Tiggywinkles Day Nursery Limited is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you before, during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR). It applies to all parents, pupils and other interested parties.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Data protection principles
We will comply with data protection law. This says that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
Who processes your information?
Tiggywinkles Day Nursery Limited is a private limited company registered in England and Wales with registered number 06848125 and is a wholly owned subsidiary of Storal Learning Ltd (Storal Learning) which is also a private limited company registered in England and Wales with registered number 10421490. Storal Learning’s registered office is at 1 Kingdom Street, London, W2 6BD.
Tiggywinkles Day Nursery Limited and Storal Learning are joint data controllers of the personal information you provide to us. This means the nursery determines the purposes for which, and the manner in which, any personal data relating to pupils and their families is to be processed.
In some cases, your data will be outsourced to a third-party processor, such as eyMan, our nursery management software. Where the nursery outsources data to a third-party processor, the same data protection standards that Storal Learning upholds are imposed on the processor.
Why do we collect and use your information?
Storal Learning collects and uses personal data relating to staff, children and their families, and we may receive information regarding them from their previous setting or employer. We only use your personal information where the law allows us to.
We collect and use personal data in order to perform any contract we have entered into with you, to meet legal requirements and where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. These legitimate interests include us operating our business of providing nursery services and ensuring we meet the statutory requirements of the EYFS 2017.
We may also use your personal data on rare occasions where we need to protect your interests (or someone else’s interests) or where it is needed in the public interest.
The personal data of staff, children and their families (or nominated individuals authorised by parents to act in loco parentis) is collected and used for the following reasons:
- To safeguard children and staff
- To support children’s learning
- To monitor and report on children’s progress
- To provide appropriate pastoral care
- To assess the quality of our service
- To comply with the law regarding data sharing
- Images of staff, children and parents may be used to promote and market our school via our website and social media, provided we have received explicit consent
- To obtain funding from the Local Authority
- To monitor the continued professional development of our staff
- To manage payment of fees and other charges
What data is collected?
The categories of children, parent and staff information that the nursery collects, holds and shares include the following:
- Personal information – e.g. names, addresses, telephone numbers, email addresses, National Insurance number, Birth Certificate
- Characteristics – e.g. language, nationality, ethnicity, occupation etc.
- Attendance information
- Assessment information
- Relevant medical information
- Information relating to Special Education Needs
- Behavioural information
- Financial details, including bank account details
- Photographs and images, including CCTV footage on site
- Recruitment information including references, professional qualifications and DBS
Whilst the majority of the personal data you provide to the nursery is mandatory, some is provided on a voluntary basis.
When collecting data, the nursery will inform you whether you are required to provide this data or if your consent is needed.
Where consent is required, the nursery will provide you with specific and explicit information with regards to the reasons the data is being collected and how the data will be used.
If you fail to provide certain information when requested, we may not be able to provide services to you or we may be prevented from complying with our legal obligations.
How we use sensitive personal information
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:
- In limited circumstances, with your explicit written consent.
- Where we need to carry out legal obligations and in line with our data protection policy.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving consent, or where you have already made the information public.
The categories of sensitive personal data we may process are relevant medical information and information relating to Special Education Needs.
How long is your data stored for?
Personal data relating to children, their families and staff are stored in line with the nursery’s Data Protection Policy. In accordance with GDPR, the company does not store personal data indefinitely; data is only stored for seven years after you leave the nursery or longer if we are legally required to do so.
With whom will my information be shared?
The company may share information with:
- Children’s destination upon leaving the nursery
- The Local Authority
- The NHS
- External payroll providers
- External software providers for invoicing, accounting and nursery management purposes
- External cloud storage providers
- Promotional material
Storal Learning will not share your personal information with any third parties without your consent, unless the law allows us to do so. The law permits us to share information with third parties where it is a legal requirement to do so, where it is necessary to administer any contract with you or where we have another legitimate interest in doing so.
Our third party service providers change from time to time and we can let you have details of parties who are processing your data at any given time upon request. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may transfer your personal information outside the EEA. If we do, we will ensure there are appropriate measures in place to provide a similar degree of protection for your personal information as that required in the EEA. This can be done in a number of different ways, for instance:
- The country to which we send the personal information may be approved by the European Commission; or
- The recipient may have signed a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal information; or
- The recipient has explicitly made a commitment to comply with codes of conduct which have been declared by the European Commission as being generally applicable, and this is supported by certification of the data processing procedures; or
- Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US; or
- Where we are otherwise authorised to transfer your personal data, for example where you have given your explicit consent to the transfer.
Please contact our Named Contact if you want further information on where we may transfer your personal data out of the EEA and the specific mechanism used by us when we do.
What are your rights?
Parents, children and staff have the following rights in relation to the processing of their personal data. You have the right to:
- Be informed about how we use your personal data
- Request access to the personal data that we hold
- Request that your personal data is amended if it is inaccurate or incomplete
- Request that your personal data is erased where there is no compelling reason for its continued processing
- Request that the processing of your data is restricted
- Object to your personal data being processed
We do not envisage that any decisions will be taken about you using automated decision making, however we will notify you and advise you of your rights in writing if this position changes.
Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time.
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates.
If you have any questions about this privacy notice, please contact the Nursery Manager or Storal Learning’s officer responsible for data compliance (Named Contact) at email@example.com.
If you have a concern about the way Storal Learning manages your data, you can raise a concern with the Information Commissioner’s Office (ICO). The ICO can be contacted on 0303 123 1113, Monday to Friday between 9am and 5pm.