Privacy Policy

1. Who we are

Thank you for visiting www.enrolmy.com and using Enrolmy ("Enrolmy", "we", "us", "our"). We respect your privacy and value your relationship with us.

Depending on where you are, one of the following companies is responsible for your personal information (the "controller"):

Enrolmy and your activity provider. Enrolmy is a booking and management platform. The organisations that run activities on Enrolmy (such as holiday programmes, clubs, schools and coaches) are called "providers" in this policy.

• For managing your Enrolmy account, our website and our own communications, Enrolmy communicates with you.
• For the booking and enrolment information a provider asks you for, the provider is responsible for how it is used. Enrolmy stores and processes it on their behalf, under a contract that requires us to protect it and only use it as the provider instructs. If you have questions about how a provider uses your information, please contact them directly. We're also happy to help point you in the right direction.

2. Information we collect

You don't need to give us any personal information to browse our website. When you create an account or book an activity, we may collect some of the following information.

About you (parent, guardian or account holder)

• Name, email address, phone number and postal address
• Login details and account preferences
• Messages and communications with us or with providers through Enrolmy

About your children or other participants

• Basic details, such as name, date of birth, gender, and school and year level
• Emergency contacts and people authorised to collect them
• Allergies, medical conditions, dietary requirements or additional needs
• Consents and preferences, such as photo or media consent
• Subsidy or funding information, where it applies to the activity
• Answers to any extra questions a provider asks on their booking form

When you use our website or apps

• Device and browser information, IP address, pages viewed, and how you arrived at our site (for example, campaign links)
• Telemetry of how you interact with our website and platform (such as clicks, scrolling and page navigation), to help us fix problems and improve the experience.
• This is collected through cookies and similar technologies (see Section 11).

Where we get it from

• From you, when you create an account, make a booking, fill in a form, or contact us.
• From other people: for example, a parent giving us their child's details, or a provider adding or importing records about participants. If you give us information about someone else, please make sure they (or their parent or guardian) know you're doing so and have seen this policy.
• Automatically, when you use our website or apps.

Staying anonymous. You can browse our website and send general enquiries without telling us who you are, or using a different name. We do need your real details to create an account or make a booking.

If you choose not to provide information. Some information is optional. If you don't provide information that a provider or Enrolmy needs, we may not be able to create your account, complete a booking, or tailor our content and communications to you and the provider you are booking with may not able able to provide your booking a place in their activity programs.

3. Sensitive information

Some information, like health details, is treated as "special category" or "sensitive" information under privacy law. It's always optional unless a provider needs it to care for a participant safely.

When you provide health information on a booking form, you agree to it being shared with the provider running that activity so they can care for the participant safely. The provider is responsible for how they use it. We only store and process it on their behalf, we never use it for any other purpose, and we protect it with extra care.

You can ask for health information to be updated or removed at any time.

4. How we use your information, and why

We use your personal information to:

Where we rely on legitimate interests, we've weighed our interests against your interests and rights, and concluded that the processing is fair and what you'd reasonably expect. You can ask us for more detail, and you can object (see Section 9).

Marketing. We'll only send you marketing if you've said yes. Every marketing email has an unsubscribe link, and you can also email us to opt out. Opting out of marketing won't stop important messages about your account or bookings.

Automated decisions. We don't make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

5. Who we share your information with

We don't sell your personal information. We share it only as described below.

• Activity providers you book with. We share the information needed for them to run your booking. Each provider is responsible for how they use that information under their own privacy obligations. You can contact them directly about information they hold.
• Service providers who help us run Enrolmy. For example: cloud hosting, email and SMS delivery, customer support tools, website analytics, performance and error monitoring, session recording, and CRM. They can only use your information to provide services to us, and must keep it secure. A list of our service providers is available on request.
• Advertising partners, only with your consent. If you accept marketing cookies, advertising platforms such as Meta may receive information about your visit, to show you Enrolmy ads and measure how well they work. These cookies never run on booking forms or pages containing children's or health information.
• Payment processors. Enrolmy does not store full credit or debit card details. Payments are handled by certified, secure third-party payment processors, which give us a secure token so we can process payments as you've asked.
• Our team and group companies. Our employees and the Enrolmy group companies listed in Section 1, where needed to provide and support our services.
• Others, with your permission. For example, partners for promotions you've opted into.
• Where required by law. For example, to comply with a court order, or to help law enforcement or government agencies where we reasonably believe it's necessary and lawful.
• If our business changes. If Enrolmy is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that, and this policy will continue to apply.

We never share children's information with third parties except to provide our services, or where the law requires it.

6. Where your information is stored

Enrolmy operates in several countries, including the United Kingdom, the European Union, New Zealand, Australia, Singapore. Details of where specific service providers store information are available on request.

Wherever you live, we apply the same protection when information moves between countries. We only transfer personal information to a country that the relevant authorities recognise as having adequate privacy laws (for example, the UK and EU recognise New Zealand), or where we've put appropriate safeguards in place. Those safeguards include contracts requiring the recipient to protect it to the same standard as this policy, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework (and UK Extension). You can ask us for a copy of the relevant safeguards.

7. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires.

After that, we securely delete or anonymise it.

8. Keeping your information safe

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, change or disclosure. This includes physical, computer and network, communications and personnel security. We also check that service providers who handle personal information for us meet appropriate privacy and security standards.

If we become aware of a data breach that is likely to cause you serious harm, we'll notify you, and the relevant regulator, as the law requires.

If you think your information or your account may have been compromised, please contact us straight away at privacy@enrolmy.com.

9. Your rights

Wherever you live, you have the same rights. You can:

• Access the personal information we hold about you, and get a copy of it
• Correct information that's inaccurate or incomplete. You can update most details yourself by logging in to your account.
• Delete your account and information. Just email us or use our Contact Us form. We'll do this unless we need to keep some information for legal reasons, such as tax records, and we'll tell you what and why.
• Restrict how we use your information within reason, if impractical, this may lead to a suggest to delete your account.
• Object to us using your information based on our legitimate interests. You can object to direct marketing at any time, and we'll stop.
• Take your information with you (data portability): receive the information you gave us in a commonly used, machine-readable format, or ask us to send it to another organisation
• Withdraw consent at any time where we rely on it (for example, cookies or marketing). This won't affect anything we did before you withdrew.
• Not be subject to decisions made solely by automated means that have a legal or similarly significant effect on you. We don't make decisions like this.
• Complain to us, or to a privacy regulator (see Section 14)

How to use your rights. Email privacy@enrolmy.com. We may need to confirm your identity before we act, to protect your information.

• It's free. We would only charge a reasonable fee, or decline, if a request is clearly unfounded or excessive, and we'll explain why.
• We'll respond within 20 working days (about four weeks). If a request is complex or we receive a lot of requests, we may need up to two more months. If so, we'll tell you why within the first 20 working days.

Information held by providers. For booking information a provider controls, we'll pass your request on to them promptly and let you know we've done so. We'll also help the provider respond.

10. Children's information

Enrolmy accounts are for adults aged 18 or over (parents, guardians and provider staff). Our services aren't designed for children to use directly, and we don't knowingly collect information directly from children.

We do hold information about children when a parent, guardian or provider gives it to us to book or run an activity. When you give us a child's information, you confirm you're their parent or guardian, or are otherwise allowed to provide it. We only ask for what's reasonably needed to deliver the activity safely. We don't use children's information for marketing or profiling.

If you believe a child has given us information directly, please contact us and we'll delete it.

11. Cookies

Cookies are small text files stored on your device that help websites work and give us information about how they're used.

We use:

• Essential cookies needed for the website and platform to work, for example to keep you logged in. These don't need your consent.
• Analytics and performance cookies to understand how our website and platform are used, spot errors, and improve them. Tools include Google Analytics, New Relic, and LogRocket, which records how you interact with pages in order to improve the product and function of the web site.
• Marketing cookies such as Facebook and Instagram, and to measure how well advertising for activities and customers work. Tools include the Meta Pixel.

Wherever you are, we only set analytics, performance and marketing cookies with your consent, which you give through our cookie banner. You can change your choices or withdraw consent at any time using the "Cookie settings" link in our website footer, or through your browser settings.

12. Links to other websites

Our website may link to other websites, including provider websites. We're not responsible for their privacy practices or content, so we suggest reading their privacy policies.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

14. Contact us and complaints

If you have any questions about this policy or your information, contact us at privacy@enrolmy.com

We want to know if you have concerns about our privacy practices. If you'd like to make a complaint, please email us. We'll acknowledge it within 30 days, look into it, and let you know the outcome.

If you're not happy with our response, you can contact the privacy regulator where you live:

United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk/concerns, 0303 123 1113

Ireland: Data Protection Commission — dataprotection.ie

New Zealand: Office of the Privacy Commissioner — privacy.org.nz

Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au, 1300 363 992

Rest of the EU/EEA: your local data protection authority — see the European Data Protection Board list.

Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg

United States: your state Attorney General's office

15. Extra information for your region

United Kingdom

We comply with the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations (PECR). We take account of the ICO's Age Appropriate Design Code when designing our services. Our ICO registration number is ZB658275

Ireland and the rest of the EU/EEA

We comply with the EU GDPR, and in Ireland the Data Protection Act 2018 and the ePrivacy Regulations (S.I. 336/2011).

New Zealand

We comply with the Privacy Act 2020 and the Information Privacy Principles, including IPP 3A. When we collect information about you from someone else, such as a provider or a family member, this policy is how we let you know.

Australia

We comply with the Privacy Act 1988 and the Australian Privacy Principles.

Singapore

We comply with the Personal Data Protection Act 2012 (PDPA). Our Data Protection Officer (see Section 1) is your contact for any questions or requests. We won't send marketing messages to Singapore phone numbers listed on the Do Not Call Registry unless you've given us clear consent.

United States

We don't sell personal information. We only use advertising cookies (see Section 11) if you've agreed to them, and you can withdraw that agreement at any time using "Cookie settings". Our services are for adults. We don't knowingly collect personal information directly from children under 13, as covered by the Children's Online Privacy Protection Act (COPPA). Parents and guardians provide any information about their children. You have the same rights as everyone else under this policy (see Section 9).

Other countries

If you're in a country not listed above, we'll handle your information in line with this policy and any privacy laws that apply to you.