records required by tax, accounting, and other laws.
Consent: to send you marketing communications by email or SMS where required, and to use non-essential cookies and similar technologies.
Explicit consent and provision of health or social care: for any processing of health-related information about you or your baby, where this is necessary to provide our classes and support.

Where we rely on consent, you can withdraw it at any time using the unsubscribe link in our emails or by contacting us.

Cookies and similar technologies
Our website uses cookies and similar technologies to:

Make the site work and keep it secure (strictly necessary cookies).
Remember your preferences and help with bookings.
Understand how visitors use our website (for example, via analytics).

Under the Privacy and Electronic Communications Regulations (PECR), we can use strictly necessary cookies without your consent, but we need your consent for most other cookies (for example, analytics and marketing cookies).

When you first visit our website, you will see a cookie banner giving you the option to accept or reject non-essential cookies. You can change your cookie preferences at any time via [link to cookie settings or instructions].

For more detail about the cookies we use, please read our Cookie Policy [link], which forms part of this Privacy Policy.

Sharing your personal data
We may share your personal data with:

Website and hosting providers that help us run the site.
Online booking and scheduling providers, where used.
Payment service providers that process your payments securely.
Email and communications providers that help us send messages and newsletters.
IT and security providers that support and protect our systems.
Professional advisers (such as accountants, lawyers or insurers) where necessary.
Government bodies or law enforcement if we are required to do so by law.

We only share the minimum amount of personal data necessary, and we do not sell your data to third parties.

How long we keep your data
We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to satisfy legal, accounting, or reporting requirements.

In general:

Account and booking records are kept while you have an active relationship with us and for up to [e.g. 6 years] afterwards where needed for tax and legal reasons.
Health-related information (if provided) is kept only for as long as necessary to deliver the relevant class or support and for a limited period afterwards, then securely deleted or anonymised.
Marketing data is kept until you unsubscribe or we determine that our communications are no longer relevant.

We will review our retention periods regularly to ensure data is not kept for longer than necessary.

Keeping your data secure
We use a combination of technical and organisational measures to protect your personal data, including secure hosting, access controls, and password protection.

While no system is completely secure, we aim to reduce the risk of loss, misuse, unauthorised access, or disclosure and we limit access to your data to people who genuinely need it to perform their role.

Children’s data
Our services are aimed at parents and carers of babies and young children, rather than at children directly.
We do not knowingly allow children to create their own accounts on this website, and any information about your baby or child should be provided by a parent or legal guardian. The ICO’s Children’s Code emphasises that services likely to be accessed by children must take particular care with children’s data and profiling.

If you believe that a child has provided us with personal data directly, please contact us so we can delete it where appropriate.

Marketing communications
If you opt in to receive news, updates, or offers from us, we will use your contact details to send you those marketing communications.

You can opt out at any time by clicking “unsubscribe” in our emails or by contacting us using the details above. We will still send you service messages about your bookings or important changes to our services, as these are not marketing.

Your data protection rights
Under UK data protection law, you have rights including:

Right of access – to ask for a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to ask us to delete your data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain cases.
Right to object – to object to processing based on our legitimate interests or to direct marketing.
Right to data portability – to ask us to transfer your data to you or another organisation in a structured, commonly used format in some circumstances.
Right to withdraw consent – where we rely on consent, you can withdraw it at any time.

You can exercise these rights by contacting us using the details in the “Who we are” section.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we use your personal data: www.ico.org.uk.

Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services or the law.

When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the website.