Privacy Notice for Childcare Users
Introduction
From the 25 May 2018 in the UK the Data Protection Act 1998 is being replaced by the General Data Protection Regulation: GDPR and accompanying Data Protection Act 2018. At Children at Heart we have always taken your privacy seriously and kept your data secure. Under GDPR this will not change, but as part of the GDPR principles we now have new requirements to tell you about the personal data we process and about your rights. We must have a ‘lawful basis’ for processing any personal data and not keep data any longer than necessary. We must be open and clear with you and where we need your permission to process personal data we must ask you to give us this rather than opting out. We are the Data Controllers for the information we collect and process.
Children have the same rights as adults but normally their parent acts for them until they are mature enough to understand and act for themselves or until they are 16 years old (13 in some circumstances).
What personal data do we process?
We obtain details about you and your child, and other people connected with your child (e.g. emergency contacts, other settings, health visitor) including: names; addresses; dates of birth; contact numbers; email addresses; financial and tax information; health information; children’s development, likes/dislikes, routines etc. religion and/or customs; photographs and any other information necessary to deliver our childcare service, including the provision of Early Years funded places and Tax Free Childcare for eligible children.
Why do we need this information? What do we use it for?
We need to gather information to be able to fulfill our contract with you to provide childcare and education and to keep your child safe and well. This includes being able to contact you to tell you news from the setting, communicate with you about your child’s day, and contact you in an emergency. It also includes monitoring and recording your child’s developmental progress. We are legally required to process certain data as part of the Statutory Framework for the Early Years Foundation Stage (EYFS), for the Local Authority and HMRC (e.g. for Early Years funding). Some of the information we ask for is not required for legal or contractual reasons but is useful to help us provide the best possible care and education for your child. In this case we will consider if we have a legitimate reason for processing this information or ask for your consent.
GDPR describes six reasons for processing personal data, known as ‘lawful bases’. We use four of these in the setting: legal obligation; to fulfill a contract; legitimate interests and vital interests. For more information see the ICO website www.ico.org.uk or our Data Protection Policy.
How do we keep your information safe?
We store any digital information on a password protected devices or encrypted external USB storage devices (back-ups), Tapestry (online learning journal) or in password protected cloud storage such as Dropbox and Google Drive. Paper records are stored in a locked filing cabinet when not in use. We carry paper copies of emergency contact details for your child whenever we leave the setting. These will be kept in sealed envelopes in our first aid kit. Our emergency contact, Tim Martland also has a copy to be opened in the case of an emergency. Parent and other emergency contact names and numbers are saved in our PIN/thumbprint protected mobile phone. Photographs are stored as above but may also be on our Facebook pages with your consent or displayed in the setting, for example in photo albums.
Who do we share your information with?
Your information will only be shared with someone you give us permission to share with or a healthcare professional in an emergency or as required to fulfill our legal obligations for example under the requirements of the Early Years Foundation Stage to share with other settings, Ofsted, HMRC or the Local Authority.
We also use Dropbox, Google Drive and Tapestry as data processors. We have contracts with them and must make sure they obey the law, including GDPR.
How long do we keep your information for?
When your child leaves the setting I have a legal obligation to keep certain information, including children’s accident/incident records, records of attendance and contracts, and 2y checks if applicable, in some situations until a child is aged 25 years. These will be stored securely in paper format in the loft. Please see the setting’s Retention Policy for full details. We also keep the copies of your child’s photos that appear in the setting’s photo albums and, with your permission, photos that have been uploaded to the parent Facebook page. All other information will be given to you, including all developmental records. Once information is no longer needed it will be shredded, deleted or otherwise destroyed.
What are my rights?
You have the right to know what data the setting holds, who it is shared with, how it is stored, how long for and how it is destroyed when no longer needed. This information is all contained in this Privacy Notice with more detailed information in the setting’s Data Protection Policy. You have the right to request a copy of any data the setting holds that you have given to us (a Subject Access Request) and in some situations, for any digital data to be transferred to you, or someone else you ask us to give the information to, in the same format (known as data portability). We will provide this information within 1 month.
You have the right for all data we hold to be accurate. We will check that the information you have given us remains correct at least once a year, however you should let us know of any changes that happen in the meantime or if any of the information we have recorded is inaccurate. You have the right to ask us to stop processing your data whilst any errors are put right or if you have any concerns.
You have the right to withdraw your consent where we have asked you for permission to process your data. You can do this by emailing us or writing to us. You also have the right to ask that any information we hold about you that we have no lawful basis to keep is destroyed. This is known as the right of erasure or right to be forgotten. If you ask us to do this we will then delete all information we are not legally required to keep or that we have no other lawful basis for as soon as possible, and always within one month. We will notify you when this is done.
You also have the right to object to our processing information you have provided and to ask us to stop, for example if you disagree with our lawful basis (reason for processing). We will then consider if your objection is valid and if so stop. You will be notified of the outcome of your objection within one month. This only applies to information you have provided that did not require consent.
How to Complain
If you are unhappy about how your information has been collected, or handled, or if your data has been shared inappropriately or been lost you should follow the setting complaint’s policy which you were given when your child joined the setting. Please ask if you no longer have a copy. If after following this you are still unhappy you can complain directly to the UK data protection regulatory body: the Information Commissioner’s Office at https://ico.org.uk/concerns/ or by calling 0303 123 1113
NOTE
‘You/your’ = parents/guardians and children using our childcare service.
‘We/us/our’ = Rebecca Martland and any Childminding assistants: operating as ‘Children at Heart Registered Childminder’
Introduction
From the 25 May 2018 in the UK the Data Protection Act 1998 is being replaced by the General Data Protection Regulation: GDPR and accompanying Data Protection Act 2018. At Children at Heart we have always taken your privacy seriously and kept your data secure. Under GDPR this will not change, but as part of the GDPR principles we now have new requirements to tell you about the personal data we process and about your rights. We must have a ‘lawful basis’ for processing any personal data and not keep data any longer than necessary. We must be open and clear with you and where we need your permission to process personal data we must ask you to give us this rather than opting out. We are the Data Controllers for the information we collect and process.
Children have the same rights as adults but normally their parent acts for them until they are mature enough to understand and act for themselves or until they are 16 years old (13 in some circumstances).
What personal data do we process?
We obtain details about you and your child, and other people connected with your child (e.g. emergency contacts, other settings, health visitor) including: names; addresses; dates of birth; contact numbers; email addresses; financial and tax information; health information; children’s development, likes/dislikes, routines etc. religion and/or customs; photographs and any other information necessary to deliver our childcare service, including the provision of Early Years funded places and Tax Free Childcare for eligible children.
Why do we need this information? What do we use it for?
We need to gather information to be able to fulfill our contract with you to provide childcare and education and to keep your child safe and well. This includes being able to contact you to tell you news from the setting, communicate with you about your child’s day, and contact you in an emergency. It also includes monitoring and recording your child’s developmental progress. We are legally required to process certain data as part of the Statutory Framework for the Early Years Foundation Stage (EYFS), for the Local Authority and HMRC (e.g. for Early Years funding). Some of the information we ask for is not required for legal or contractual reasons but is useful to help us provide the best possible care and education for your child. In this case we will consider if we have a legitimate reason for processing this information or ask for your consent.
GDPR describes six reasons for processing personal data, known as ‘lawful bases’. We use four of these in the setting: legal obligation; to fulfill a contract; legitimate interests and vital interests. For more information see the ICO website www.ico.org.uk or our Data Protection Policy.
How do we keep your information safe?
We store any digital information on a password protected devices or encrypted external USB storage devices (back-ups), Tapestry (online learning journal) or in password protected cloud storage such as Dropbox and Google Drive. Paper records are stored in a locked filing cabinet when not in use. We carry paper copies of emergency contact details for your child whenever we leave the setting. These will be kept in sealed envelopes in our first aid kit. Our emergency contact, Tim Martland also has a copy to be opened in the case of an emergency. Parent and other emergency contact names and numbers are saved in our PIN/thumbprint protected mobile phone. Photographs are stored as above but may also be on our Facebook pages with your consent or displayed in the setting, for example in photo albums.
Who do we share your information with?
Your information will only be shared with someone you give us permission to share with or a healthcare professional in an emergency or as required to fulfill our legal obligations for example under the requirements of the Early Years Foundation Stage to share with other settings, Ofsted, HMRC or the Local Authority.
We also use Dropbox, Google Drive and Tapestry as data processors. We have contracts with them and must make sure they obey the law, including GDPR.
How long do we keep your information for?
When your child leaves the setting I have a legal obligation to keep certain information, including children’s accident/incident records, records of attendance and contracts, and 2y checks if applicable, in some situations until a child is aged 25 years. These will be stored securely in paper format in the loft. Please see the setting’s Retention Policy for full details. We also keep the copies of your child’s photos that appear in the setting’s photo albums and, with your permission, photos that have been uploaded to the parent Facebook page. All other information will be given to you, including all developmental records. Once information is no longer needed it will be shredded, deleted or otherwise destroyed.
What are my rights?
You have the right to know what data the setting holds, who it is shared with, how it is stored, how long for and how it is destroyed when no longer needed. This information is all contained in this Privacy Notice with more detailed information in the setting’s Data Protection Policy. You have the right to request a copy of any data the setting holds that you have given to us (a Subject Access Request) and in some situations, for any digital data to be transferred to you, or someone else you ask us to give the information to, in the same format (known as data portability). We will provide this information within 1 month.
You have the right for all data we hold to be accurate. We will check that the information you have given us remains correct at least once a year, however you should let us know of any changes that happen in the meantime or if any of the information we have recorded is inaccurate. You have the right to ask us to stop processing your data whilst any errors are put right or if you have any concerns.
You have the right to withdraw your consent where we have asked you for permission to process your data. You can do this by emailing us or writing to us. You also have the right to ask that any information we hold about you that we have no lawful basis to keep is destroyed. This is known as the right of erasure or right to be forgotten. If you ask us to do this we will then delete all information we are not legally required to keep or that we have no other lawful basis for as soon as possible, and always within one month. We will notify you when this is done.
You also have the right to object to our processing information you have provided and to ask us to stop, for example if you disagree with our lawful basis (reason for processing). We will then consider if your objection is valid and if so stop. You will be notified of the outcome of your objection within one month. This only applies to information you have provided that did not require consent.
How to Complain
If you are unhappy about how your information has been collected, or handled, or if your data has been shared inappropriately or been lost you should follow the setting complaint’s policy which you were given when your child joined the setting. Please ask if you no longer have a copy. If after following this you are still unhappy you can complain directly to the UK data protection regulatory body: the Information Commissioner’s Office at https://ico.org.uk/concerns/ or by calling 0303 123 1113
NOTE
‘You/your’ = parents/guardians and children using our childcare service.
‘We/us/our’ = Rebecca Martland and any Childminding assistants: operating as ‘Children at Heart Registered Childminder’