GDPR Privacy Notice

Information we collect

Children’s information

The categories of children’s information that we collect, hold and share include:

• personal information (such as name, address, date of birth)
• characteristics (such as ethnicity, language, nationality, country of birth, early years pupil premium eligibility)
• attendance information (such as sessions attended, number of absences and absence reasons)
• observations and assessment information and tracking of progress
• medical information
• information on special educational needs and disabilities (including if accessing Disability Living Allowance and entitled the Disability Access Fund)
• referrals to other relevant services
• safeguarding information.

Parents’ and guardians’ information

We also collect, hold and share some information on the children’s parents/guardians:

• personal information (names, address, contact numbers and emails)
• National Insurance numbers and dates of birth, for funding purposes.

How we obtain information

We obtain personal information directly from parents or guardians and, where appropriate, from the child. We may also receive information from previous or concurrent childcare providers, schools, the local authority, health professionals, safeguarding agencies and other professionals working with the child. Where information is obtained from another source, we provide the relevant privacy information within the period required by law.

Why we collect and use this information

We use the children’s and parents’ data to:

• support their learning and development, to enable staff to plan suitable activities to extend their knowledge and skills
• ensure that all children are safe within our childcare provision
• monitor and report on their progress
• provide appropriate behavioural and emotional support as required
• assess the quality of our services as a childcare provider
• comply with the law regarding data sharing (GDPR)
• meet the requirements of the early years foundation stage (EYFS)
• make claims for funding.

The lawful basis on which we use this information

We collect and use children’s information under the following lawful bases:

• Contract: the processing is necessary for a contract we have with you the parents/guardian of the child to provide childcare and the contract that we have with the local authority to provide funded childcare to eligible families.
• Legal obligation: the processing is necessary for us to comply with the law (submitting data for the early years census).

Some information we process is special category data, including information concerning health or disability-related health needs and information revealing racial or ethnic origin. We identify an applicable lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9 before processing it. Where required, we also meet an applicable condition and safeguard under Schedule 1 to the Data Protection Act 2018 and maintain an appropriate policy document.

For each purpose described in this notice, we identify and document the applicable lawful basis before processing begins. Depending on the purpose, this may include processing necessary to perform our childcare contract, comply with a legal obligation, carry out a task in the public interest, protect vital interests, pursue a legitimate interest where appropriate, or act on valid consent where consent is genuinely optional.

Collecting children’s information

While the majority of children’s information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the GDPR, we will inform you whether you are required to provide certain children’s information to us or if you have a choice in this.

Storing children’s data

We are required to hold children’s data for a reasonable period of time after children have left the provision (eg until after the next Ofsted inspection) as a requirement under the EYFS. We retain each category of personal information only for as long as necessary for its purpose and to meet applicable legal, safeguarding, insurance and limitation requirements. Our retention schedule records the period, or the criteria used to determine it, for each record type.

Who we share children’s information with

We routinely share children’s information with:

• schools that the child attends after leaving our provision
• other local childcare providers where the child is engaging currently (wrap around or blended childcare)
• our local authority (for funding claims and the early years census)
• the DfE (annual early years census)
• special education needs co-ordinators
• NHS services (health visitors and speech and language therapists).

Service providers

We may use carefully selected service providers that process personal information on our behalf, such as providers of childcare management, communications, storage, security, payment or professional support services. They may use the information only on our documented instructions, must keep it secure and must delete or return it when their services end, subject to any legal retention requirement.

Why we share children’s information

We share children’s information only where we have a lawful basis and, where relevant, an additional condition for special category data. Consent is used only where it is the appropriate basis. We may share information without consent where this is necessary to comply with a legal obligation, protect a child or another person, perform a public task, or otherwise where data protection law permits.

We share children’s data with the DfE on a statutory basis. We are required to submit data to our local authority (York City Council) for them to submit as part of the annual early years census in January and to access childcare funding.

Data collection requirements

To be granted access to children’s information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

Requesting access to your personal data

Under data protection legislation, parents and children have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s early years record, contact Tom Mathie, Data Protection Officer.

Your rights

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
• claim compensation for damages caused by a breach of the Data Protection Regulations.

Complaints

You may make a data protection complaint to us using the contact details below. We will acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep you informed where appropriate, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office at any time.

Contact

If you would like to discuss anything in this privacy notice, please contact: