1. Who we are
Nannvo Ltd ("Nannvo", "we", "us", "our") operates the nannvo.co.uk website and care marketplace platform. We are the data controller for personal data collected through our services.
If you have any questions about this policy, contact us at: privacy@nannvo.co.uk
2. What data we collect
Information you provide directly
- Account data: name, email address, phone number, date of birth
- Profile data: profile photo, biography, skills, work history, qualifications
- Identity verification: government-issued ID, DBS certificate number, right to work documentation
- Payment data: billing address, payment card details (processed securely via our payment provider — we do not store card numbers)
- Communications: messages sent through the Nannvo platform, support enquiries
- References: contact details of references provided by carers
Information collected automatically
- IP address, browser type, operating system
- Pages visited, time on site, referral source
- Device identifiers and cookie data (see our Cookie Policy)
3. How we use your data
We use your personal data to:
- Create and manage your Nannvo account
- Verify carer identity, qualifications, and DBS status
- Facilitate connections and bookings between families and carers
- Process payments and prevent fraud
- Send booking confirmations, reminders, and service notifications
- Provide customer support
- Improve our platform through aggregated analytics
- Meet our legal and regulatory obligations
- Send marketing communications (only with your explicit consent — you may opt out at any time)
4. Legal basis for processing
We process your data under the following lawful bases:
- Contract performance: processing necessary to provide the Nannvo service
- Legal obligation: compliance with UK laws including employment, safeguarding, and financial regulations
- Legitimate interests: fraud prevention, platform security, and service improvement
- Consent: marketing emails, optional cookies, and any processing you have opted into
5. Who we share your data with
We do not sell your personal data. We may share data with:
- Other platform users: carer profiles are visible to families; booking details are shared between matched parties
- Identity & DBS verification providers: to carry out legally required checks
- Payment processors: Stripe or equivalent, to handle transactions securely
- Email & communication tools: to send notifications and support messages
- Analytics providers: to understand how our platform is used (anonymised or pseudonymised data only)
- Legal authorities: where required by law, court order, or safeguarding obligations
6. Data retention
We retain your personal data for as long as your account is active or as required by law. Specifically:
- Account data: held for the duration of your account plus 2 years after closure
- Payment records: retained for 7 years to comply with financial regulations
- DBS and verification records: retained for the period required by law
- Marketing data: until you withdraw consent
7. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access: request a copy of the data we hold about you
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request deletion of your data (subject to legal obligations)
- Right to restrict processing: limit how we use your data in certain circumstances
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to processing based on legitimate interests or for direct marketing
- Rights related to automated decision-making: not be subject to solely automated decisions that significantly affect you
To exercise any of these rights, contact us at privacy@nannvo.co.uk. We will respond within 30 days.
8. Data security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit (TLS/HTTPS) and at rest
- Access controls limiting who can view personal data
- Regular security audits and penetration testing
- Staff training on data protection obligations
9. International transfers
We primarily process data within the UK and European Economic Area. Where data is transferred outside these regions, we ensure appropriate safeguards are in place (such as standard contractual clauses or adequacy decisions).
10. Children's privacy
Our platform is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately.
11. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time. We will notify you of significant changes by email or prominent notice on our website. The date at the top of this page indicates when it was last updated.