How Little Blossoms handles your information.

To provide safe, personalised childcare, Chloe collects the following categories of personal data from families: • Parent and guardian names and contact details (phone number, email address, home address) • Children's names, ages, and dates of birth • Medical information, allergies, and dietary needs • Emergency contact details • Payment information (processed securely — see section 4) • Photos or videos of children, only where a parent or guardian has given explicit written consent Chloe collects only the information that is necessary for the safe delivery of childcare.

Chloe processes personal data for the following purposes: • To confirm and manage childcare bookings (lawful basis: contract) • To keep children safe during care, including responding to medical needs or emergencies (lawful basis: vital interests / legal obligation) • To communicate with parents and guardians about bookings, changes, and care updates (lawful basis: contract) • To process payment for services provided (lawful basis: contract) • To meet safeguarding and child protection obligations under Isle of Man law (lawful basis: legal obligation) • To maintain financial records for tax and accounting purposes (lawful basis: legal obligation) Where photos or videos of children are taken, this is done only with explicit prior written consent from a parent or guardian (lawful basis: consent). You may withdraw this consent at any time.

Chloe does not sell or share personal data for marketing purposes. Data may be shared only in the following limited circumstances: • Safeguarding and child protection authorities — if Chloe has a legal duty or reasonable cause to refer a concern, relevant information will be shared with the appropriate Isle of Man authorities in line with her safeguarding obligations. • Accountant or bookkeeper — financial records (such as payment amounts and dates) may be shared with Chloe's accountant or bookkeeper for tax and legal compliance purposes. They are bound by confidentiality obligations. No other third parties receive your personal data.

Payment details are processed securely. Chloe does not store full card numbers or sensitive payment credentials. Where an online payment facility is used, it is provided by a PCI-DSS compliant payment processor. Please refer to that provider's own privacy policy for details of how your payment data is handled.

Chloe will only take photos or videos of children in her care where a parent or guardian has given explicit written consent in advance. Photos and videos are used solely for the purpose agreed (for example, sharing a moment from the day with the family). They are not shared publicly, posted on social media, or used for any commercial purpose without further explicit consent. You may withdraw consent for photos or videos at any time by contacting Chloe directly.

Little Blossoms has a presence on the following social media platforms: Facebook, Instagram, and WhatsApp. If you contact Little Blossoms through a social media platform, or interact with Little Blossoms content (for example by commenting, liking, or sending a direct message), any information you share will be subject to both this privacy policy and the privacy policy of the platform you are using. Chloe encourages you to review the privacy policies of Facebook, Instagram, and WhatsApp before sharing personal information through those channels. Chloe will never share identifiable information about children — including photos, videos, names, or ages — on social media without explicit prior written consent from a parent or guardian. Any content shared on social media relating to Little Blossoms' services will be handled with care and professionalism. Please be aware that social media platforms are independent third parties. Chloe has no control over how those platforms collect, store, or use your data once you interact with them.

The Little Blossoms website (littleblossoms.co.im) is used to provide information about childcare services and to allow families to make enquiries. The following applies to your use of this website: • The website does not use tracking, advertising, or analytics cookies. Only essential cookies necessary for the site to function are used. • Any personal information you submit through the contact or enquiry form (such as your name, email address, or phone number) is used solely to respond to your enquiry and is handled in accordance with this privacy policy. • The website may contain links to external websites. Chloe is not responsible for the privacy practices or content of those sites. You are encouraged to read the privacy policy of any external site you visit. For full details on cookies, see section 8 below.

Cookies are small text files placed on your device when you visit a website. The Little Blossoms website uses only essential cookies — those strictly necessary for the site to operate correctly. No tracking cookies, advertising cookies, or third-party analytics tools are used. Essential cookies may include those that remember your session or preferences during a single visit. They do not collect personal data for marketing purposes and are not shared with third parties. You can control and delete cookies through your browser settings. Please note that disabling essential cookies may affect how the website functions.

The Little Blossoms website and social media profiles may contain links to external websites, resources, or third-party services. These links may sometimes appear as shortened URLs (for example, links shared on social media). Chloe is not responsible for the content, privacy practices, or security of any external websites. Clicking an external or shortened link will take you away from Little Blossoms' controlled environment, and any data you provide to those sites is governed by their own privacy policies. If you are ever unsure whether a link is genuine, please contact Chloe directly before clicking.

Personal data collected by Little Blossoms is used only for the purposes for which it was provided. Specifically: • To arrange, confirm, and manage childcare bookings • To keep children safe during care, including responding to medical or emergency situations • To communicate with you about your booking, any changes, or care updates • To process payments for services • To meet legal and safeguarding obligations • To maintain financial records as required by law Your information will not be used for unsolicited marketing, sold to third parties, or shared beyond the circumstances described in this policy. Chloe will only contact you in connection with your childcare arrangement or in response to an enquiry you have made.

You have the right to control how your personal information is used. Specifically, you can: • Request access to the personal data Chloe holds about you and your child • Ask Chloe to correct any inaccurate or incomplete information • Ask Chloe to delete your data, subject to any legal obligations to retain certain records • Withdraw consent at any time where processing is based on consent (for example, consent to take photos or videos) • Object to or restrict certain types of processing To exercise any of these rights, please contact Chloe at [email protected]. Requests will be responded to within one month. Chloe will never make access to childcare services conditional on you waiving your data protection rights.

Chloe retains personal data for as long as is necessary for the purposes for which it was collected, and no longer than 3 years after the end of the last childcare arrangement. Financial records required for tax purposes are kept for up to 7 years in line with Income Tax Division of the Isle of Man guidance. After the applicable retention period, data is securely deleted or destroyed. If you would like your data deleted sooner, please contact Chloe directly. Requests will be considered in line with any legal obligations that require certain records to be kept.

Chloe takes reasonable steps to protect personal data from unauthorised access, loss, or disclosure. This includes storing records securely, limiting access to data to Chloe only (except where sharing is required as described above), and using secure communication channels where possible. In the event of a data breach that is likely to affect your rights or freedoms, Chloe will notify you and the relevant authority as required by law.

Under Isle of Man data protection law, you have the following rights: • Right of access — you can request a copy of the personal data Chloe holds about you and your child. • Right to rectification — you can ask Chloe to correct inaccurate or incomplete data. • Right to erasure — you can ask Chloe to delete your data, subject to any legal obligations to retain it. • Right to restriction — you can ask Chloe to limit how your data is used in certain circumstances. • Right to object — you can object to processing based on legitimate interests. • Right to withdraw consent — where processing is based on consent (such as photos), you can withdraw it at any time. To exercise any of these rights, please contact Chloe at [email protected]. Chloe will respond within one month.

Chloe may update this privacy policy from time to time to reflect changes in how Little Blossoms operates, changes in the law, or feedback from families. The date at the top of this page will always show when the policy was last revised. Where changes are significant, Chloe will make reasonable efforts to notify existing clients directly. Continued use of childcare services or this website after any update constitutes acceptance of the revised policy. You are encouraged to check this page periodically.

If you have a concern about how your personal data has been handled, please contact Chloe in the first instance at [email protected]. If you remain unhappy, you have the right to lodge a complaint with the Isle of Man Information Commissioner's Office (ICO), which is the supervisory authority for data protection on the Isle of Man. Isle of Man Information Commissioner PO Box 69, Douglas, Isle of Man, IM99 1EQ www.inforights.im