Privacy Policy
Little Nest Child Care Centre Sdn. Bhd. (company no. 202501014831 (1616246-X)), which runs the Little Nest and Little Cottage early childhood centres in Kuching, Sarawak ("Little Nest", "we", "us"), keeps records about the children in our care and the families and staff around them. This policy explains what we record, why, who can see it, how long we keep it, and what you can ask us to do.
It covers our Student Management System, which our office uses in a web browser, and the Flock by Little Nest app, which our staff will use on their phones at the door and in the classroom and which parents will be able to use to see their own child's records. It also covers the one-day pickup pass a parent can send to someone collecting their child.
We handle personal data in line with the Personal Data Protection Act 2010 (PDPA), as amended.
1. Who is responsible
Little Nest Child Care Centre Sdn. Bhd. is the data controller for the records described here. For any question or request about your data, contact us using the details at the end of this page.
2. What we collect
2.1 About your child and family
- Your child's name, date of birth, class, centre and enrolment status.
- A photograph of your child, so that staff can recognise them at the door and when checking a pickup pass.
- Parent and guardian names, email addresses, phone numbers and home address, and emergency contacts.
- Information needed for your child's care, such as allergies, dietary needs and relevant health notes.
2.2 Drop-off and collection
- Sign-in and sign-out times, and the staff member who handled each one.
- Your child's temperature at drop-off, mood on arrival and a visual health check. A temperature is health information, and we record it with your consent given at enrolment.
- Who collected your child: their name as shown on their ID, their relationship to your child, the type of ID the staff member saw, how the collection was checked, and any call we made to confirm it.
When we record a collection, we never record the collector's ID number, a photo of their ID, their photo or their phone number.
2.3 Collectors, pickup passes and restrictions
- Collectors list: the people you authorise to collect your child, with their name and relationship. You confirm they are 18 or over; we do not store their age.
- One-day pickup pass: a random, single-use link you can send to a collector for a particular day. It records who issued it, for which children and day, the collector's name and relationship, and when it was used.
- Do-not-release entries and holds: the name of a person who must not collect your child, and any hold on collection. A manager may attach a photo of a restricted person so that relief staff can recognise them. Staff only look at that photo. It is kept as a small resized copy, is never analysed by software, and is deleted with the entry.
2.4 Daily care records
- Meals and milk feeds, nappy changes and toileting, naps, any medicine given, symptoms observed, and notes on your child's play, learning and wellbeing.
- Absences and their reasons, including when a child is sent home with a fever.
2.5 Incident reports
If your child is hurt or unwell at the centre, we record what happened, when and where, what we observed, any first aid or medicine given and the permission for it, who saw it, what we did next, the staff member responsible and when we told you.
2.6 App accounts
- Parents: the name and email address you sign in with, and which of your children your account is linked to.
- Staff: name, role, the Google account used to sign in, and their first name, which is what appears on records parents can see.
- If you allow notifications, a device code so we can send alerts to your phone. It is stored privately against your account.
2.7 The camera
The Flock app uses the phone's camera only to read QR codes, on the phone itself. No image is stored, uploaded or analysed for faces.
2.8 What we do not collect
We do not use face recognition or any other biometric data. We do not record ID numbers or copies of ID. We do not track location. We do not use advertising, analytics or tracking software, and we do not build profiles of you or your child.
3. Why we collect it
| Purpose | What it covers |
|---|---|
| Caring for your child | Knowing who is present, what they have eaten, when they slept and what they need. |
| Safety and safeguarding | Making sure a child is only released to someone you have authorised, and recording health checks and incidents. |
| Keeping you informed | Daily records, incident notices, absence confirmations and collection notices. |
| Meeting our obligations | Records a registered childcare centre is expected to keep, and evidence we may need if a question about an injury or a collection arises later. |
4. Consent
Because these records are about young children, a parent or guardian gives consent on their child's behalf at enrolment. You may withdraw consent for an optional part, such as your child's photograph or app notifications, at any time by writing to us. Some records we must keep regardless, because they are part of our duty of care or our legal record keeping. If you ask, we will tell you which is which.
When you add a collector or send a pickup pass, you confirm that the collector has agreed and knows we will record their name.
5. Where your data is stored
Records are stored on Google Cloud (Firestore) in Google's Singapore region. Google acts as our service provider and does not use the data for its own purposes. Data is encrypted in transit and at rest. Singapore has data protection law comparable to Malaysia's, and our agreement with Google includes data protection terms.
The Flock app on a staff phone keeps a copy of the children's details and the attendance records it has shown, including the names of people who collected, so it can work with a weak connection. It never keeps collectors lists, do-not-release entries or holds. The copy is cleared when the staff member signs out, or the next time the app opens after their access is removed. A phone that is never opened again keeps it, protected by the phone's screen lock, which our staff phone policy requires.
We do not sell personal data, and we do not share it with advertisers, marketers or data brokers.
6. Who can see your child's records
- You see your own child's records only. The app cannot show you another family's child, and this is enforced by our server, not only by the app.
- Our staff see the children in their care so they can sign them in and out, check collectors and keep the daily log. Every record names the staff member who made it.
- The Principal, managers and administrators see records across the centre, including parent contact details.
- Collectors lists, do-not-release entries and holds are managed by our managers, shown to staff through our server when they are needed at the door, and never stored on staff phones. You can see your own child's collectors list in the app.
Staff access ends on the day a staff member leaves. We may share a record with a doctor, hospital or the relevant authority where a child's health or safety requires it, or where the law requires us to.
7. How long we keep it
We keep records only as long as we need them for your child's care, our legal duties, or to answer a question or claim later. After your child leaves, we keep:
| Record | Kept for up to |
|---|---|
| Attendance and collection records, including who collected and how it was checked, and the history of changes to collectors and do-not-release entries | 7 years after your child leaves |
| Daily care records, absences and incident reports, including the medicine, symptom and witness notes that go with them | 7 years after your child leaves |
| The current collectors list, and do-not-release names and photos | 30 days after your child leaves |
| One-day pickup passes | 30 days after the pass date. Who collected your child is copied to the attendance record first. |
| Door arrival taps from the parent app | 14 days |
| Fees, invoices and receipts | 7 years, as tax and company law require |
For the first 3 years after your child leaves, these records stay in our system. After that they are moved, together with your child's enrolment details and the contact details you gave us, to a secure archive that no app or staff screen can reach, and destroyed at the end of the period above. Your child's photograph is deleted at that point and is not archived. We keep a log of what we destroy and when. We may keep a particular record longer only while a complaint, claim or official inquiry about it is open. If you ask us to delete your child's data sooner, we will, except for records we are required to keep.
8. Your rights
Under the PDPA you may ask us to:
- give you a copy of the personal data we hold about you and your child;
- correct anything that is wrong or out of date;
- stop using data for a purpose you have not agreed to, or withdraw consent for an optional feature;
- delete data, where we are not required to keep it.
Write to us at the email address below. We will respond within 21 days, at no charge. If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner of Malaysia.
9. Keeping data safe
- Only accounts we have approved in advance can sign in. There is no self-registration.
- Every request is checked against rules on our server, so what an account can see is decided centrally, not by the app.
- Removing an account takes effect on its very next request.
- Sensitive details, such as parent contact information, restrictions and device codes, are kept in separate private records.
- Alerts sent to managers never name the child or the restricted person.
No system is perfect. If a data breach affects your or your child's personal data, we will notify the Personal Data Protection Commissioner and you where the law requires, and tell you what happened, what it affected and what we are doing about it.
10. Changes to this policy
If we change this policy, we will update the version and date at the top and tell parents directly when the change is significant, for example if we begin collecting something new.
11. Contact us
Little Nest Child Care Centre Sdn. Bhd.
Company No. 202501014831 (1616246-X)
1st Floor (Level 2) L 10222, Lot L1.09, Green Height Mall, Jalan Datuk Bandar Mustafa, 93250 Kuching, Sarawak, Malaysia
Email: admin@littlenest.my
Phone: +60 16 924 0328