This policy applies only to this public marketing website. Data stored within the NurserySpace Platform (the application used by nurseries to manage children's data) is covered by a separate App Privacy Policy and Data Processing Agreement.
1. Who We Are
We are Orvanta Group Ltd, a company registered in England & Wales.
- Company No: 16554536
- Registered Address: 13th Floor, Piccadilly Plaza, New York Street, Manchester, England, M1 4BT.
- Email: info@orvantagroup.co.uk
For the purposes of the UK General Data Protection Regulation (UK GDPR), we are the Data Controller of the personal information you provide on this website.
2. What Information We Collect & Why
We collect information to help us communicate with you and improve our services.
A. When You Contact Us or Book a Demo
- What we collect: Name, Email Address, Phone Number, Nursery Name, Job Title.
- Why: To answer your queries, schedule product demonstrations, and determine if NurserySpace is a good fit for your setting.
- Legal Basis: Consent (you freely provided your details via our form).
B. Newsletters & Updates
- What we collect: Email Address.
- Why: To send you industry news, product updates, and educational content.
- Legal Basis: Consent (you opted in).
C. Website Usage (Anonymised)
- What we collect: Pages visited, time spent on the site, clicks (e.g., "Book Demo"), and device type.
- Why: To improve the performance and usability of our website.
- Legal Basis: Legitimate Interest (improving our business services).
3. Tools We Use (Sub-Processors)
To keep your data secure, we minimize the use of third-party platforms. Where possible, we process and store data within our own secure infrastructure.
A. CRM & Lead Management (Internal)
- Internal Systems (Google Cloud Platform): When you fill out a form or request a demo, your data is encrypted and stored directly in our secure internal database (Firestore), hosted in the UK/EU. We do not share this data with external sales platforms like HubSpot or Salesforce.
- Google Appointment Schedules: Used to allow you to book demo slots directly with our team.
B. Communication Providers
- SendGrid (Twilio Inc.): We use SendGrid to deliver our email newsletters, product updates, and system notifications. SendGrid manages our email delivery to ensure messages reach your inbox securely.
- Twilio: We use Twilio to send SMS notifications (if requested) and to manage two-factor authentication (2FA) messages.
C. Website Analytics & Cookies
- Google Analytics (GA4): Helps us understand how people use our website. We have configured this to anonymise IP addresses.
- CookieYes: Manages your cookie preferences to ensure we only track you if you give explicit consent.
4. International Data Transfers
Our primary infrastructure (Google Cloud) is located in the UK (London). However, our communication providers (Twilio and SendGrid) are US-based companies and may process data in the United States.
To ensure your data remains protected when processed outside the UK/EEA, we rely on Binding Corporate Rules (BCRs). Twilio (and its subsidiary SendGrid) have obtained approval for their BCRs from European Data Protection Authorities. This is recognized as a "Gold Standard" for data protection, ensuring your data is treated with the same level of security in the US as it is in the UK.
5. Cookies
We use a cookie control system that lets you decide if you’re happy for us to use tracking cookies.
- Necessary Cookies: Required for the site to work (e.g., security, load balancing). You cannot turn these off.
- Analytics Cookies: These help us count visits and traffic sources. We only use these if you click "Accept" on our banner.
You can change your preferences at any time by clicking the "Cookie Settings" icon in the corner of our website.
6. How Long We Keep Your Data
- Demo Requests/Sales Leads: We keep your details in our internal system for 2 years from your last interaction. If you become a customer, we keep it for the duration of your contract.
- Newsletter Subscribers: We keep your email until you click Unsubscribe.
- Analytics Data: Retained for 14 months in an anonymised format.
7. Your Rights
Under the UK GDPR, you have the right to:
- Access the data we hold on you.
- Correct inaccurate data.
- Delete your data (Right to be Forgotten).
- Withdraw Consent (e.g., Unsubscribe).
To exercise any of these rights, please email info@orvantagroup.co.uk.
8. Complaints
If you have concerns about how we handle your data, please contact us first. If you are not satisfied, you have the right to complain to the ICO (Information Commissioner’s Office).