Your Privacy is important to Beach House Nursery so we have developed a number of privacy notices which cover how we collect, use, process, transfer and store your personal information. All your personal information shall be held and used in accordance with The General Data Protection Regulation 2018 (GDPR). Our full Data Protection Policy can be accessed by contacting our Data Protection Officer (DPO).
The policy below is intended to inform you how we gather, define, and utilise your personal information such as name, address, email address and mobile phone number.
Beach House Nursery is the data controller for any personal information you provide to us regarding you or your child, this means we decide how your personal data is processed and for what purpose.
Beach House Nursery is required to collect and process data for a number of purposes concerning its staff, contractors, parents, children and any other individual who comes into contact with the company. In gathering and using this data Beach House Nursery is committed to protecting all individual’s rights of freedom and privacy and meeting the requirements of the General Data Protection Regulation 2018 (GDPR).
What personal data we collect about you and your child
Beach House Nursery’s contractual responsibilities include but are not limited to the collection of the following personal data:
• Personal details (name, date of birth, gender)
• Attendance information (start date, hours in nursery)
• Medical and health information
• Personal characteristics
• Dietary requirements and preferences (allergies or intolerances, food likes/dislikes)
• Special Educational Needs information
• Development records
The information we hold about you as a parent or guardian include:
• Personal details (name, date of birth, national insurance number)
• Contact details (address, phone number, email address)
• Bank details (name of bank, account number and sort code)
We do hold some special category data about you and your child regarding race, ethnic origin, religion and health information. The special category data is only collected as required by the Local Authority or other public bodies for legal and contractual purposes. We comply fully with the requirements of GDPR in relation to special category data and are aware of the sensitive nature of the information.
It is the duty of you, the Data Subject to let us know of any personal data that has changed or is incorrect, we send out annual declaration forms to ensure the data we hold on you is accurate.
How we process your personal data
Beach House Nursery complies with its obligations under the GDPR by keeping personal data up to date; storing and destroying it securely; not collecting or retaining excessive amounts of data; protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. All the data we process, we do so to fulfil the contract we have with you.
Beach House Nursery holds and processes your data to be able to:
· Provide the appropriate care for your child
· Support your child’s learning
· Monitor and report on your child’s progress
· Ensure the right first aid and medication is provided to your child in cases where they become ill or have an accident in our care
There is certain data we hold about you as a parent or guardian to be able to successfully carry out the contract. The information we hold about you includes your name and address, contact details, bank details and signatures.
We hold this personal data and use it to:
· Be able to contact you in case there is an emergency regarding your child
· Be able to take payment for the childcare we are providing your child
· To provide proof of consent of your agreement to our contract terms and conditions
Whilst much of the data you provide to us is mandatory to carry out the contract you hold with us, some of it is provided on a voluntary basis. To comply with the GDPR we will inform you at the time of collection whether the information you are asked to provide is mandatory. Where personal data is not required for legal or contractual reasons, we will give you the opportunity to provide your consent for us to use your data for that purpose.
The lawful basis in which we process this data
Beach House Nursery collects and processes all the information you provide to us as a parent or guardian under the contractual lawful process. It is necessary to process this data to be able carry out the requirements of the contract. Without this data we will not be able to fulfil your contract and thus not be able to keep your child in our care. The health and medical data you provide to us regarding your child is legally required and is vital to keep your child safe whilst in our care.
Data regarding your child's ethnicity, race and religion is only processed under the requirements of Local Authorities and public bodies and upholding Beach House Nursery’s Equal Opportunities policy and ensuring we are meeting the Equality Act 2010.
Some data will only be processed if explicit consent is given. This can include the ability to take photographs of your child and using your details for direct marketing. Where this is the case we will ask for your consent at the time we collect your data.
Who collects this data
Beach House Nursery collects most of its data directly from the individual themselves. The information we collect about you and your child will all be obtained from the application pack you fill out when you first register your child. Additional data is collected as part of the Annual Declaration and on an ad-hoc basis as required.
Storage of data
All your data is either kept in our software systems or in paper format. Data relating to you and your child will be kept at the nursery. Personal data held within a software system will be securely protected with individual log-in, which will only be given to those who need to access the data. If you wish to see the full version of our IT security policy, please contact the Data Protection Officer.
All data stored in paper format will be kept in a safe location where only those who are authorised to access it, can. This may include being locked away in a filing cabinet/cupboard.
Who and why we share this data
We are legally obliged to pass some of your details on to third parties such as public bodies. This includes Local Authorities, Ofsted, NHS, Police and enforcing agencies. We will not give information about you or your child to anyone outside of the company without your explicit consent unless the law or our terms and conditions allow us to.
We may also share data with organisations for trend analysis. The processing of this kind of data we are not legally required to do and therefore we will ask you for your explicit consent for us to share your data for this purpose.
We may share your child’s progress data with schools as they transfer from nursery, however this will only be done with the explicit consent from you as a parent or guardian.
Data retention periods
Beach House Nursery is committed to ensuring we do not hold personal data for any longer than necessary.
Data which we hold under contract is subject to specified retention periods. These are as follows:
• Parent and child personal data – Until the child is 25 years old
• Safeguarding information – Until the child is 25 years old
• Medical and health data – Will not be destroyed
• Accident data – Will not be destroyed
• Child learning progress – Given to the parent when the child leaves the nursery, if not collected by the parent or guardian this will be destroyed a term after the child has left the nursery
Once the data has been used for its original purpose and the retention period has expired, we will appropriately dispose of the data.
If we wish to use your personal data for a new purpose, not covered by this Data Protection Privacy Notice, we will provide you with a new notice explaining this new purpose. Where and whenever necessary, we will seek your consent to the new processing.
Your data subject rights
Under GDPR you have the right to request access to any of the data held by Beach House Nursery about you and your child. If you wish to make a subject access request, please contact the Data Protection Officer (DPO).
If you feel Beach House Nursery has not handled your or your child’s personal details adequately or you are unhappy with how your data request has been dealt with contact the Data Protection Officer (DPO).