GDPR & UK Data Protection Policy

Pebblhub is a childcare management platform operated by inSylos Group. We act as a data processor on behalf of nurseries and childcare settings (the data controllers) who use our platform to manage their operations and communicate with families.

For the purposes of UK GDPR, our data protection contact is: support@pebblhub.com

We process personal data on the following lawful bases:

•Contract performance — to deliver the platform services agreed with nursery operators.

•Legitimate interests — to improve our services, ensure platform security, and prevent fraud.

•Legal obligation — where processing is required to comply with applicable law.

•Consent — where we rely on consent (e.g. optional marketing communications), individuals may withdraw it at any time.

Where nurseries use Pebblhub to process children's data, they are responsible for establishing their own lawful basis (typically contractual necessity with parents or legitimate interests under safeguarding obligations).

Through the platform, nurseries may process:

•Children's data — name, date of birth, health and medical information, daily activity records, attendance, photos and videos, incident reports.

•Parent/guardian data — name, contact details, payment information, communication records.

•Staff data — name, contact details, role, attendance, activity logs.

•Nursery operational data — billing records, invoices, scheduling, analytics.

Pebblhub processes this data solely as instructed by the nursery operator and does not use it for any independent commercial purpose.

Data is retained for the duration of the nursery's active subscription plus a 90-day grace period following account closure, during which the nursery may export their data. After this period, all personal data is permanently deleted from our systems unless a longer retention period is required by law.

Nurseries should define their own retention schedules in line with applicable regulations (e.g. Ofsted requirements in England, KHDA requirements in the UAE).

Under UK GDPR, individuals have the right to:

•Access — request a copy of personal data held about them.

•Rectification — request correction of inaccurate data.

•Erasure — request deletion of personal data ("right to be forgotten").

•Restriction — request that processing be restricted in certain circumstances.

•Portability — receive personal data in a machine-readable format.

•Object — object to processing based on legitimate interests.

To exercise any of these rights, contact your nursery administrator in the first instance (as the data controller), or contact Pebblhub at support@pebblhub.com if your request relates to Pebblhub's own data processing.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Pebblhub stores data on cloud infrastructure hosted within the EU/EEA and the United Kingdom. Where any transfer outside these regions is necessary, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO.

We do not sell or transfer personal data to third parties for their own commercial purposes.

We implement industry-standard technical and organisational measures to protect personal data, including:

•Encryption in transit (TLS 1.2+) and at rest (AES-256).

•Role-based access controls — staff only access data relevant to their role.

•Regular security assessments and penetration testing.

•Incident response procedures with breach notification within 72 hours where required by law.

For UK GDPR queries or to exercise your data rights, contact us at:

Email: support@pebblhub.com

Subject line: "Data Protection Request"

We will respond to all requests within 30 days.