Privacy and data questions to ask about childcare tour booking

Tour-booking tools collect personal information about families and children. Before using one, understand what is collected, where it goes and who can access it.

Ask the supplier and your own service team:

Collection

• What fields are collected, and which are genuinely necessary?
• Is the family told why the information is collected and how it will be used?
• Are optional fields clearly marked?
• Does the form avoid collecting sensitive information that belongs in a later enrolment process?

Storage and access

• Where is the data hosted?
• Which staff and supplier personnel can access it?
• Are role-based permissions and audit logs available?
• Is information encrypted in transit and at rest?
• Are backups protected?

Sharing

• Which third parties or subprocessors receive the data?
• Is it used for advertising, profiling or product training?
• Can integrations send more information than the centre expects?

Retention and deletion

• How long are enquiry and booking records retained?
• Can the service export and delete records?
• What happens when the contract ends?

Incidents and compliance

• How are security incidents detected and reported?
• Who is responsible for breach response?
• Does the provider support the service’s obligations under the Privacy Act and the Notifiable Data Breaches scheme where applicable?

OAIC guidance on the Australian Privacy Principles covers collection, notification, use, disclosure, security, access and correction. ^R11 Whether particular obligations apply can depend on the organisation and circumstances; obtain legal advice for the service’s position.

Practical next step: complete a short privacy impact assessment before launch and repeat it when the form, integrations or supplier arrangements change.

Related guides

• What makes a childcare enquiry useful to a centre?
• How to add a CCS calculator or tour booking to a childcare website
• How should a multi-centre childcare website work?