Privacy Policy

Effective from: September 2026

Brick Robot Club Ltd (“we”, “us”, “our”) has designed this website to give you a great experience while respecting and protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights in relation to it.

This policy covers our website and the public club sessions and birthday party bookings made through it. Enquiries about our SEN/Alternative Provision (AP) and EOTAS services may begin through this website, but that service itself is delivered under a separate, tailored data-sharing agreement agreed directly with the referring school, local authority, or family — not under this website policy.

By using or registering on this website, you consent to this policy.

1. Principles of Our Policy

• Private — we will never sell, rent or trade your information to other companies.
• Secure — we follow strict security procedures, in line with UK GDPR, in the storage and disclosure of any information you give us.
• Necessary — we only collect information that helps us deliver our service to you or give you relevant, useful information.
• Proportionate to children’s safety — where we collect information about a child attending our sessions, we treat it with additional care given its sensitivity.

2. Data We Collect

We collect information in the following ways:

• Directly from you — for example, contact details you provide when booking a club session or party, or registering interest via a form.
• About the child attending — name, age, and, where relevant to keeping them safe during a session, information such as allergies, medical conditions, or additional needs you choose to share with us.
• Emergency contact details for the duration of a booking.
• Payment information — processed securely by our third-party payment provider; we do not store your full card details ourselves.
• Automatically from the website — basic technical information such as your IP address, collected as part of normal website security and spam prevention (see our Cookies section below).

3. Special Category Data (Health and Additional Needs Information)

Where you tell us about a child’s allergies, medical conditions, or additional needs, this is “special category data” under UK GDPR. We only collect this with your explicit consent at the time of booking, and only use it to keep the child safe and appropriately supported during the session. We do not use it for any other purpose.

4. How We Use Your Data

We use the information we hold about you to:

• Deliver and administer the club session or party you have booked, including managing supervision, safety and any medical/additional needs disclosed.
• Communicate with you about your booking (confirmations, changes, reminders).
• Send you information about our services where you have consented to this — you can opt out at any time.
• Meet our legal and safeguarding obligations.
• Keep the website secure and working properly, including protecting our forms from spam and abuse.

5. Legal Basis for Processing

We rely on the following legal bases, depending on the data and purpose:

• Consent — for special category data (e.g. medical/additional needs information) and for marketing communications.
• Performance of a contract — to process and deliver the booking you’ve made with us.
• Legal obligation — to meet safeguarding and record-keeping requirements.
• Legitimate interests — for keeping the website secure and functioning properly (e.g. spam/bot protection).

6. Data Retention

We keep personal data only as long as necessary:

• Booking and session records: retained for 2 years after the session, to support insurance, safeguarding, and administrative purposes.
• Safeguarding-related records (e.g. incident reports, disclosed medical or welfare information): retained for 7 years in line with standard safeguarding practice, or longer if required by law or an ongoing safeguarding matter.
• Marketing consent: retained until you withdraw consent.

7. Who We Share Your Data With

We use a small number of trusted third-party services to help run our website and communications, which may process your data. Where this happens outside the UK, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Addendum or an adequacy decision):

• Google reCAPTCHA — protects our sign-up and booking forms from spam and automated abuse.
• Mailchimp — email marketing, only for those who have opted in to hear from us.
• Our website host and payment processor — to run the site and process bookings/payments securely.

We do not sell, rent or trade your personal information to any third party.

8. Photography and Images

We may take photographs or video during sessions for promotional use (e.g. our website, social media, marketing materials). We will always ask for your explicit consent before using any image that identifies your child, and you can withdraw that consent at any time by contacting us — we will remove the image from future use as soon as reasonably practicable.

9. Cookies

Our website currently only uses cookies that are necessary for it to function properly — we do not use analytics, advertising, or tracking cookies at this time. Because of this, none of the cookies below require your consent under UK cookie law, though we list them here for transparency.

Cookies used on this site:

If we introduce analytics, advertising, or other non-essential cookies in future, we will update this policy and ask for your consent via a cookie banner before any such cookies are set.

10. Your Data Protection Rights

You can contact us at any time to:

• Request access to the information we hold about you.
• Correct any inaccurate information.
• Request deletion of your information, where applicable.
• Object to or request we restrict our processing of your data.
• Request a copy of your data in a portable format.
• Withdraw consent for marketing or for special category data processing at any time.

You also have the right to lodge a complaint with the UK’s supervisory authority, the ICO: https://ico.org.uk.

11. Children and This Website

This website is intended to be used by parents, guardians and carers on behalf of a child, not by children directly. We do not knowingly collect information directly from children without a parent or guardian’s involvement.

12. Contact Us

Brick Robot Club Ltd is a company registered in England and Wales (company number 16643458).

Registered address:
80b Sand Street, Longbridge Deverill, Warminster, Wiltshire, BA12 7DS

Data Protection Contact: Sam Ramsay
Email: sam@brickrobotclub.co.uk
Phone: 07771 703 884

13. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it was last revised. We encourage you to review it periodically.