Privacy Policy for Babyzone (Charity number: 1198316)

This Privacy Policy describes the information that Babyzone gathers on, or through, its website and associated services (together, our “site”) and how the information is used and processed. For each processing purpose, the reason the data is needed, what data is processed, the legal basis for processing the data, and how long the data will be kept are articulated.

Where the legal basis of consent is to be used, it will be gathered freely, in clear, plain language that is easy to understand, and the consent can be removed at any point.

References in this Privacy Policy and on the site to “we”, “our” or “us” refer Babyzone (Charity number: 1198316) and its affiliates. References to “you” and “your” mean each natural or legal person who uses the site.

  1. What Information Do We Collect About You and How Do We Use It?

Babyzone collects/processes information to provide the best possible experience when you use our site. This section of the policy describes the purpose for processing your Personal Data, the legal basis to do so, and how long data is kept.

"Personal Data" has the meaning given to it in the Data Protection Laws.

"Data Protection Laws" means any and all laws, statutes, enactments, orders or regulations or other similar instruments of general application and any other rules, instruments or provisions in force from time to time relating to the processing of personal data and privacy applicable to the performance of this Agreement, including where applicable the Data Protection Act 2018, the Regulation of Investigatory Powers Act 2000, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) and the GDPR (Regulation (EU) 2016/679), as amended or superseded.

Babyzone does not collect any Special Categories of Personal Data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, or information about your health).

  • Our Web Site and Services

If you choose to use the site or services, including receiving email notifications, newsletters and product/service updates, attending webinars, attending sessions, other services that support you in raising young children, donating/fundraising and research and analysis, you may need to provide Babyzone with some Personal Data. This may include your name, email address, postal address, payment details and IP address. Other non-mandatory Personal Data may also be gathered if you choose to provide it.

Babyzone processes your personal data on the following legal bases:

  • Consent: We will rely on your consent for specific processing activities. You can withdraw your consent at any time by contacting us using the details below or by following the unsubscribe instructions in our marketing emails.
  • Legitimate Interests: In some cases, we may process your data based on our legitimate interests, provided these interests do not override your rights and freedoms. We have carefully balanced our interests against your rights before relying on this basis.
  • Contractual Necessity: We may process your data to fulfill a contract we have with you.
  • Legal Obligation: We may process your data to comply with legal requirements.
  • Legal Claims: We may process your data to establish, exercise, or defend legal claims."

Babyzone will retain Personal Data for active leads or site users for a period of up to two (2) years. A lead will be active under the following circumstances:

  • An email sent by Babyzone has not received an unknown account bounce back
  • An email or contact us form has been sent to us from the data subject
  • Marketing

Babyzone would like to send you information about new or existing products and services, or content resources that may be of interest. You have a right at any time to stop us from contacting you for marketing purposes. To distribute marketing information, Babyzone may use personal data such as names, addresses, email addresses, employer details, job titles, telephone numbers, and LinkedIn profiles.

If you request or consent to be added to mailing or marketing lists, Babyzone will use consent as the legal basis to process your Personal Data.

If you haven’t requested to be added to mailing or marketing lists, Babyzone will process Personal Data using the following legal rationale to send marketing information: if your role within an organization is associated with any of:

  • Marketing
  • Fundraising
  • Charity Work

Then Babyzone will use legitimate interest as the legal basis to process the data. Babyzone uses this legal basis after completing a legitimate interest assessment process. The assessment states Babyzone will only send low volume, customized messages to business email addresses who, based on their job role, would have a legitimate interest in marketing attribution and customer data, and may find our product useful. If you do not want Babyzone to contact you, an unsubscribe facility will be provided within the emails, or you can email us at dp@babyzone.org.uk.

Babyzone will retain Personal Data for active leads for a period of up to two (2) years. A lead will be active under the following circumstances:

  • An email sent by our organization has not received an unknown account bounce back
  • An email has been sent to us from the data subject
  • The Baby Buddy App
    • Third-Party Links

The App may, from time to time, contain links to and from websites of third parties. This Privacy Notice does not apply to the practices of any third parties that we do not own or control, such as third-party websites that you choose to access through the App, for example, Facebook. While we attempt to provide access only to third-party services that share our respect for privacy, we cannot take responsibility for such third parties. We advise you check their privacy policies before providing your information to them.

  • NHS Login

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS England’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

  • Information We May Collect From You

‘Personal data’, or ‘personal information’, means any information relating to an identifiable individual. It does not include data where the identity of to whom it belongs is not known (anonymous data).

We may collect, use, store and transfer different kinds of personal data which we have grouped together as follows:

  • Child Profile Data includes information about babies, such as their name, gender and due date and images. Where you upload such information, you confirm that you are consenting on the baby’s behalf to such sharing, as their parent or legal guardian.
  • Contact Data includes email address.
  • Development Data includes measurements on the growth of the child, recording of vaccinations and developmental milestones.
  • Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, date of birth and gender.
  • Image data in the form of photographs that you upload to the App.
  • Location Data includes information about your location, which may include general location information (e.g. your postcode) and more specific information based on the specific location of your device (e.g. GPS-based functionality).
  • Marketing and Communications Data includes your preferences in receiving marketing from us and our selected third parties and your communication preferences.
  • NHS Data includes data obtained from NHS login permissions, and child health data obtained through the NHS National Events Management Service.
  • Profile Data includes your username and password, feedback and survey responses, information about the pregnancy, such as the type of user you are (e.g. mum, dad, midwife, grandparent, other contact), the due date, whether there will be a multiple birth (e.g. twins), your relationship status (e.g. with partner, single), whether this is a first baby, whether the baby is being breastfed, your goals (e.g. to stop smoking, stop drinking alcohol, eat healthier, exercise more).
  • Search Data comprises information requested in in-App searches.
  • Sensitive Data includes physical or mental health or condition, for example about the pregnancy.
  • Survey Data includes information which you provide to us by completing surveys or polls.
  • Technical Data includes internet protocol (IP) address, your login data and operating system.
  • Transactional Data includes details of transactions you have carried out through the App and the completion of your orders and, where you accessed chargeable services, your billing information and credit card or other financial information;
  • Usage Data includes information about how you use our App. This is statistical data so that we can look at how you use the App and how we can make it better, and which allows us to carry out statistical research to analyse information to identify trends or patterns to help us improve services for mothers and babies.
  • Cookies are small files containing a line of text that may be sent and stored on your computer when you visit a website. Cookies help to provide a better and faster experience by helping a website remember information about your visit to make your next visit easier and the site more useful to you. More information on the use of cookies on our App can be found here.

We collect this data when you give it to us directly, when signing up and using our app, or when you share it via your NHS login.

It is our intent to ensure that personal data collection is limited to what is relevant and essential to the use and security of our App.

  • What we might do with that Information

We process personal information for the following purposes:

  • To enable Best Beginnings to broadly meet its Data Protection obligations in relation to how personal information is managed;
  • To demonstrate that we are accountable for such processing in accordance with Article 5(2) of the GDPR;
  • To support our charitable aims and objectives and our legitimate interests;
  • To safeguard members, members families and any other individuals should we judge they may be at risk;
  • To set appropriate systems and control according to our technical and organisational standards;
  • To ensure data protection is built into the design of new projects which include the processing of data, so that data privacy is evidenced by default;
  • To safeguard personnel and stakeholder interests.
  • To provide you with a service (the use of our app).

All data is encrypted, so we are not able to identify individual users on the Baby Buddy application.

  • How Long do we keep your Information?

We may keep information for different time periods depending upon the purposes for which it was collected. This may be determined by legal and operational considerations. For example, we are legally required to hold certain types of information to fulfil our statutory and regulatory obligations which may include but are not limited to Health and Safety Regulations, tax and for accounting purposes.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.

We will only ever share your data in other circumstances, if we have your explicit and informed consent.

We ensure that there are appropriate technical controls in place to protect your personal details, including data collected through our Baby Buddy WhatsApp Assistant.

  • We retain personal data of Baby Buddy app users for a period of 15 years
  • We retain personal data of donors and supporters for a period of 10 years
  • We retain personal data of Champions/Parent Panel members for a period of 10 years

After this time, personal data is reviewed and securely destroyed.

  • Community Chat Groups

Babyzone offers a Community Group Chat via WhatsApp for Business to provide parents with a platform for:

  • Sharing information and experiences related to parenting and child development.
  • Receiving timely updates and announcements from Babyzone.
  • Connecting with other parents in a supportive environment.

Data Processing:

To facilitate the Community Group Chat, Babyzone will process the following personal data, WhatsApp Phone Number, Profile Name, Group Chat Messages: Any messages, photos, videos, or other content you share within the group.

The purpose of this group chat is to facilitate community interaction and the sharing of information between parents, and to provide updates from Babyzone.

We will process your personal data for this purpose based on your consent. By joining the Community Group Chat, you are providing your explicit consent to the processing of your WhatsApp phone number, profile name, and group chat messages for the purposes outlined above. You can withdraw your consent at any time by leaving the group.

Data Retention:

  • WhatsApp Phone Number and Profile Name: Babyzone will retain your WhatsApp phone number and profile name for as long as you remain a member of the Community Group Chat. Upon leaving the group, your phone number and profile name will be removed from the group's participant list. However, please be aware that WhatsApp retains its own records of group participation.
  • Group Chat Messages: Messages shared within the group chat will be retained for a period of [Specify a retention period, e.g., 3 months, 6 months, or until the group is archived] to facilitate the smooth running of the community. After this period, messages will be deleted. However, please be aware other group members may retain information that you have shared. Also, Whatsapp will retain its own records of messages.
  • If the group is archived, all data within the group will be deleted.
  • Cookies

Like many websites, Babyzone uses cookies and similar technologies to collect additional site usage data and to improve our services. Site usage information is collected using cookies to monitor aggregate site usage metrics such as total number of visitors, pages viewed, and web traffic routing on our services.

Babyzone will process Personal Data under the legitimate interest legal basis as we only use the data to perform aggregated tracking analysis and will not target individuals based upon this analysis. You will also need to accept our cookie policy to allow us to process the data.

Active cookie data will be retained for a period of up to one (1) year. A cookie will remain active if a user re-visits our site.

Learn more about how Babyzone uses cookies by visiting the cookie policy on our website.

  1. Updating This Policy

Babyzone may change or update this Privacy Policy at any point so that it accurately reflects our services, if we believe it does not fundamentally change your data privacy rights. If we believe your rights have been affected, users will be contacted 30 days before the change is implemented. If you continue to use the site once the Privacy Policy has been updated or amended, you will be bound by the updated Privacy Policy. If you do not want to agree to any updated or amended Privacy Policy, please stop using the site.

  1. Your Rights
    • Accessing or Rectifying your personal data Updating This Policy

In most circumstances, before your rights can be invoked, verification as the data subject may be needed. Data will be requested from you and checked against our records before proceeding.

We want to make sure that your personal information is accurate and up to date, and you have the right to request a copy and update the Personal Data that we hold about you. You may ask us to correct or remove information you think is inaccurate. If you would like to invoke this right, please email or write to us at dp@babyzone.org.uk or DP – Babyzone, Scale Space, 58 Wood Lane, London, W12 7RZ.

  • Deletion

Based upon the retention periods described above, Personal Data will be removed from our platforms.

  • Object, Restrict, or Withdraw Consent

You may wish to object to or restrict our ability to process your Personal Data. This can be done either via email or in writing, using the contact details below. Further context may need to be requested to ensure the relevant tasks can be carried out to perform the request.

You can also opt out of receiving emails or updates at any point.

  • Portability

You may wish to port your Personal Data to another platform. If you would like to invoke this right, please email or write to us at dp@babyzone.org.uk or DP – Babyzone, Scale Space, 58 Wood Lane, London, W12 7RZ.

  1. Who We Are And How To Contact Us

This Privacy Policy is issued on behalf of the Babyzone group of companies, so when we mention “Babyzone”, “we”, “us” or “our” in this Privacy Policy, we are referring to the relevant company in the group responsible for processing your data. Babyzone is the data controller and is responsible for this website.

Our company name is: Babyzone

Our company address is: Scale Space, 58 Wood Lane, London, W12 7RZ.

Our email address is: dp@babyzone.org.uk

  1. To Whom We Disclose Information

Except as described in this Privacy Policy, Babyzone will not intentionally disclose the Personal Data that is collected or stored to third parties without the consent of the data subject. Information may be disclosed to third parties if you consent to us doing so, as well as in the following circumstances:

Unrestricted Information

Any information that you voluntarily choose to include in a public area of the site will be available to any visitor or user who has access to that content.

  1. Service Providers

We work with third-party service providers who provide email hosting, core corporate applications, web hosting, maintenance, advertising, marketing, and other services for us. These third parties may have access to, or process Personal Data as part of providing those services for us. We limit the information provided to these service providers to that which is reasonably necessary for them to perform their functions, our contracts with them require them to maintain the confidentiality of such information, and we ensure a privacy impact assessment and data processing agreement is conducted with each third party before any Personal Data is shared to ensure privacy compliance with applicable laws at all time. An up-to-date list of our service providers can be found at the end of this policy.

  • Overseas transfers

The information you provide may be transferred to countries outside the UK or European Economic Area (EEA). However, we will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland, and Liechtenstein. By submitting your information, you consent to these transfers for the purposes specified above.

We may transfer your personal information to our service providers located outside of the UK or EEA as specified in the list of service providers which can be found at the end of this policy.

All of our International service providers have each provided the information to demonstrate they have appropriate technical and organizational measures in place to safeguard Personal Data, and it shall be processed to at least the same standards as set out by the General Data Protection Regulations. Each organization has entered into Standard Contractual Clauses with Hive Learning, which is accepted by the European Commission as evidence that an adequate level of protection exists for the Personal Data in the country, territory, or organization where it is being transferred.

  • Non-Personally Identifiable Information

We may make non-personally-identifiable information available to third parties for various purposes. This data may be automatically-collected and would be analysed to create an aggregated view of the data, ensuring the reported information was anonymous.

  1. Law Enforcement, Legal Process, and Compliance

We may disclose Personal Data or other information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a valid court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies.

  1. Change of Ownership

Information about data subjects may be disclosed and otherwise transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets and only if the recipient of the Personal Data commits to a privacy policy that has terms substantially consistent with this Privacy Policy.

  1. Our Data Security

We have appropriate security measures in place to prevent personal information from being accidentally lost, used, or accessed in an unauthorized way, and we regularly review and maintain these measures to ensure they are always fit for purpose.

  1. Complaints

If you are not happy with this privacy policy, or you wish to speak to a supervisory authority, you can contact the ICO on 0303 123 1113 or via their website www.ico.org.uk.

  1. CCPA

In relation to the California Consumer Privacy Act (CCPA), we confirm the following:

  • We do not sell any personal information
  • We do not offer any financial incentive for your personal information
  • You will not receive any discriminatory treatment by our business for exercising your privacy rights
  • We will not charge you for exercising your privacy rights
  • Upon receiving a request to know or a request to delete, we will confirm receipt of the request within 10 business days and provide information about how the business will process the request.
  • We will respond to requests to know and requests to delete within 45 calendar days.
  • We shall not disclose in response to a request to know a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics.
  • We are able to provide the information and classification of information when responding to a Request to Know request
  • We are able to delete the personal information in relation to a Request to Delete request

This Privacy Policy was last updated February 2025.

Service Providers

Blenheim Chalcot IT Services India Private Limited: Located in Mumbai, India, providing application development, back-office finance and invoicing services, and helpdesk queries

HubSpot: Located in Cambridge, MA, United States, with data storage in the AWS us-east-1 region, providing CRM services

BC LTF Limited: Located in London, UK, they are used for internal company operations

Microsoft Corporation/Microsoft Ireland Operations, Ltd: 600413485 / One Microsoft Way Redmond, Washington 98052-6399, US / One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, providing Hosting Services and Office Productivity

Stripe Payments Europe, Limited (SPEL): 1 Grand Canal Street Lower. Grand Canal Dock. Dublin. D02 H210. Ireland, providing payment services

WhatsApp, Meta Platforms: 1601 Willow Rd, Menlo Park, CA 94025, United States, providing Community Chat Groups