Grain Rain Holdings Ltd. ("Myharambee", "we", "us", "our") operates the Myharambee community childcare exchange platform, available at myharambee.com and through our iOS and Android applications. We are the data controller for personal data processed through the Service, registered with the UK Information Commissioner's Office under registration number ZB987100. Our registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

This Privacy Policy explains what personal data we collect about you, why we collect it, how we use and share it, and the rights you have over your data. It applies to everyone who uses Myharambee. For questions, write to privacy@myharambee.com. For matters specifically requiring our Data Protection Officer, write to dpo@myharambee.com.

1. Personal Data We Collect

Account and profile data

Name, email address, telephone number, postal address, date of birth, profile photograph, emergency contact information, and the user type you registered as (parent, solo provider, or partnered provider).

Identity verification data

Government-issued identification documents and a biometric selfie used for liveness and face match. This data is collected and processed by Stripe Identity (Stripe Payments UK Ltd. and its affiliates) on our behalf. We receive only a verification outcome and minimal verification metadata; we do not store the original identity document images on our servers.

Background check data

For users acting as childcare providers, we process Disclosure and Barring Service (DBS) certificate numbers and Update Service subscription details supplied by the provider. We do not generate or hold the underlying criminal record information.

Training and qualification data

Your progress and completion status for required and supplementary training courses provided through the platform.

Service and booking data

Help requests you create or accept, the time and location of agreed sessions, session check-in and check-out events, points balances, point transactions, escrow movements, reliability scores, ratings, and reviews.

Session location data (providers, while a session is active)

When a provider checks in to a confirmed session, we activate location-based safeguards to verify the provider remains with the children for the duration of care. This includes:

• A geofence around the agreed session location, set up using your device's operating system, which notifies our app when the device enters or leaves the area.
• Periodic heartbeats containing approximate GPS coordinates and an accuracy reading, sent at intervals of one to two minutes during the session.
• A record of geofence entry/exit events, heartbeat gaps, and any incidents these events trigger.

This processing is active only while a session is in progress. It begins at provider check-in and ends at provider check-out. We do not collect background location at any other time. Providers consent to this processing per session through an in-app prompt; refusing the prompt ends the session. The lawful basis for this processing is our legitimate interest in protecting the safety and wellbeing of children placed in the care of providers, balanced against the privacy of the provider, with vital interests as an additional basis during a live incident. A Legitimate Interest Assessment is available on request.

Communications data

Messages exchanged with other users through the in-app messaging system, support tickets, community posts and comments, and notifications.

Device and technical data

Device model and operating system, device push notification token, IP address, app version, language and locale, and crash diagnostics. We do not use third-party SDKs to track you across other apps or websites.

Cookies and similar technologies (web only)

We use strictly necessary cookies to keep you signed in and remember preferences. We do not use advertising or cross-site tracking cookies. You can manage cookies in your browser settings; disabling strictly necessary cookies will prevent the website from working.

2. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6:

For special category data (biometric data used for KYC), we rely on your explicit consent under Art. 9(2)(a), captured before the verification flow begins.

3. How We Use Your Data

We use the data above to:

• Create your account and authenticate you on the platform.
• Verify your identity, age, and right to provide childcare.
• Match parents with available providers and process help requests.
• Operate the points-based exchange, including escrow, balances, overtime, and reliability scoring.
• Run the session monitoring safeguards described in section 1.
• Notify you about events you care about (incoming requests, status changes, messages, alerts).
• Investigate safety concerns, reports, appeals, and disputes.
• Detect and prevent fraud, abuse, and misuse of the platform.
• Comply with our legal and regulatory obligations, including child safeguarding and tax/accounting requirements.
• Improve the Service through aggregated, anonymised analytics.

We do not subject you to solely automated decision-making that produces legal or similarly significant effects on you without human review.

4. Sharing Your Data

We do not sell, rent, or trade your personal data. We share it only as described below.

With other users on the platform

• Parents see provider profile information (name, photo, ratings, reviews, qualifications, availability, distance band).
• Providers see parent/requester information needed to provide care (name, photo, agreed location, child information the parent has chosen to share, contact during the session).
• During an active session, parents receive alerts about session status, including any session monitoring incidents. These alerts may include the provider's last reported approximate location at the time of the incident. Parents do not receive a continuous live view of provider location.

With our processors and service providers

We share the minimum data necessary with vetted processors operating under written data processing agreements:

With administrators and moderators

Our internal admin and customer support team can access account, verification, session, message, and incident data on a need-to-know basis to operate the Service, investigate reports, and resolve disputes. All admin access is logged.

For legal and safety reasons

We may disclose data to comply with legal obligations, court orders, regulatory requests, or lawful subpoenas; to enforce our Terms or investigate violations; to protect the rights, property, safety, or wellbeing of users (especially children), Myharambee, or others, including reporting safeguarding concerns to relevant authorities; and in connection with a corporate transaction subject to confidentiality and to this Privacy Policy continuing to apply.

5. International Transfers

Our primary servers are located in the United Kingdom and European Economic Area. Some of our processors are based outside the UK/EEA. Where personal data leaves the UK we rely on UK adequacy decisions where applicable, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or other appropriate safeguards required by UK GDPR Chapter V. You can request a copy of the relevant transfer mechanism by writing to privacy@myharambee.com.

6. Data Retention

We retain personal data only as long as needed for the purposes set out above and the periods set by law. Our standard schedule:

When the retention period ends, data is deleted or irreversibly anonymised, except where we are required by law to keep it longer.

7. Your Rights

Under UK GDPR you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing: ask us to pause processing while a query is investigated.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interest, including session monitoring (note: objecting will end your ability to act as a provider on the platform).
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making: we do not subject you to solely automated decisions with legal or similarly significant effects.

To exercise any right, write to privacy@myharambee.com. We will respond within one calendar month, extendable to three months for complex requests.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Web: https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address any concern with us first.

8. Children's Data

Myharambee is for adults (18+) acting as parents/guardians or as childcare providers. We do not provide services directly to children, and children may not register accounts.

Information about a child placed in care (such as first name, age, dietary or medical notes, or a photograph chosen by the parent) is provided to us by the parent in the booking context and shared only with the assigned provider for the purpose of that booking. We follow the principles of the ICO Age Appropriate Design Code (Children's Code) when handling any data relating to people under 18, including data minimisation, retention limits, and refraining from any profiling.

If you believe we have inadvertently collected data directly from a child without parental authorisation, contact privacy@myharambee.com and we will delete it promptly.

9. Data Security

We implement technical and organisational measures appropriate to the risk:

• TLS 1.2+ encryption for data in transit; AES-256 encryption at rest for sensitive fields.
• Argon2 password hashing.
• HTTP-only, secure-flagged authentication cookies.
• Role-based access controls and audit logging on admin actions.
• Rate limiting and abuse detection.
• Regular vulnerability assessments and patching.
• A documented incident response process.

In the event of a personal data breach posing a risk to your rights, we will notify the ICO within 72 hours and you without undue delay where required by Art. 34. No system is perfectly secure, but we work to make ours strong, and we expect the same of our processors.

10. Changes to This Policy

We may update this policy as the platform evolves or as the law changes. When we make a material change we will post the revised policy on the website and in the app, and where the change materially affects how we use your data, give you advance notice by email or in-app banner so you have a chance to review before the change takes effect. Continued use of the Service after a change becomes effective indicates acceptance.

11. Contact