Privacy Policies – New Regulations May 2018 – GDPR

Privacy Notice (How we use parents/carers and children’s information)

All information that we collect is necessary to meet our contractual and legal requirements as an Early Years Setting, from Ofsted, Local Authorities and the EYFS.

The categories of information that we collect, hold and share include:

• Personal information (such as name, date of birth and address)

• Characteristics (such as ethnicity, language, nationality, country of birth and funding eligibility) for children

• Attendance information (such as sessions attended, number of absences and absence reasons) for children

• Relevant Medical information for children

• Special Educational Needs information for children

• Assessment information for children

• Bank details for adults

• Proof of identity for adults

• Birth certificates for funding for children

• Details of any accidents / incidents / existing injuries

• Relevant documentation for child protection and safeguarding concerns

• Funding information and details

Why we collect and use this information

We use the data:

• to support children’s learning

• to monitor and report on their progress

• to provide appropriate pastoral care

• to assess the quality of our services

• to comply with the law regarding data sharing

• to comply with the requirements of the EYFS and Ofsted

• to ensure children are eligible for funding

• to process nursery fees

• to ensure children’s health, safety and well being

The lawful basis on which we use this information

We collect and use pupil information under the Statutory Framework for the Early Years Foundation Stage (given legal force by the Childcare Act 2006), The Limitation Act 1980. By completing and signing the nursery registration form you are giving consent for us to process yours and your child’s personal data for the specific purposes of being part of the nursery setting.The processing of the information you have provided about yourself and your child is necessary for the contract you have completed in the registration form. We have a legal obligation to process the information provided to comply with the law.

Collecting Children’s Information

Whilst the majority of children’s information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain information to us or if you have a choice in this.

Storing children’s data

We hold children’s data such as their registration details, accidents and medication forms etc. until each child has reached the age of 21. Learning and assessment for the children is stored for up to three months after the child has left the setting, then removed from storage. Parents are able to request copies of their data at any point up until this time.

Who we share children’s information with

We routinely share pupil information with:

 • Department for Education (DfE)

• Schools that the children attend after leaving us

• Our local authority

• Ofsted

• Health Visitors

• Social Workers

• Inclusion teams, SEN panels, funding etc

• Local Children’s safeguarding boards / LADO

• Other providers that children attend

• Multi agency professionals working with individual children

• Area SENCO’s

Why we share pupil information

We do not share information about children with anyone without consent unless the law unless we are obliged to as part of a lawful process/investigation.

Decisions on whether DfE releases this personal data to third parties are subject to a robust approval process and are based on a detailed assessment of who is requesting the data, the purpose for which it is required, the level and sensitivity of the data requested and the arrangements in place to store and handle the data. To be granted access to pupil level data, requestors must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements and retention and use of the data.

For more on information on how this sharing process works, please visit http://www.gov.uk/guidance/national-pupildatabase-apply-for-a-data-extract .

For information on which third party organisations (and for which project) pupil level data has been provided to, please visit https://www.gov.uk/government/publications/national-pupildatabase-requests-received .

If you require more information about how we and/or the DfE use this information please visit DfE’s website https://www.gov.uk/data-protection-how-we-collect-and-share-research-data or email us at info@nibleyhouse.co.uk.

Requesting access to your personal data

Under data protection legislation, parents and children have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact our Company Compliance Officer at info@nibleyhouse.co.uk .

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress

• prevent processing for the purpose of direct marketing

• object to decisions being taken by automated means

• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and

• claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance at info@nibleyhouse.co.uk . Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

Privacy Notice (How we use employee information)

All information that we collect is necessary to meet our contractual requirements as an employer, from Ofsted, Local Authorities and the EYFS.

The categories of employee information that we collect, process, hold and share include:

• personal information (such as name, passport number, bank details, national insurance number)

• special categories of data including characteristics information such as gender, age, ethnic group – this is collected anonymously for Equal Opportunities purposes

• contract information (such as start dates, hours worked, post, roles and salary information)

• work absence information (such as number of absences and reasons)

• qualifications and DBS numbers

• relevant medical information on your health declaration and return to work self-certification forms

Why we collect and use this information

We use employee data to:

• ensure that staff have the legal right to work in the UK

• ensure that all staff have the relevant qualifications required for their role

• support individuals with any health needs or other requirements

• enable individuals to be paid

• enable us to fulfil our duty of care to our employees.

The lawful basis on which we process this information

We process this information under the following legal basis:

Contract: In that the information we process is necessary for us to fulfil our contractual obligations to you. Legitimate Interest: Through the course of employment it may be necessary for us to process data that is related to individual employee’s. For example; information around absence trends, retention statistics etc. All processing that takes place is what would be reasonably expected as part of an employee / employer relationship and is undertaken with full consideration to individuals rights and privacy.

Collecting this information

Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection legislation, we will inform you whether you are required to provide certain school workforce information to us or if you have a choice in this.

Storing this information

We hold employee data for 6 years after staff have ended their employment with the company.

Who we share this information with

We routinely share this information with: our local authority (by means of staff census), DfE, Ofsted

Why we share school workforce information

We do not share information about workforce members with anyone without consent unless the law and our policies allow us to do so.

Local authority

We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments. We would also need to give staff details to our LADO or Ofsted if allegations were raised 2 against them.

Department for Education (DfE)

We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to funding and the assessment educational attainment.

Ofsted

During inspections Ofsted will ask to see evidence of staff qualifications and DBS numbers

Data collection requirements

The DfE collects and processes personal data relating to those employed in Early Years Settings. All settings are required to make a census submission because it is a statutory return under the Education Act 2005. To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/guidance/early-years-census . The department may share information about Early Years employees with third parties who promote the education or well-being of children or the effective deployment of Early Years staff in England by:

• conducting research or analysis

• producing statistics

• providing information, advice or guidance

The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data

• the purpose for which it is required

• the level and sensitivity of data requested; and

• the arrangements in place to securely store and handle the data

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data. To contact the department: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact info@nibleyhouse.co.uk

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress

• prevent processing for the purpose of direct marketing

• object to decisions being taken by automated means

• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and

• claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance at info@nibleyhouse.co.uk . Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/