Privacy policy

1. Who we are

aluma is operated by ALUMA FZ-LLC, a company registered in the United Arab Emirates.

aluma takes data protection seriously and is registered with the Information Commission (formerly the Information Commissioner's Office, ICO), registration number ZC252716. You can check our registration is current on the public register.

UK Representative: to be appointed. Until then, please use the email address below for anything about your data.

For anything about your data, contact us at hello@aluma.app.

2. Who is responsible for your data

This policy explains what personal information aluma collects when you visit our website or use the aluma app, why, how long we keep it, and what rights you have. aluma plays two different roles, depending on the information.

Where we are in charge (controller)

We decide how this information is used, and this policy covers it in full:

• account owners' and managers' account, sign-in and billing details;
• messages you send us, early-access sign-ups, and affiliates' details;
• our emails to account owners;
• website usage statistics;
• security records, such as failed sign-in attempts, error reports and bot checks, and the audit log once an account has closed.

Where we act for a business (processor)

Everything a business records in aluma about its staff, venues and day-to-day running belongs to that business. The business is the controller: it decides what goes in and why, and it must give its own privacy notice to its staff and to anyone else whose details it records. We only use these records to run aluma for that business, on its instructions, as set out in our terms. While an account is open, this includes the audit log of who opened which record.

If you are a staff member, or someone whose details a business has recorded, please contact that business first about your data. If you contact us, we will pass your request on and help them respond.

3. What we collect

About account owners and managers

• Your name, email address, and your business's name and type.
• If you add them, your business's address, phone number, email address and logo, and the name of its safeguarding lead.
• Your password, which our sign-in provider stores only in scrambled form, and your two-factor sign-in settings.
• Your plan, subscription status and billing dates. Card details go straight to Stripe and never reach aluma.
• When you last signed in.
• Whether you have asked for aluma's monthly news, and the date you ticked the box.

Emails to account owners

To send set-up and account emails (for example, a tip if no staff members have been added yet, or a note when you subscribe or cancel), we use the owner's first name, email address, an internal reference number, the business name and type, the plan and subscription status, whether the business is a beta tester, and simple counts and dates about how the account is used: trial, subscription and cancellation dates, how many staff members and venues have been added and when, and when you last signed in. Loops also records whether these emails are opened and which links are clicked, so we can see which emails are helpful.

aluma's monthly news is only sent to owners who tick the box for it, when signing up or in Settings. Loops is told whether you have ticked it. Untick it in Settings, or use the unsubscribe link in any email, to stop it.

About website visitors

• Website usage information through Plausible Analytics, such as which pages are visited, where the visit came from, device type and approximate location. Plausible does not use cookies.
• Your name, email address and message, if you contact us, join the early-access list or apply to be an affiliate.

About affiliates

If you join our affiliate programme, we hold your name, email address, referral code, payment details, and the commission we have paid you. We count the businesses that sign up through your link, but we do not share their details with you.

Technical and security information

• The audit log: each time someone opens or changes a sensitive record, aluma records who did it (their account and email address), what they did, which record, when, and their IP address and browser details. It never holds the contents of the record itself.
• Failed sign-in attempts (the email address used and when), so we can stop people guessing passwords.
• Sign-up verification codes we email you, with how many times a code was tried.
• Error reports when something goes wrong, and a small sample of page loads to check speed, with private links, web address details and anything typed into forms removed before they are sent.
• Bot checks on sign-in, sign-up and other public forms, which process your IP address and browser details.
• If you turn on notifications, the notification address your browser gives us.

Records businesses keep in aluma

A business decides what to record. Depending on how it uses aluma, this can include:

• Staff members: name, role, email address, phone number, date of birth, home address, emergency contact's name and phone number, contract type, start and leaving dates, pay rates, payroll reference, payment method, VAT number and self-billing details, sessions worked, pay runs, invoices, one-off pay adjustments (such as a bonus, expense or deduction, each with a note saying why), a history of changes to pay (who made each change, when, and the old and new values), employment status checks, uniform orders, and messages and notices between the business and its staff.
• Checks and documents: certificates and qualifications, DBS details (certificate number, issue date, Update Service details, and any copy of a certificate that is uploaded), consent to Update Service checks (with the IP address and browser details when consent was given), overseas criminal record checks, right to work documents, references (including the referee's name), suitability declarations, signed contracts (with the signer's name, IP address and time of signing), appraisals, supervision notes, onboarding checks and policy sign-offs.
• Wellbeing check-ins: if the business switches on Rate your month, each staff member's monthly rating from 1 to 5 stars, whether they asked for a chat with their manager, and when their manager checked in with them. It is stars and a tick box only, with no space to write anything.
• Safeguarding records: referrals made to the Disclosure and Barring Service and, for nurseries, referrals to the Local Authority Designated Officer (LADO) about staff members, including the reason or allegation and the outcome.
• The accident and incident book: an entry about a child can hold the child's name, age or date of birth, room, what happened, injury, treatment, body map, and which parent or carer was told (their name and how they were contacted). An entry about an adult who is hurt, such as a staff member or visitor, holds their name, what happened, the injury and the treatment.
• Nurseries: notifications made to Ofsted, and the name and contact details of anyone who makes a complaint to the nursery.
• Head Office: for a franchise network, the name, email address, phone number and address of each franchise owner.
• Venues: venue details, risk assessments, insurance, equipment checks, and the names, roles, phone numbers and email addresses of venue contacts.
• Uploaded files: any document a business uploads. A document can contain more than the details above, and we cannot see inside it in advance, so businesses should only upload what they need. aluma never asks for photographs of people: photos of equipment faults and product images must not show anyone. The one exception is a copy of an identity document for a right to work check, which the law requires and which shows the holder's photo.

4. Sensitive information

Some records in aluma are especially sensitive:

• Health information, such as injuries and treatment in the accident book, or health details a business writes in notes or uploads.
• Criminal offence information, such as DBS details and certificate copies, overseas criminal record checks, barring and LADO referrals, and suitability declarations.

The business that records this information must have a lawful reason to hold it, and must also meet the extra legal condition the law requires for health and criminal offence information (for example, for employment, or for safeguarding children). We process it only on that business's instructions and never for our own purposes. We protect it with extra measures: every time it is opened in aluma it is logged, each business's data is kept separate, it is encrypted, and accident book entries and nursery complaints never appear on inspection links or partner packs.

5. Why we use it, and our lawful basis

Where we rely on our legitimate interests, you can ask us how we have balanced them against your rights. We do not make decisions about people using automated processing alone.

6. Cookies and analytics

We only use the cookies and browser storage aluma needs, such as keeping you signed in. Our website analytics, Plausible, run on our public website only and use no cookies or persistent identifiers. Plausible is designed not to keep raw IP addresses or raw browser details, and we do not send it account details, email addresses or anything about uploaded files. The cookie policy lists every cookie and storage item we use.

7. Who we share your data with

We use trusted providers to run aluma. They only process data to provide their service to us:

When a business chooses to share

• A business can create inspection links and partner packs to show its records to an inspector, venue or partner. Accident book entries are never included.
• If a business links to a Head Office on aluma (for example, as part of a franchise), the Head Office sees the compliance summary and the documents the business agrees to share, not staff members' own documents.

When the law requires it

We may share information if the law requires it, for example with the police or a regulator, or where it is needed to protect someone from serious harm.

We do not sell your data. We do not share it for anyone else's marketing.

8. International transfers

Your account records and uploaded files are stored in the United Kingdom (London). Some of the providers above are outside the UK, as listed, and our own team at ALUMA FZ-LLC works from the United Arab Emirates and can access data to run and support aluma.

The UK treats the European Union as having adequate data protection, so transfers to Europe need no extra safeguards. For other countries, such as the United States and the United Arab Emirates, a transfer needs a UK-approved safeguard, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or, for US companies certified under it, the UK Extension to the EU-US Data Privacy Framework. We are putting the right safeguard in place for each provider and for our own team, and will list each one here. Until then, ask us at hello@aluma.app which applies to a particular provider.

9. How long we keep it

• Account data: for as long as your account is active, plus 30 days after closure, then deleted. Backup copies of uploaded files are removed within a further 30 days, and database backups roll off within 7 days.
• Free trials: if you do not choose a plan, we keep your data for 30 days after the trial ends, then delete it. We email you a week before.
• Records businesses keep: each business can set how long it keeps the main types of record, such as documents, certificates and accident book entries, and aluma flags anything past its date so the business can review it. Most records can then be deleted in aluma. If a record can't yet be deleted there, the business can ask us at hello@aluma.app and we will delete it. All records are deleted when the account closes, as above.
• Accident book: entries about a child are kept until the child turns 21. A child can bring a claim for an injury until three years after they turn 18, so 21 is the legal minimum. Nurseries keep them until the child turns 25 by default, a common buffer in the sector, which the nursery can change. Entries about adults are kept for three years. When the date is reached, the entry is archived and flagged so the business can delete it. Deleting it is a deliberate step the business takes, and it is logged.
• Nursery complaints: kept for at least 3 years, because Ofsted can ask to see the record of complaints from the last 3 years. After that the nursery can ask us to delete them.
• Wellbeing check-ins: kept for 2 years, then deleted automatically. A rating only needs to be kept long enough for the business to see how someone is doing over time.
• Audit log: kept for 6 years after the account closes, then deleted. Six years is the usual time limit for legal claims in England and Wales, and the log may be needed to show who saw a record if a safeguarding concern, claim or investigation comes up. aluma blocks everyone, including our team, from editing or deleting an entry before then. If an entry is wrong, we add a correcting note next to it rather than changing it.
• Security records: failed sign-in attempts are deleted after 24 hours, and sign-up verification codes after 2 days. The clean-up runs once a night, so either can last up to a day longer. Error reports are kept by Sentry for up to 90 days.
• Data exports: the download file is deleted after a day.
• Closed accounts: a short note that an account was closed (the business name, the owner's email address, the date and the reason) is kept for 6 years, so we can answer questions about it.
• Billing records: Stripe keeps payment records, and we keep invoices and payment records for 6 years for tax and accounting, even after an account closes.
• Affiliates: your details are kept while you are an affiliate. Payment records are kept for 6 years after the payment, for tax and accounting.
• Enquiries: messages you send us before you have an account are kept for 12 months, then deleted.
• Early-access list: kept until we tell you aluma has launched, then deleted within a month.
• Legal holds: if the law requires us to keep something for longer, for example because of a legal claim, a safeguarding investigation or a request from a regulator, we keep only what is needed, only for as long as it is needed, and then delete it as above.
• Website statistics: Plausible keeps usage statistics for our website. It does not keep raw IP addresses or raw browser details.

10. Your rights

You have the right to:

• see the personal data we hold about you,
• correct it if it is wrong,
• delete it,
• restrict or object to how we use it,
• receive a copy in a portable format,
• withdraw consent at any time, where we rely on it.

Some of these rights have limits. For example, we may keep information the law requires us to keep, and audit log entries cannot be deleted during their retention period, although we will add a correcting note if one is wrong. We may need to check your identity before we act on a request.

If your request is about records a business keeps in aluma, such as your staff record or an accident book entry, that business is in charge of them, so please contact them first. If you contact us, we will pass your request on and help them respond.

If you have an aluma account, you can download a full copy of your business's data yourself at any time, from Settings, Your data. This gives you your records as spreadsheet files plus the documents you have uploaded, in one download. We recommend doing this before closing your account.

To use any of these rights, email hello@aluma.app. We will respond within one month, or tell you within that month if we need longer because a request is complex. If you live outside the UK, you may also have rights under your local law. Contact us and we will help.

11. Keeping your data safe

We take reasonable technical and organisational steps to protect your data:

• Each business's data is kept separate from every other business using aluma, enforced by the database itself.
• Data is encrypted in transit and at rest, and backed up daily.
• Every time someone views a sensitive record, such as a DBS certificate, aluma records who did so and when, in a log that aluma blocks everyone, including our team, from editing or deleting.
• Account holders can turn on two-factor sign-in for an extra layer of protection.
• Access by the aluma team is limited to running and supporting the service, and everyone with access is bound by confidentiality.
• Every change to aluma goes through automated security checks, including scanning for known weaknesses and for passwords or keys left in the code. An independent security test (a penetration test) is being arranged.
• If you find a security problem, please tell us at hello@aluma.app.

If a data breach puts personal data at risk, we will act quickly to contain it. Where we are in charge of the data, we will tell the Information Commission within 72 hours where the law requires, and tell you directly if there is a high risk to you. Where we hold the data for a business, we will tell that business without undue delay so it can meet its own duties.

No method is ever completely secure, but we work to keep your data safe and to act quickly if anything goes wrong.

12. Children

This website is aimed at business owners and their staff, not children, and is not directed at anyone under 18. The aluma product holds staff and business records. The one place it can hold a child's details is the accident book, where a business records an accident involving a child as the law expects (see section 3 for exactly what an entry can hold). Those entries are controlled by that business, logged every time they are opened, and kept as set out in section 9. A child, or their parent or carer, who wants to use their rights should contact the business that made the entry.

13. Changes to this policy

We may update this policy as aluma grows. When we do, we will change the date at the top and, for anything significant, let account holders know.

14. Questions about your data?

If you have any questions, contact us at hello@aluma.app.

15. How to complain

If you are unhappy with how we have handled your personal data, you can complain to us first:

• Email hello@aluma.app with "Data protection complaint" in the subject line.
• We will acknowledge your complaint within 30 days.
• We will look into it without undue delay, keep you updated, and tell you the outcome and what we have done.

If your complaint is about a staff or accident record that a business keeps in aluma, that business is responsible for it. We will pass your complaint to them and help them respond.

If you are still unhappy, you have the right to complain to the Information Commission (formerly the Information Commissioner's Office, ICO) at ico.org.uk.