Storal Learning Ltd is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you before, during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR). It applies to all parents, pupils and other interested parties.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Data protection principles
We will comply with data protection law. This says that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
Who processes your information?
Storal Learning Ltd is a private limited company registered in England and Wales with registered number 10421490. Storal Learning’s registered office is at 1 Kingdom Street, London, W2 6BD.
Storal Learning is the data controller of the personal information you provide to us. This means the company determines the purposes for which, and the manner in which, any personal data relating to pupils and their families is to be processed.
In some cases, your data will be outsourced to a third-party processor, such as eyMan, our nursery management software. Where the nursery outsources data to a third-party processor, the same data protection standards that Storal Learning upholds are imposed on the processor.
Why do we collect and use your information?
Storal Learning collects and uses personal data relating to staff, children and their families, and we may receive information regarding them from their previous setting or employer. We only use your personal information where the law allows us to.
We collect and use personal data in order to perform any contract we have entered into with you, to meet legal requirements and where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. These legitimate interests include us operating our business of providing nursery services and ensuring we meet the statutory requirements of the EYFS 2017.
We may also use your personal data on rare occasions where we need to protect your interests (or someone else’s interests) or where it is needed in the public interest.
The personal data of staff, children and their families (or nominated individuals authorised by parents to act in loco parentis) is collected and used for the following reasons:
- To safeguard children and staff
- To support children’s learning
- To monitor and report on children’s progress
- To provide appropriate pastoral care
- To assess the quality of our service
- To comply with the law regarding data sharing
- Images of staff, children and parents may be used to promote and market our school via our website and social media, provided we have received explicit consent
- To obtain funding from the Local Authority
- To monitor the continued professional development of our staff
What data is collected?
The categories of children, parent and staff information that the nursery collects, holds and shares include the following:
- Personal information – e.g. names, addresses, telephone numbers, email addresses, National Insurance number
- Characteristics – e.g. language, nationality, occupation etc.
- Attendance information
- Assessment information
- Relevant medical information
- Information relating to Special Education Needs
- Behavioural information
- Financial details
- Photographs and images
- Recruitment information including references, professional qualifications and DBS
Whilst the majority of the personal data you provide to the company is mandatory, some is provided on a voluntary basis.
When collecting data, the nursery will inform you whether you are required to provide this data or if your consent is needed.
Where consent is required, the company will provide you with specific and explicit information with regards to the reasons the data is being collected and how the data will be used.
If you fail to provide certain information when requested, we may not be able to provide services to you or we may be prevented from complying with our legal obligations.
How we use sensitive personal information
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:
- In limited circumstances, with your explicit written consent.
- Where we need to carry out legal obligations and in line with our data protection policy.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving consent, or where you have already made the information public.
The categories of sensitive personal data we may process are relevant medical information and information relating to Special Education Needs.
How long is your data stored for?
Personal data relating to children, their families and staff are stored in line with the nursery’s Data Protection Policy. In accordance with GDPR, the company does not store personal data indefinitely; data is only stored for seven years after you leave the nursery or longer if we are legally required to do so.
With whom will my information be shared?
The company may share information with:
- Children’s destination upon leaving the nursery
- The Local Authority
- The NHS
- External payroll companies
- External software companies for invoicing and accounting purposes
- External cloud storage companies
- Promotional material
Storal Learning will not share your personal information with any third parties without your consent, unless the law allows us to do so. The law permits us to share information with third parties where it is a legal requirement to do so, where it is necessary to administer any contract with you or where we have another legitimate interest in doing so.
Our third party service providers change from time to time and we can let you have details of parties who are processing your data at any given time upon request. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may transfer your personal information outside the EEA. If we do, we will ensure there are appropriate measures in place to provide a similar degree of protection for your personal information as that required in the EEA.
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
- Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.
- Where we are otherwise authorised to transfer your personal data, for example where you have given your explicit consent to the transfer
Please contact our Data Protection Officer if you want further information on where we may transfer your personal data out of the EEA and the specific mechanism used by us when we do.
What are your rights?
Parents. children and staff have the following rights in relation to the processing of their personal data. You have the right to:
- Be informed about how we use your personal data
- Request access to the personal data that we hold
- Request that your personal data is amended if it is inaccurate or incomplete
- Request that your personal data is erased where there is no compelling reason for its continued processing
- Request that the processing of your data is restricted
- Object to your personal data being processed
We do not envisage that any decisions will be taken about you using automated decision making, however we will notify you and advise you of your rights in writing if this position changes.
Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time.
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates.
If you have any questions about this privacy notice, please contact the Storal Learning’s Data Protection Officer on 0203 402 3071.
If you have a concern about the way Storal Learning manages your data, you can raise a concern with the Information Commissioner’s Office (ICO). The ICO can be contacted on 0303 123 1113, Monday to Friday between 9am and 5pm.