Privacy Notice

Privacy notice for parents/carers

Under data protection law, individuals have a right to be informed about how Childbase Partnership Limited uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about you and your child within the guidelines of the General Data Protection Regulations (GDPR) 2018.

We, Childbase Partnership Limited are the ‘data controller’ for the purposes of data protection law.

The personal data we collect about you and your child

Personal data that we may collect, use, store and share (when appropriate) about parents/guardians and their child/ren includes, but is not restricted to:

The information we hold about your child includes:

• Personal details such as name, date of birth and gender
• Medical and health related information
• Attendance information such as booking patterns and absence records
• Personal characteristics including ethnic background, if supplied
• Special Educational Needs information
• Development records
• CCTV images
• Photographs

The information we hold about you as a parent or guardian includes:

• Personal details such as your name and address
• Contact details including your address, phone numbers and email
• Bank details for the purpose of setting up a Direct Debit and processing refunds
• CCTV images
• Photographs where consent has been given (family books & nursery events)

The Department of Education specify what early years information must be collected in order to claim funding, namely:

• Child’s full name i.e. forename, middle name(s) and legal surname
• Gender
• Date of birth
• Ethnicity
• First language
• Address
• Birth certificate or passport (please note that some local authorities require us to keep a copy)

Similarly in order to claim additional funding such as Early Years Pupil Premium (EYPP), Disability Access Fund (DAF) or 30 hours then extra information is required in order to establish eligibility, see below:

• EYPP:  Parent’s NI number, Parent’s Date of Birth, 1st 3 letters of parent’s surname.
• DAF:  Child’s Disability Living Allowance reference
• 30 hours:  11 digit eligibility code, Parent’s NI number

Please note that if a parent does not provide the requested information then Childbase cannot claim funding for their child.

We may also hold data about children that we have received from other organisations, including other nurseries, local authorities and the Department for Education. 

All local authority parent declarations will be retained in line with HMRC’s policies on the archiving of financial information.

It is your responsibility to inform us of any change to the personal data we hold on you and/or your child.

Why we use this data

Childbase Partnership is responsible for keeping all data provided securely to prevent data loss, misuse or unauthorised access.

Full information on how data is held both within Childbase Partnership Limited systems and any third party systems can be found within the parent registration pack which forms part of your registration process.

We use this data to:

• Support and monitor each child’s learning and development
• Report on each child’s learning and development progress
• Protect children’s welfare including behaviour monitoring
• Administer admissions, booking and session changes
• Comply with relevant laws regarding data sharing
• To share data for statutory inspections and audit purposes
• To be able to contact you in the case of an emergency
• To be able to take monthly payment of fees, where applicable
• For marketing purposes where consent has been provided
• To assess and improve our services (via surveys and feedback through Ceeda Research Limited)

Some data is necessary to supply and maintain our contract with you as a customer. Other data is optional and it is your choice to supply this when registering with any Childbase Partnership Limited nursery.

Our legal basis for using this data

We only collect and use a child’s personal data when the law allows us to. Most commonly, we process it where:

• We need to comply with a legal or statutory obligation

Less commonly, we may also process a child’s personal data in situations where:

• We have obtained consent to use it in a certain way (marketing purposes)
• We need to protect the individuals vital interests (or someone else’s interests)

Where we have obtained consent to use a child’s personal data, this consent can be withdrawn at any time by contacting your Nursery Manager in writing. We will make this clear when we ask for consent. There may be further grounds which justify our use of personal data.

Collecting this information

Whilst the majority of information we collect about you and your child is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional within our registration documents. If it is mandatory, we will explain the possible consequences of not complying. This data will be required to meet legal or statutory requirements and to supply and maintain a contract with you.

How we store this data

We keep personal information about parents/guardians and their child whilst they are attending a Childbase Partnership nursery.

All your data is either kept in our Nursery Management System or in paper format. Data relating to you and your child will be kept in the nursery your child attends. Personal data held within a software system will be securely protected with individual logins, which will only be given to those who need to access the data. If you wish to see the full version of our IT security policy please contact the Data Protection Officer.

All data stored in paper format will be kept in a safe location where only those who are authorised to access it, can. This may include being locked away in a secure cupboard or filing cabinet.

Data is kept securely for 3 months after your contract with Childbase Partnership Limited ends unless it is legally required to be held for longer.

Who and why we share this data

We are legally obliged to pass some of your details on to third parties for legal reasons such as public bodies. This includes Local Authorities, Ofsted, NHS, Police and enforcing agencies. We will not give information about you or your child to anyone outside of the company without your explicit consent unless the law or our terms and conditions allow us to.

We may share your child’s progress data with schools as they transfer from nursery, however this will only be done with consent from you as a parent or guardian.

Data retention periods

Childbase Partnership Limited is committed to ensuring we only hold personal data for the necessary/required time.

Data which we hold under contract is subject to specified retention periods. These retention periods are in line with legal guidance and statutory requirements.

Once the data has been used for its original purpose and the retention period has expired, your data will either be deleted or anonymised (so that it can no longer be associated with you).

Parents and rights regarding personal data

Individuals have a right to make a ‘subject access request’ to gain access to personal information that Childbase Partnership Limited holds about them.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

Parents also have the right to make a Subject Access Request with respect to any personal data Childbase Partnership Limited holds about them.

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request please contact us via email dataprotection@childbase.com

Other rights

Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe, including the right to:

• Object to the use of personal data if it would cause, or is causing, damage or distress
• Prevent it being used to send direct marketing
• Object to decisions being taken by automated means (by a computer or machine, rather than by a person)
• In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
• Claim compensation for damages caused by a breach of the data protection regulations

To exercise any of these rights, please contact our data protection office via email dataprotection@childbase.com

Contacting us

If you have any questions about this Privacy Policy please contact us via email dataprotection@childbase.com