Privacy policy

We’re Xander and Zane, the founders of Nurture Play, which we run together. For the personal data described in this policy, Nurture Play is the data controller. You can contact us at contact@nurtureplay.net.

This policy applies to nurtureplay.net, our booking and enquiry communications, and personal data we collect while organising or running Nurture Play sessions. It does not govern a third-party website or service that you choose to visit.

The personal data we collect depends on how you interact with us. We try to collect only what we need.

• Booking details: the selected session; each participating child's name and date of birth; each attending adult's name; your mobile number; your preferred language; your acknowledgements; and any optional remarks you add, such as allergies, sensitivities, health information or participation needs.
• Order and payment details: the order number, amount due, payment status, pricing record and discount code, if any. If you send a payment receipt through WhatsApp, Instagram or another channel, we also receive the receipt and the information shown on it. We do not collect card details through this website.
• Enquiries and messages: your name, email address, phone number, social-media handle, message and any other information you choose to send by email, WhatsApp, Instagram or an enquiry form when one is available.
• Session information: attendance, communications about the session, photography preferences, session photographs and information reasonably needed to respond to a safety concern, incident or complaint.
• Technical and analytics information: our hosting provider may automatically process details such as your IP address, browser or device type, requested page, referring page, and the date and time of a request in order to deliver and secure the website. Cloudflare Web Analytics also measures aggregate page views, traffic sources, visitor country, device and browser categories, and page-load performance as described below.

Most personal data comes directly from you when you complete a booking, contact us, send a receipt, speak with us or attend a session. Technical information is generated when your browser connects to the website.

A parent, caregiver or booking organiser may give us information about a child or another attending adult. If you provide another person's personal data, please make sure you are authorised to do so and that they, or their parent or guardian where appropriate, understand how we will use it.

We process personal data with consent, where it is needed to take steps at your request or provide the session you booked, and where it is needed to meet legal obligations or protect the safety and rights of participants and Nurture Play.

• To receive, check, price, administer and confirm bookings and payments.
• To plan age-appropriate activities, make reasonable preparations for stated allergies or participation needs, manage attendance and keep sessions safe.
• To contact you about the booking, answer an enquiry, provide support, or tell you about an unexpected change, transfer, cancellation or refund.
• To prevent spam, fraud, misuse and security incidents, troubleshoot the website, and keep appropriate business, tax, accounting and dispute records.
• To understand aggregate website traffic and page performance so we can maintain and improve the site.
• To document and share our work through carefully handled session photographs as explained below.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal rights.

To make a booking, you must provide the child and attending-adult names, each child's date of birth, a valid mobile number, and the required safety and booking acknowledgements. We cannot accept or properly manage a booking without them. Remarks are optional, although relevant allergy, sensitivity, health or participation information may be important for safe preparation.

Contacting us is voluntary, but we may be unable to answer or help if you do not give us enough information. We do not use the mobile number entered in the booking form for marketing, and we do not use personal data for automated decision-making or profiling.

You may ask us to stop optional processing or withdraw consent at any time. This will not affect processing already carried out lawfully, and in some cases it may mean we cannot provide a requested service.

We do not sell or rent personal data, and we do not give it to third parties for their own unrelated marketing. Access within Nurture Play is limited to the founders, staff and facilitators who need the information to organise the session, support participants or administer the business.

We use service providers to host the website, store booking records, provide web analytics and support communications. The website and booking system are hosted by Netlify, and Cloudflare provides Web Analytics. If you choose to contact us or send a receipt through WhatsApp, Instagram or email, the relevant communication provider will process that interaction. A Google Maps link opens only when you choose it. Banks or payment services process a transfer under their own terms.

We may also disclose information to professional advisers, insurers, emergency services, venues where reasonably necessary for an event, or public authorities when required or permitted by law. Service providers may process data outside Malaysia. Where we arrange such processing, we take reasonable steps required by applicable law to protect the data. The providers' own policies explain their separate processing.

We use Cloudflare Web Analytics to understand aggregate website traffic and how well pages perform. Its JavaScript performance beacon measures page views, visits, referring sites, country, device type, browser, operating system, page-load time and Core Web Vitals. Cloudflare states that Web Analytics does not collect or use visitors' personal data, track individual visitors across websites, use cookies or localStorage for analytics, or fingerprint people. It does not currently log URL query strings.

We do not use advertising pixels or marketing-tracking cookies on this website. Your language choice is carried in the page address rather than stored as a tracking profile.

Our hosting provider may still create technical and security logs when it serves the site or processes a form or booking. External sites you open, including Instagram, WhatsApp and Google Maps, may use cookies or similar technologies under their own policies.

Our services are arranged by parents, caregivers or other adults. Children should not send personal data to us by themselves. We use children's names, dates of birth and any relevant participation information to administer the booking, check age-based pricing and suitability, prepare the session and support safety.

We occasionally photograph sessions to document our work. If you do not want your child photographed, tell us or any member of staff and we will stop photographing them. Before we publish a photograph, we always crop out or cover children's faces. You may also ask us to take down a specific published photograph.

We keep personal data only for as long as it is reasonably needed for the purposes described in this policy. The period depends on the type of information, whether a booking is still active, whether follow-up or a dispute is possible, and any legal, tax, accounting, insurance or safeguarding requirement that applies.

We aim not to keep children's dates of birth, optional health or participation notes, contact messages or unpublished session photographs longer than they are needed for their specific purpose. When data is no longer required, we delete it, anonymise it or securely put it beyond use.

We use reasonable administrative and technical safeguards appropriate to the information we hold. These include encrypted website connections, access controls, limiting access to people who need it, and using reputable service providers.

No internet transmission or storage system is completely secure. If we become aware of a personal-data breach, we will investigate, limit the impact and make any notification required by applicable law.

Subject to applicable law, you may ask whether we hold your personal data, request access to it, ask us to correct inaccurate or incomplete data, withdraw consent, or ask us to stop, limit or delete particular processing. You may also ask questions about how your data has been used or disclosed.

Email contact@nurtureplay.net with enough detail for us to understand your request. We may need to verify your identity and authority before acting, particularly where a request concerns a child or another person. Some requests may be limited where the law permits or requires us to keep or process the information.

We may update this policy when our services, providers or legal obligations change. We will publish the revised policy here and change the date at the top. If a change materially affects how we use data already collected, we will take reasonable steps to bring it to the attention of the people affected.