Tax-Free Childcare: data protection impact assessment
Last updated Wed 7 Oct '26
ClubDock lets parents pay their club from their Tax-Free Childcare account while they book. Before doing that we assessed the risks to parents and children. This is a summary of that assessment.
| Reference | CD-DPIA-TFC-01, version 1.0 |
|---|---|
| Organisation | Pigeonhole Early Years Ltd, trading as ClubDock (company number 17014216, ICO registration ZC136329) |
| Approved by | Dave Mills, Director, 7 October 2026 |
| Next review | October 2027, or sooner if what we do with this data changes |
1. What happens
- A parent chooses to pay with Tax-Free Childcare and signs in to HMRC through Government Gateway. HMRC asks them whether to let ClubDock use their childcare account. If they agree, HMRC gives ClubDock a permission that lasts 18 months.
- For each child, the parent enters the child's childcare reference, the one ending in TFC. We send it to HMRC with the child's date of birth, and HMRC tells us the child's name as it holds it, so the parent can see the right child was linked.
- When the parent books, we ask HMRC for the account balance and show it to them. When they confirm, we ask HMRC to pay the club, using the club's own Tax-Free Childcare provider reference and postcode. HMRC returns a payment reference and the date the club should expect the money.
- The money goes from the parent's childcare account to the club through NS&I. It never passes through ClubDock.
Every request happens while the parent is using ClubDock. Nothing is sent in batches, and nothing is sent without the parent pressing a button.
2. What is shared, and for how long
| Information | Where it comes from | How long we keep it |
|---|---|---|
| The child's childcare reference and date of birth | The parent, and the club's registration form | While the club uses ClubDock, then deleted automatically twelve months after the club closes its account |
| The child's name as HMRC holds it, and when the account was linked | HMRC | |
| Each payment's amount and status, HMRC's payment reference and the expected payment date | HMRC | |
| HMRC's permission to use the account | HMRC | Kept encrypted, and deleted when the parent disconnects, when HMRC withdraws it, when it expires after 18 months, or when the club closes its account |
| The account balance | HMRC | Shown to the parent at the time, and not kept |
| A record of each request to HMRC: when it was made, which kind it was and whether it worked | ClubDock | 30 days |
No health or other special category information is involved. We send HMRC only the fields its service requires.
3. Who is responsible
Each club is responsible for its own families' records, and ClubDock looks after them on the club's behalf, as our data processing agreement describes.
The connection to Tax-Free Childcare is the exception. ClubDock is the payment provider registered with HMRC, and is party to HMRC's data sharing agreement for it, so for the information exchanged with HMRC we are a controller in our own right. HMRC is the controller of Tax-Free Childcare accounts, and NS&I makes the payments on HMRC's behalf.
4. Why this is necessary
- It is what the parent asked for. Paying the club from their childcare account is the reason the information is shared, and it is used for nothing else — not marketing, not analysis, not training anything.
- It is optional. A parent who would rather not connect their account can still pay the club by any other method it accepts, or through HMRC's own childcare service.
- The parent stays in control. They grant access at HMRC, confirm each payment, and can disconnect ClubDock at any time, which deletes the permission.
- It is minimal. We send HMRC only the fields it needs, do not keep balances, and never record HMRC's permission or the contents of a request in our logs.
5. Where it is held
Information from HMRC is held on Microsoft Azure in the United Kingdom, encrypted in transit and at rest. ClubDock will not exchange live Tax-Free Childcare information with HMRC until all of its data is hosted in the UK.
The club the payment is for sees its amount, status and HMRC's payment reference, so it can match the money when it arrives. If a club needs to refund a payment, we email it HMRC's payment reference through our email provider, Resend, in the United States, under the UK's international data transfer addendum. If a club has connected Xero or QuickBooks, the invoices we send there include the child's childcare reference.
6. Risks, and what reduces them
| Risk to parents and children | What reduces it | Remaining risk |
|---|---|---|
| Someone else uses a parent's childcare account through ClubDock | No passwords to steal: sign-in is a single-use code or a passkey, and attempts are limited. Each permission belongs to one parent at one club. Every payment is confirmed by the parent, and HMRC pays only a registered childcare provider. | Low |
| A payment is sent twice, or to the wrong club | A payment is recorded before it is sent and never retried automatically. The club's provider reference is set by the club, and a refusal from HMRC is shown to the parent rather than tried again. | Low |
| One family's details are seen by another family or another club | Every request is limited to one club, and a parent to their own children. This is enforced where the data is read, and covered by automated tests. | Low |
| The systems holding the data are breached | Encryption in transit and at rest. HMRC's permissions are encrypted again with keys held separately. The database accepts no passwords and is closed to the internet by default, and failures and unusual activity raise alerts. | Low |
| Information is kept longer than it is needed | Deletion is automatic, on the timescales above. It does not rely on anyone remembering. | Low |
| Someone inside ClubDock misuses the information | Access is limited to the director, who is DBS checked, as is anyone given access in future. Every change is recorded, and sign-in to our systems needs a second factor. | Low |
None of the remaining risks is high, so the assessment does not need to go to the Information Commissioner before the processing starts.
7. Questions
Our privacy notice explains how we handle personal information generally, and our data processing agreement sets out what we do for each club. For anything about this assessment, email support@clubdock.co.uk.