Owner: Privacy Department
Approver: Global Privacy Officer
Version: Effective August 2026
Last Reviewed: August 2026

1) Introduction

This Privacy Notice (“Notice”) explains Bright Horizons’ and our subsidiary/affiliate companies (“We”, “Us” or “Our”) use of facility cameras and supporting camera systems owned and operated by us (“Cameras”) at our Nurseries and Preschools (“Nurseries”), including how we collect, use, and disclose personal information processed on the Cameras (“Personal Information”).

2) Scope

This Notice applies to all Personal Information processed by Cameras, including any related biometric or AI‑supported features. It covers all individuals who may be captured in Camera footage, such as children, parents and legal guardians, employees, contractors, and visitors to the Nurseries. Please review this Notice in conjunction with our Global Consumer Privacy Notice for a more complete understanding of how we handle personal information. 

3) Location of Cameras

Cameras are visible and we may install them in the following locations: 

• Nursery and preschool rooms
• Playground areas
• Reception & Hallway
• Exterior building areas
• Carparks

We do not locate Cameras in areas where there is a reasonable expectation of privacy, such as bathrooms, toilets, changing or nappy areas, designated breast-feeding areas, or private staff rooms and offices.

4) Monitoring

We will not conduct live streaming or active monitoring of the Camera footage of nursery rooms, playground areas, reception areas and hallways. Under limited circumstances as described below, we may use AI facial recognition in exterior areas for security purposes.

5) Categories of Personal Information & Processing Purposes

We obtain Personal Information from (a) the Camera footage recorded by the Cameras; and (b) under limited circumstances as described below, images of individuals we upload to the Camera system. We do not collect audio or non-facial biometric identifiers such as fingerprints, voiceprints, or retinal scans. Under limited circumstances as described below, we process facial biometric identifiers. 

We will only use Personal Information in compliance with applicable laws and as reasonably necessary and proportionate to achieve the purposes described below.

6) Biometric Identifiers Notice

In limited circumstances as described above, the only category of biometric identifier processed by the Cameras is facial geometry patterns. Cameras can extract, from regular Camera footage or uploaded images, unique facial measurements that form a facial geometry pattern. These patterns allow the Cameras to recognise or confirm the identity of an individual. Our use of biometric identifier is intentionally limited, carefully evaluated, and subject to strong controls to ensure we protect the privacy and rights of children, families, and staff while supporting safety and security in our Nurseries. Please see Sections 9 and 10 below for information on how we share, retain, destroy and safeguard Personal Information, including biometric identifiers.

7) AI Disclosures

We do not collect, use, or sell Personal Information to train or improve any public, vendor‑owned, or broadly distributed large language models (LLMs) or other generalised AI models, nor do we allow Personal Information to be incorporated into any model that may be used by another organisation for their own purposes.

We may use Personal Information to fine‑tune or configure our own private, access‑controlled instance of an AI or machine‑learning model, solely to support our internal business operations and to improve performance of tools used exclusively within Bright Horizons’ controlled environment.

8) Data Sharing

We restrict access to Personal Information to authorised personnel of Bright Horizons on role-based permissions and only for the processing purposes described above.

We will only share Personal Information for the processing purposes described above and in accordance with established privacy controls, such as with: 

• Service providers / contractors (e.g., installation, cloud video management/hosting, analytics, maintenance/monitoring support) acting on our instructions under contract prohibiting secondary use/sale/sharing and requiring compliance with data protection laws and privacy/information security standards; and 
• Regulators, children’s / social services, and law enforcement as required under law; and 
• other parties to comply with a Court Order or lawful requests. 

9) Retention & Deletion

Default Retention for Facial Biometric Identifiers

We retain facial biometric identifiers of individuals who are:

• the data subject of lawful access requests for the period of time it takes to fulfil such requests; and 
• known security risk for as long as such security risk is present. 

We retain facial biometric identifiers of individuals captured in the Camera footage that are neither the data subject of the lawful access request nor a known security risk for the few seconds it takes the system to confirm they are not the targeted individual. We may use facial recognition technology to support the redacting/blurring of faces on Camera footage to protect their privacy.

Default Retention for all other Personal Information

Subject to the extended retention conditions described below, we retain all other Personal Information for 30 days. 

Extended Retention Conditions 

We may extend retention of Personal Information beyond the default period above only when necessary to: 

• investigate, establish, exercise, prepare for or defend legal claims; 
• comply with legal obligations; or 
• investigate an allegation or incident. 

Deletion Schedule

When the retention period ends, we irretrievably delete or overwrite Personal Information including facial biometric identifiers.

10) Data Security

• We use technical, organisational, and physical safeguards to protect Personal Information including encryption in transit and at rest using industry recognised standards and role‑based access with logging and periodic review.

• We use vetted service providers bound by contracts limiting processing, prohibiting secondary use/sale, and requiring security controls.

• We host Personal Information on Bright Horizons’ controlled and secured systems, or on dedicated private cloud resources where Bright Horizons controls access.

• We maintain a protocol for responding to data security incidents involving Personal Information inclusive of biometric identifier, including:

• immediate containment of the incident;
• evaluation of affected systems; and
• notification to individuals when required.

11) Your Privacy Rights & How to Exercise Them

Please refer to the section titled “What rights do you have over your personal information?” in our Global Consumer Privacy Notice for more information on the rights available to you where you live or receive services, such as right to access, correction, deletion, portability, and appeal. Parents/guardians may exercise rights on behalf of their child.

12) How We Will Update This Notice

We may update this Notice to reflect changes in our practices or legal requirements. We will notify you of any material updates, together with a new effective date.

13) Contact Us

We hope this Notice has been helpful in setting out the way we process and protect Personal Information. If you have any questions about this Notice, please contact our Global Privacy Team at dataprivacy@brighthorizons.com.