PARENTS AND CHILDREN – PRIVACY NOTICE: Data Protection & Confidentiality
At Seahorse Nursery we recognise that we hold sensitive/confidential information about children and their families. Your rights relating to use of your personal data changed in May 2018, with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, coming into force. This Privacy Statement explains in plain English how and why the Seahorse Nursery processes your personal data under these new laws.
• We follow the legal requirements set out in the Statutory Framework for the Early Years Foundation Stage and accompanying regulations about the information we must hold about registered children and their families.
• We follow the requirements of the General Data Protection Regulations (GDPR) 2018 and the Freedom of Information Act 2000 with regard to storage of data and access to it.
The GDPR states that personal data must be processed lawfully, for a specific purpose, kept to a minimum, accurate and up to date, retained only for as long as necessary and kept securely. The below will detail how we abide by these laws.
This notice is to help parents understand how and why Seahorse Nursery collects your child’s personal information and what we do with that information. It also explains the decisions that you can make about your child’s information (when we refer to ‘your’ in this notice it may include you and your child)
What we use your information for?
We may use your information to:
• Support your child’s learning and monitor their progress
• To keep your child safe and healthy
• Assess the quality of our services
• Provide essential care
• Comply with the law in terms of data sharing
What information do we collect?
We collect various types of information from you that are divided up into different categories. Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection law, we will inform you when you have a choice in this.
• Personal Information: Name, address, date of birth, gender, parent and emergency contact details
• Sensitive Data: ethnicity, language, nationality, religion, funded hours eligibility, national insurance number, financials such as direct debit details, medical information, special education needs (SEN) information, accident/ incidents, dietary information, photos
• Assessment Information: learning journals, tracking, cohort tracking, planning
• Attendance: sessions attended, absences and reasons for absences
We have a Data Audit Log that lists all of the information we hold, why we hold it and how long for. You can request, in writing, to see this at any time to the Manager.
How do we store your information?
All personal paper files are kept in the locked office and computer files kept on a USB hard drive or password protected email. Photos are only to be taken on the nursery cameras which are locked away in the filing cabinet and also stored on the USB hard drive. We will provide the parent with all developmental records upon leaving the nursery. All files such as outings permissions, medication forms, dietary requirement information is deleted or shredded upon leaving the nursery. Key personal information (including name, address, date of birth), registers, minor accident/ incident/ pre-existing forms, complaints to Ofsted are kept securely then deleted/shredded after seven calendar years. Any records of major accidents/ incidents/ pre-existing injuries or safeguarding data is kept for as long as advised by Local Authority.
Who do we share your information with?
We may share your information with various other parties/ agencies. These include:
• Other settings your child may attend
• Schools your child may go on to attend
• The Local Authority e.g. safeguarding practices, SEN support, advisory support, Early Years Funding
• Department for Education e.g. Early years census
• Health Visitors e.g. as part of your child’s 2 Year Check
• External Agencies e.g. Speech and Language Therapist, Occupational Therapist, Physiotherapist
• Our insurance company e.g. if there is a serious incident
Where possible, we will gain your consent for information sharing unless the law or our policies exceeds the consent. We never discuss other children’s details with you.
Who has access to your data?
Various files can be accessed by all staff members but some more sensitive data (e.g. safeguarding file) is only accessed by senior management. These files are kept in the locked office. Any information shared with the staff team is done on a ‘need to know basis’ and treated in confidence. During induction and upon leaving employment, staff are reminded of confidentiality and the importance of not sharing information outside of Nursery. If staff breach any confidentiality provisions, this may result in disciplinary action and, in serious cases, dismissal. Students on placement in the nursery are advised of our confidentiality policy and required to respect it.
Any breach of confidentiality would betray your trust and be to the detriment of the relationship between the child, parents and the nursery.
Our legal grounds for using your information
This section contains information about the legal basis that we are relying on when handling your information.
This means that the processing is necessary for legitimate interests except where the processing is unfair to you. Seahorse Nursery relies on legitimate interests for most of the ways in which it uses your information. Specifically, Seahorse Nursery has a legitimate interest in:
• Providing educational and care services to your child;
• Safeguarding and promoting the welfare of your child (and other children);
• Protecting the objectives and interests of the setting. This includes making sure we are able to enforce our rights against you, for example, so that we can contact you about unpaid fees or government funding matters.
• Facilitating the efficient operation of the setting; and
• Ensuring that all relevant legal obligations of the setting are complied with.
Necessary for a contract
We will need to use your information in order to perform our obligations under our contract with you. For example, we need your name and contact details so that we can update you on your child’s progress and so that we can contact you if there is a concern. This also includes having your data to access local authority funding or to submit data to them for headcounts and census.
Where the setting needs to use your information in order to comply with legal obligation, for example, to report a concern to Safeguarding Services. We may also need to disclose information to third parties such as the local authorities/police where legally obliged to do so.
For example, to prevent someone from being seriously harmed or killed.
The setting must also comply with an additional condition where it processes special categories of personal information. For example, ethnic origin and health information.
We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can withdraw this consent at any time. Any use of your information before you withdraw remains valid.
How long do we keep your information?
When your child leaves nursery we are required to keep certain information; this time period will be in accordance with our data audit log.
In exceptional circumstances, we may keep your child’s information for a longer time than usual, but we would only do so if we had a good reason and only if we are allowed to do so under Data Protection Law. The Data Audit Log details how long we will keep your information for, you can request, in writing, to see this document.
What decisions can you make about your information?
From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights. Your rights are as follows:
• If information is incorrect you can ask us to correct it;
• You can also ask what information we hold about you (known as a Freedom of Information FOI request or Subject Access request SAR) and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to;
• You can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information;
• You can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer;
• Our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy;
• You can object to direct marketing
• Claim compensation for damages caused by breach of Data Protection regulations.
If you believe there has been a breach, please contact the nursery first. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/. If there has been a major breach to data, we must comply with telling the ICO of the breach within 72 hours.
Subject Access Request
Subject Access Request refers to your right to access your personal data. You can make a request to see your information in writing to the Manager. We have one month to respond to this request and cannot charge a fee to deal with the request. There may be times (to comply with safeguarding or law) that we cannot supply you with certain information.
Further information and guidance
This notice is to explain how we look after your child’s personal information. The Principal or Manager can answer any questions which you might have.
Like other organisations we need to keep your information safe, only use it for what we say we will, destroy it when we no longer need it and most importantly – treat the information we get fairly.
If you consider that we have not acted properly when using your child’s personal information you can contact the Information Commissioner’s Office: ico.org.uk.
The best way to get a feel for our environment is to come and visit us.
One of our team will be pleased to show you around the nursery and take you through how we support your child's learning and development.
A typical visit lasts around 20-30 minutes and you can use this handy online form to arrange a date and time. Please note that pre-school visits are generally at 10:00, and day nursery visits are at 10:30 and 15:30.