Child and Parent Privacy notice for Stepping Stones Nursery
Stepping Stones Nursery (the Nursery) is part of Regis Community Arena Limited (RCAL), which is a subsidiary of United Learning Trust (ULT).
This notice is intended to provide information about how the Nursery will use or “process” personal data about individuals including current, past and prospective children and their parents, carers or guardians (referred to in this notice as “parents”).
Responsibility for Data Protection
The data controller for personal information held by the Nursery is RCAL. RCAL is registered with the Information Commissioner’s Office (ICO). The registration number is 00044535754.
The Company Secretary, Steve Whiffen, is responsible for ensuring that ULT complies with the Data Protection Law. He can be contacted on firstname.lastname@example.org or 01832 864538.
Lorraine Mellers is responsible for ensuring that the Nursery complies with ULT’s policies and procedures in relation to Data Protection. She can be contacted on Lorraine.Mellers@theregisschool.co.uk or 01243 871044.
The purposes for which we process Child and parent personal data
The Nursery and RCAL collect, create and hold personal information relating to our children and may also receive information about them from other nursery settings, local authority and/or the Department for Education (DfE). We also collect and hold personal information about our children’s parents and carers. We use this personal data to:
- Provide education services (including SEN), monitor children’s progress and educational needs.
- To safeguard children’s welfare and provide appropriate support and (where necessary) medical care.
- To receive information about current and prospective children from any educational provider that they attend.
- To confirm the identity of prospective children and their parents.
- To make use of photographic images of children within the Nursery, on the Nursery website and for publicity in accordance with the RCAL’s policy on taking, storing and using images of children.
- To create invoices and process payments for services.
- For security purposes, and for regulatory and legal purposes (for example child protection and health and safety) and to comply with its legal obligations.
- To receive reports from any organisation that may be working with your child.
- Where otherwise reasonably necessary for the Nursery’s purposes, including to obtain appropriate professional advice and insurance for the Nursery.
- To keep you updated about the activities of the Nursery including by sending updates and newsletters by email and post.
The categories of personal data held about children
The types of personal data processed by the Nursery will include:
- Names, addresses, telephone numbers, email addresses and other contact details.
- Education records and assessment results, including learning journals.
- Personal characteristics such as your ethnic group, religious beliefs, any special educational needs you may have, and any relevant medical information.
- Attendance information and behavioural information/records.
- Information provided by other early years providers and/or other professionals or organisations working with children.
- Where children go after they leave the Nursery.
- Images captured by the Nursery’s CCTV system (in accordance with RCAL’s policy on taking, storing and using images of children).
The legal basis for the processing of child and parent data
The processing of data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where necessary to comply with our legal obligations.
Information relating to racial or ethnic origin, religious beliefs or health (point 3) will only be processed with the explicit consent of the child’s parents or when it is necessary for carrying out our legislative obligations. Further information regarding the purposes for which these data would be processed will be provided with the data collection form.
Data Retention Periods
The child’s educational record will move with the child to their school or education establishment.
Information relating to financial transactions will be kept for 7 years.
For further information on how long we keep personal data for please refer to our records retention schedule which can be found http://www.theregisschool.co.uk/Policies
RCAL has in place technical and organisational measures that ensure a level of security appropriate to the sensitive nature of the personal data that we process. For further information regarding how we keep personal data secure please refer to ULT’s security of personal data policy.
We use third party data processors to provide us with a management information system, accounts software, cloud storage services, apps and software for use in the Nursery and to facilitate the secure transfer of data between the Nursery and central office. This use of data processors will only take place if is in compliance with the Data Protection Act 1998 and the General Data Protection Regulation.
Decisions on whether we contract with these third party processors are subject to a robust approval process and are based on a detailed assessment of the purpose for which the data processing is required, the level and sensitivity of data involved and the arrangements in place to store and handle the data. To be granted access to child level data, data processors must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements and retention and use of the data.
We currently use the following data processors:
Preschooler (the Nursery invoicing software company).
Sharing Data with Third Parties (other data controllers)
We may share data with the following recipients:
On request we will share education records with inspectors from Ofsted.
West Sussex County Council
We provide parent information for children’s funding applications (via Synergy FIS provider portal).
Other agencies (related to Early Years)
HMRC, Social Care, the Multi-Agency Safeguarding Hub (MASH), Health Visitors, other early years providers, the NHS and Early Childhood Services.
If you need more information about how our local authority use your information, please visit:
- our local authority at West Sussex County Council: please visit https://www.westsussex.gov.uk/contact-us
We will not give information about our children to any other third parties without your consent unless the law and our policies allow us to do so.
Rights of the Data Subject
Data protection legislation gives individuals certain rights which are detailed below. If you wish to exercise these rights please contact Lorraine Mellers (Nursery Manager).
Right of access to personal data “subject access request”
You have the right to access the personal data that the Nursery holds about you. Requests need to be made in writing. We take the security of personal data seriously so we may ask you for proof of identity to verify that you are entitled to the information requested.
Right to withdraw consent
Where we have obtained your consent to specific processing activities you may withdraw this consent at any time.
Right to rectification
You have the right to have the personal data that we hold about you rectified if it is inaccurate or incomplete. We will respond to such requests within one month.
Right to erasure
You have the right to have personal data erased in certain specific circumstances. If you make such a request we will consider whether the right to erasure applies and give you a full and reasoned response.
Right to restrict processing
In certain circumstances you have the right to request that we restrict the processing of your personal data. If you make such a request we will consider whether the right to restrict processing applies and give you a full and reasoned response.
For further information regarding your rights please refer to our rights of the data subject policy.
If you disagree with a decision that we have taken regarding the processing of your personal data please contact RCAL’s Company Secretary, Steve Whiffen, on 01832 864538 or email@example.com.
You also have the right to lodge a complaint with the information Commissioners Office on 0303 123 1113 or https://ico.org.uk/for-the-public/