• We take privacy very seriously and we are currently updating all our records to comply with the General Data Protection Regulation (GDPR), the new data protection standard. This privacy notice provides detailed information about the processing of personal data of children and of children’s parents/guardians.

  • Categories of children’s information that we collect, hold and share include:

    • Personal information (such as name, address, date of birth)
    • Characteristics (such as language, nationality and country of birth)
    • Attendance information (such as sessions attended, number of absences and absence reasons)
    • Observations and assessment information and tracking of progress
    • Information on special educational needs and disabilities
    • Safeguarding information
    • Photos and images
    • What is known as Special Category Personal Data (SCPD) e.g. concerning health, medical information, ethnicity, religion or biometric data

    Why we collect and use this information

    We use the children’s and parents’ data to:

    • support children’s learning and development, enable staff to plan suitable activities to extend children’s knowledge and skills
    • ensure that all children are safe within our childcare provision
    • monitor and report on children’s progress
    • provide appropriate behavioural and emotional support as required
    • assess the quality of our services as a childcare provider
    • comply with the law regarding data sharing (GDPR)
    • meet the requirements of the early years foundation stage (EYFS)
    • make claims for funding

    The lawful basis on which we use this information

    We collect and use children’s information under the following lawful bases:

    • Contract: the processing is necessary for the agreement we have with the parents/guardians of the child to provide education and childcare at our Nursery for the child
    • Legal obligation: the processing is necessary for us to comply with the law (submitting data to the statutory authorities)

    Collecting children’s information

    While the majority of children’s information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the GDPR, we will inform you whether you are required to provide certain children’s information to us or if you have a choice in this.

    Storing children’s data

    We are required to hold children’s data for a reasonable period of time after children have left the Nursery (e.g. until after the next Ofsted inspection) as a requirement under the EYFS. The Limitation Act 1980 recommends that we retain data until the child reaches the age of 21 — or until the child reaches the age of 24 for child protection records. Your data will be held securely and will only be accessible by staff who are authorised to do so.

    Who we share children’s information with

    We share children’s information with:

    • schools that the child attends after leaving our Nursery
    • other childcare providers which the child may be attending
    • our local authority and the Department for Education (DfE)
    • special education needs co-ordinators
    • NHS services (health visitors and speech and language therapists)

    Why we share children’s information

    We do not share information about our children with anyone without your consent unless the law and our policies allow us to do so. We share children’s data with the DfE on a statutory basis and are required to submit data to our local authority, Bournemouth Borough Council.

    Data collection requirements

    To be granted access to children’s information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

    Contacting us, Raising concerns and Requesting access to your personal data

    Under data protection legislation, parents and children have the right to request access to information about them that we hold. To make a request for your personal information or to be given access to your child’s early years record, contact Milla MacDonald in the first instance.

    You also have the right to:

    • object to processing of personal data that is likely to cause, or is causing, damage or distress
    • prevent processing for the purpose of direct marketing
    • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
    • claim compensation for damages caused by a breach of the Data Protection Regulations

    If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), with whom we are already registered under reference: ZA317098, although the ICO recommends that steps are taken to resolve the matter with us before involving them.

    We will update this Privacy Notice from time to time. Any substantial changes that affect how we process your personal data will be notified on our website and to you directly, as far as practicable.

    May 2018