Legal

Privacy Policy

Last updated: 30 July 2026 · Applies to hqyou.co.uk and HQ You services in the United Kingdom

1. Who we are

HQ You (“we”, “us”, “our”) provides live, virtual after-school clubs for children aged 7-11 in the UK. For UK data protection law, HQ You is the data controller for personal information we decide how and why to use.

Website: www.hqyou.co.uk
Privacy contact: katyoneill@hqyou.co.uk

We handle personal data in line with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and, where our online services are likely to be accessed by children, the ICO's Age Appropriate Design Code (Children's Code). We also follow DfE safeguarding guidance for out-of-school settings.

2. What personal information we collect

When you register interest on our website

• Parent / guardian name, email address and contact number
• Number of children who may join, and children's first names
• Subjects of interest and preferred days
• How you heard about us
• Your consent to be contacted about the waitlist and clubs
• Technical data such as IP address, browser type and pages viewed (if analytics are enabled), and cookie identifiers where you have consented

When clubs and bookings go live (later)

• Parent account details and login information
• Child profiles (first name, age band / date of birth where needed)
• Booking, attendance and payment records
• Emergency contact details and any health or access information you share
• Safeguarding or incident records if a concern arises
• Communications with our team

We aim to collect the minimum information needed. A parent or guardian submits the waitlist form on behalf of their children.

3. Why we use your information (lawful bases)

• Consent: for waitlist sign-up and email/SMS updates (you can withdraw anytime).
• Contract: to take bookings, deliver clubs and send join links.
• Legitimate interests: to improve our services, prevent misuse, and keep records needed to run a safe business.
• Legal obligation: where the law requires us to keep or share information.
• Vital interests: in rare emergencies to protect someone's life or safety.

Electronic marketing emails and texts to individuals generally require consent under PECR. We will not send marketing without a clear opt-in, and every message will include an easy unsubscribe option.

4. Children's personal data

Under the UK GDPR and the Children's Code we will:

• Put the best interests of the child first
• Use high-privacy defaults. We do not make children's profiles public
• Minimise what we collect and keep it only as long as needed
• Not use children's data for behavioural advertising or sell it
• Not profile children for marketing
• Carry out a Data Protection Impact Assessment (DPIA) for our online services that involve children's data

5. Live video sessions: recording, chat and safety

Session safeguards include:

• Waiting rooms and host approval before a child joins
• Sessions locked after they start
• Private chat between participants disabled
• Small groups (maximum 8 children)
• Hosts who are DBS-checked and safeguarding-trained

We ask families not to record sessions themselves without written permission from HQ You and the other families involved.

6. Who we share information with

We do not sell personal data. We only share it when necessary with service providers (hosting, email, form storage, analytics if enabled, payments, video), hosts (need-to-know roster info), professional advisers, and authorities where required by law or to protect a child.

7. How long we keep information

• Waitlist interest: while you remain interested; removed on request; aimed at no longer than 24 months if you never become a customer
• Booking and payment records: as needed for the service and legal / tax retention
• Safeguarding records: in line with safeguarding good practice
• Marketing contacts: until you unsubscribe

8. How we keep information secure

• Access limited to people who need it for their role
• HTTPS and secure storage with reputable providers
• API keys stored as environment variables, never in public code
• Staff and hosts trained on privacy and safeguarding expectations

9. Cookies and analytics

Essential cookies may be needed for the site to work. Non-essential cookies (for example analytics) are only used with your consent where PECR requires it.

10. Your rights

Under UK GDPR you can ask us to:

• Access the personal data we hold
• Correct inaccurate data
• Delete data (in certain circumstances)
• Restrict or object to certain processing
• Receive data in a portable format (where applicable)
• Withdraw consent at any time
• Object to direct marketing. We will always honour this

Email katyoneill@hqyou.co.uk. We aim to respond within one month.

11. Safeguarding

Protecting children comes first. Data protection law allows sharing information with the right agencies when a child may be at risk of harm. Every host is DBS-checked and safeguarding-trained before leading a club.

12. Contact us and how to complain

Email: katyoneill@hqyou.co.uk
Web: www.hqyou.co.uk

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk · Helpline 0303 123 1113.

13. Changes to this policy

We may update this Privacy Policy as our services grow. The “Last updated” date at the top will change when we do.