Last updated: October 2026
# 1. In short
Tumble helps families find and book children's activities.
We collect and use personal information to:
- run your Tumble account;
- process and manage bookings;
- communicate with you about your bookings;
- help providers run activities safely;
- process payments and refunds;
- provide customer support;
- improve Tumble; and
- meet our legal obligations.
Your child's health and safety information is shared with the provider responsible for a session your child is booked to attend, where that information is relevant to running the session safely.
We do not share your email address with a provider for the provider's own marketing unless you have chosen to allow this. A provider may nevertheless receive information needed to administer a booking, and a provider that already had your contact details before you used Tumble may continue to hold them under its own privacy notice.
We do not sell personal information.
We do not use advertising cookies.
We explain below what information we collect, why we use it, who receives it, how long we keep it and the choices and rights available to you.
---
# 2. Who is responsible for your information?
Rhythm Limited, trading as Tumble and Just Tumble, is the organisation responsible for your Tumble account.
Rhythm Limited is registered in England and Wales under company number 15186358.
Registered office:
24 St. Stephens Gardens London W2 5QX England
For data-protection questions, contact:
Allyn Aaron [email protected]
Tumble is generally the controller of personal information that we collect and use to operate your Tumble account and provide Tumble's services.
A provider may also be a controller of personal information relating to an activity that you book.
For example, where you book your child into a provider's class, the provider will generally be responsible for deciding how it uses information it receives to organise and deliver that class, including information needed for safeguarding.
The provider's own privacy notice may therefore apply to its use of your information.
---
# 3. When Tumble acts for a provider
Some providers use Tumble to manage their own customers, bookings and administration.
Where Tumble processes personal information on behalf of a provider and under that provider's instructions, the provider may be the controller and Tumble may act as its processor.
In that situation, the provider remains responsible for deciding why and how that information is used, and the provider's privacy notice applies.
The exact controller/processor relationship depends on the service the provider has chosen and how the information is being used.
---
# 4. Information we collect
Information about you
We may collect:
- your name;
- email address;
- telephone number;
- home address and postcode;
- your relationship to the children on your account;
- account and login information; and
- communications you have with Tumble.
We use this information to create and operate your account, communicate with you and administer your bookings.
Information about your children
You may provide:
- name;
- date of birth;
- school and year group;
- allergies;
- medical conditions;
- medication information;
- additional needs;
- whether the child may leave an activity without an authorised adult;
- authorised collection arrangements;
- emergency information; and
- photography or media preferences.
Some of this information is particularly sensitive.
We only ask for information that is relevant to the purposes explained in this notice or to the activity and safeguarding requirements of the provider.
Emergency contacts
If you provide an emergency contact, we may collect their:
- name;
- relationship to the child; and
- telephone number.
Please make sure that you are entitled to provide their information and, where appropriate, tell them that you have done so.
Bookings and payments
We collect information about:
- activities you book;
- dates and times;
- children attending;
- providers;
- booking status;
- amounts paid;
- refunds and credits;
- payment method; and
- relevant account or balance information.
Our payment provider processes card payments.
Tumble does not receive or store your full payment-card number where the payment is processed by our payment provider.
We may retain a payment reference and limited card information, such as the last four digits, where necessary to identify a payment or saved payment method.
Messages and support
We may retain messages sent through Tumble between you and providers, together with communications between you and Tumble's support team.
We use these to provide the service, investigate problems, answer questions, prevent misuse and resolve disputes.
How you use Tumble
We may collect information about how you use Tumble, including:
- pages viewed;
- searches;
- activities or listings selected;
- links followed;
- technical information about your device or browser; and
- information about how you interact with Tumble.
We use this information to operate, secure and improve Tumble.
Where we provide providers with information about how families discovered them, we aim to provide it in aggregated form rather than identifying individual families.
---
# 5. Location information
If you have not provided a postcode or another location for activity searches, Tumble may use an approximate location derived from your internet connection to help show activities in a relevant area.
This is approximate rather than a precise device location.
We do not use this information to show you an exact distance from your home.
Where the approximate-location lookup is used only to provide this feature, we do not retain the lookup result as part of your Tumble profile.
---
# 6. Children's health and safeguarding information
Some information about a child may be special-category personal data, including information about health.
Examples include:
- allergies;
- medical conditions;
- medication;
- disability or additional needs; and
- other information about a child's health.
We only process this information where there is a lawful basis under Article 6 of the UK GDPR and an applicable additional condition under Article 9.
The precise legal basis depends on the purpose for which the information is being used.
Where you provide health information so that it can be used to support your child's safe participation in an activity, we may rely on your explicit consent as the Article 9 condition, alongside the applicable Article 6 lawful basis.
Where another legal condition is applicable, we may rely on that condition instead.
We will not rely on consent where another lawful basis or special-category condition is more appropriate.
Our detailed internal records identify the lawful basis and Article 9 condition applicable to each processing activity.
What happens if you withdraw consent?
Where processing relies on your consent, you may withdraw that consent at any time.
Withdrawal does not affect processing that took place before you withdrew it.
If you remove information that a provider needs to keep your child safe, the provider may no longer have that information available when your child attends.
You should therefore consider telling the provider directly about any important health or safeguarding information as well.
---
# 7. Why we use your information
The following table describes the main purposes for which we use personal information.
| Purpose | Examples of information | Main legal basis | |---|---|---| | Create and operate your Tumble account | Name, email, phone, account information | Performance of contract | | Process bookings | Family, child and booking information | Performance of contract | | Send booking communications | Email, phone, booking details | Performance of contract | | Process payments and refunds | Payment and transaction information | Performance of contract and legal obligations | | Keep financial records | Transaction and payment information | Legal obligation | | Help providers deliver booked activities | Child, booking, collection and relevant safety information | Performance of contract and/or applicable legal basis | | Process health information for safeguarding | Health and additional-needs information | Article 6 basis plus applicable Article 9 condition | | Provide customer support | Account, booking and communication information | Performance of contract and legitimate interests, depending on the purpose | | Prevent fraud, misuse and security incidents | Account, device, transaction and usage information | Legitimate interests and/or legal obligations | | Improve Tumble | Usage and technical information | Legitimate interests, where appropriate | | Understand which providers families discover through Tumble | Aggregated usage information | Legitimate interests | | Send marketing | Email and marketing preferences | Consent or another lawful basis permitted by applicable electronic-marketing law |
The lawful basis shown above is a summary.
Where the same information is used for more than one purpose, different legal bases may apply to different uses.
---
# 8. Who receives your information?
We share personal information only where there is a reason and lawful basis to do so.
This may include:
Activity providers
Where your child is booked onto a provider's activity, the provider may receive the information it reasonably needs to administer the booking and keep your child safe.
This may include:
- child's name;
- age or date of birth;
- relevant allergies or medical information;
- relevant additional needs;
- emergency contact information;
- authorised collection arrangements; and
- photography or media preferences relevant to that activity.
A provider does not receive information about children who are not attending its activities merely because they are included on your Tumble account.
A provider does not receive another provider's information about your child.
Payment providers
We use third-party payment providers to process payments, refunds and saved payment methods.
Email providers
We use third-party email delivery services to send service and, where permitted, marketing communications.
Technology and security providers
We use technology providers to host, secure, operate and maintain Tumble.
Legal and professional advisers
We may disclose information to professional advisers, insurers, regulators, law enforcement bodies or other authorities where necessary to comply with law, protect rights or deal with legal claims.
---
# 9. Your email address
We treat your email address separately from the information that providers need to administer your child's attendance.
Tumble communications
We send essential communications such as:
- booking confirmations;
- receipts;
- booking changes;
- reminders;
- security messages; and
- password or account-recovery messages.
These are part of providing Tumble and are not marketing communications.
Tumble marketing
You can choose whether to receive Tumble's newsletter and other marketing communications where consent is required.
You can unsubscribe at any time.
Provider communications
A provider may communicate with you through Tumble about an activity you have booked.
Where this happens, Tumble sends the message without necessarily disclosing your underlying email address to the provider.
Sharing your email with providers
Where Tumble gives you a choice about sharing your email address directly with a provider, that choice is separate from your agreement to receive essential booking communications.
If you choose to share your email address, the provider may use it in accordance with its own privacy notice and any choices you make with that provider.
A provider that already held your contact information before you used Tumble may continue to use that information under its own privacy notice.
---
# 10. Marketing
We will only send direct marketing in accordance with applicable data-protection and electronic-marketing law.
Where consent is required, we will ask for it.
You can unsubscribe from marketing communications at any time.
Unsubscribing from marketing does not stop essential communications needed to operate your account or administer your bookings.
---
# 11. Services we use
We currently use or may use the following third-party services.
Stripe
Used for payment processing and saved payment methods.
Resend
Used to deliver email.
Cloudflare
Used to deliver, protect and secure the website and related services.
ipapi.co
Used where appropriate to estimate a general location from an IP address so that we can prioritise nearby activities.
postcodes.io and OpenStreetMap / Nominatim
Used to convert addresses or postcodes into map locations for mapping and location-related features.
This list may change.
Where a new service receives personal information, we will update this notice where appropriate and ensure that the relevant contractual, security and transfer requirements are in place.
---
# 12. International processing
Some of the companies we use may process or make personal information accessible outside the United Kingdom.
Where this happens, we assess whether the arrangement involves a restricted transfer under UK data-protection law.
Where required, we rely on an applicable UK adequacy regulation, appropriate safeguards such as the UK International Data Transfer Agreement or another lawful transfer mechanism.
We do not describe a service as “UK-hosted” merely because Tumble itself is based in the UK.
The locations and transfer mechanisms for relevant suppliers are recorded in our internal supplier and data-flow records.
---
# 13. Cookies and similar technologies
Tumble uses cookies and similar technologies.
We use some technologies because they are necessary for Tumble to provide a service you have requested or to keep the service secure.
Other technologies require your consent before we use them.
We do not use advertising cookies.
Essential technologies
Depending on how you use Tumble, these may include technologies that:
- keep you signed in;
- maintain your basket;
- display a booking confirmation;
- remember your cookie preference; or
- provide security and fraud protection.
Optional provider-referral technology
Where you arrive through a provider's link or widget, we may use an optional cookie or similar technology to remember that referral for up to 90 days.
This allows us to attribute the introduction to the provider.
It does not change the price you pay.
Optional referral technology
Where a friend has referred you, we may use an optional cookie or similar technology to remember the referral for up to 30 days.
Cookie choices
Where consent is required, we will not set the relevant technology until you have given consent.
You can withdraw or change your choices through our cookie controls where available.
Clearing cookies in your browser may also remove stored preferences and cause Tumble to ask for your choice again.
---
# 14. How long we keep information
We keep personal information only for as long as we have a legitimate or legal reason to keep it.
Our current retention periods include:
Account information
We keep account information while your account remains open.
If you ask us to delete your account, we will delete or anonymise information that we no longer need to retain.
Bookings and financial records
We retain booking and financial information for the period required for accounting, tax, legal, dispute-resolution and other legitimate purposes.
Our current target retention period is 6 years, subject to the precise legal and operational requirement applying to the particular record.
Data-rights requests
We retain records of completed data-protection requests for 6 years where necessary to demonstrate compliance and deal with disputes.
Emails and communications
Routine email and communication records are generally retained for 1 year, unless they need to be kept longer for a booking, dispute, safeguarding matter, legal claim or another legitimate purpose.
Login sessions
Session information is generally retained for no more than 30 days after expiry, subject to security requirements.
Uploaded files
Files that are no longer required for the purpose for which they were uploaded are generally deleted within 90 days, unless they need to be retained for another lawful purpose.
Safeguarding and incident information
Safeguarding information may need to be retained for longer periods.
Where the information belongs to or is controlled by a provider, the provider's retention requirements and privacy notice may apply.
Retention periods are reviewed periodically and information is deleted or anonymised when it is no longer required.
---
# 15. Your rights
Depending on the circumstances, you may have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate information;
- ask us to delete information;
- ask us to restrict processing;
- object to certain processing;
- withdraw consent where we rely on consent;
- receive certain information in a portable format; and
- object to direct marketing.
Some rights are subject to legal exceptions.
For example, we may be required to retain particular financial, legal or safeguarding information even if you ask us to delete it.
---
# 16. Using Your account → Your data
Where available, you can use Your account → Your data to download information associated with your Tumble account.
You can also contact us if you want to exercise a right that cannot be dealt with through the self-service tools.
We normally respond to valid data-rights requests within one month, subject to any permitted extension or other legal exception.
We may need to verify your identity before completing a request.
---
# 17. Deleting your information
If you ask us to delete your information, we will delete or anonymise information that we no longer need and are legally permitted to delete.
This may include:
- your account information;
- children's information held solely for the operation of your account;
- health information held by Tumble where there is no continuing lawful reason to retain it;
- emergency-contact information; and
- saved activities and preferences.
We may retain information where necessary to:
- comply with a legal obligation;
- establish, exercise or defend legal claims;
- prevent fraud;
- protect children or other people;
- maintain required financial or accounting records; or
- comply with another applicable legal requirement.
Where we retain information after a deletion request, we will explain the main reason.
Deleting information from Tumble does not automatically delete information that a provider already holds under its own controller responsibilities.
If you want information held by a provider deleted, you may need to contact that provider directly.
---
# 18. Children
Tumble is designed for parents and carers to manage children's activities.
Children do not create their own Tumble family accounts.
We expect information about a child to be provided by a parent, guardian or other person with appropriate authority.
We do not knowingly use children's information for advertising.
Where the Children's Code applies to a particular Tumble service, we take its standards into account when designing and operating that service.
---
# 19. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access to children's information is restricted according to role and need.
We maintain records of relevant staff access and changes to sensitive information.
We use appropriate security controls around financial, account and audit information.
No online system can be guaranteed to be completely secure.
If we become aware of a personal-data breach, we will assess the incident and notify affected people and/or the Information Commissioner's Office where required by law.
---
# 20. Providers and their responsibilities
Providers are independent organisations.
Where a provider receives information about your child for the purposes of delivering an activity, the provider may become responsible for that information as a controller.
Providers are responsible for:
- using the information lawfully;
- keeping it secure;
- explaining their processing to families;
- retaining it only as long as necessary; and
- responding to rights requests that relate to processing for which they are responsible.
Where Tumble processes information solely on a provider's documented instructions, Tumble acts as the provider's processor and the provider remains responsible for the relevant controller obligations.
The exact arrangement depends on the Tumble service being used.
---
# 21. Complaints
If you have a question or complaint about how Tumble uses your personal information, please contact:
We will investigate your concern and try to resolve it.
You can also complain directly to the Information Commissioner's Office (ICO).
Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Website: ico.org.uk
---
# 22. Changes to this notice
We may update this Privacy Notice when our services, technology, legal obligations or data practices change.
If a change is significant, we will take reasonable steps to bring it to your attention before or when the change takes effect where required.
The current version will always be available on Tumble.
---
# 23. Contact
Rhythm Limited trading as Tumble / Just Tumble
24 St. Stephens Gardens London W2 5QX England
Email: [email protected]
Company number: 15186358