How we use children’s information
Under Data protection/General Data Protection Regulations (GDPR) law, Rainbow Day Nursery School Ltd has certain obligations as a data controller of personal information. This document is intended to make clear what information we hold, the purpose for us holding that information and our obligations in relation to it and make you aware of your rights as data subjects.
Rainbow Day Nursery School Ltd is registered with the ICO (Information Commissioners Office) under registration reference: ZA122300 and has been registered since 11th June 2015.
Please do not hesitate to contact us using the details at the bottom of this notice should you have any questions in relations to the information below.
GDPR includes 7 rights for individuals:
#1 The right to be informed
Rainbow Day Nursery School Ltd is a registered Childcare provider with Ofsted and as so, is required to collect and manage certain data.
The categories of information that we collect, hold and share include:
- Personal information (such as name, address, date of birth)
- Characteristics (such as ethnicity, language, nationality, Country of birth)
- Parental details (such as name, address, national insurance number, work details, contact details)
- Emergency contact details (such as family/friends details -names, contact number)
- Attendance information (such as days attended, number of absences and absence reasons)
- Assessment information (such as learning pathways and summative tracking, observations)
- Medical information (such as medical conditions or treatments, log of vaccinations, log of any incidents/accidents/illnesses that we are aware of that occurred at Nursery or at home)
- SEND (record of any Special Educational Needs and Disabilities along with associate observations, strategies, and learning plans)
- Parents claiming free nursery entitlement (the Nursery is requested to provide parental/child data to the Local Authority – this is sent via a secure electronic file transfer system)
- Visitor’s details (such as name and company – this is in respect of our Health and Safety and Safeguarding policy)
We use the data to:
- Support children’s learning and development
- Monitor and report on children’s progress
- Provide appropriate medical care and general care
- Assess the quality of our services
- Comply with the law regarding data sharing
- Safeguard children and families
#2 The right of access
Rainbow Day Nursery School is a company registered in England. Registration No: 06377432. Registered Office: Abacus House, 132 Parkwood Road, Bournemouth, BH5 2BN. Rainbow Day Nursery School, 14 Kingland Road, Poole, Dorset, BH15 1TP. Telephone Number, 01202 673581.
At any point an individual can make a request relating to their data and Rainbow Day Nursery School Ltd will need to provide a response within 30 days. Rainbow Day Nursery School can refuse a request, if we have a lawful obligation to retain data i.e. from Ofsted in relation to the EYFS, or for safeguarding issues. The Nursery will inform the individual of the reasons of rejection and inform them they have a right to complain to the ICO if they are not happy with the decision.
#3 The right to erasure
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However, Rainbow Day Nursery School has a legal duty to keep children’s and parents details for a reasonable time: Rainbow Day Nursery School retain these records for 3 years after leaving the Nursery. Children’s accident and injury records for 21 years and 24 years (or until the child reaches 24 years) for Child Protection records. This data is archived securely then confidentiality shredded by Madman’s Moving and Storage (Unit 1, 2 Willis Way, Fleet Lane Ind Est. Poole, Dorset, BH15 3SS) after the legal retention period. There is a full Risk Assessment in place for transportation and storage. A copy of this Risk Assessment can be provided upon request.
#4 The right to restrict processing
Parents, visitors, and staff can object to Rainbow Day Nursery School processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications.
#5 The right to data portability
Rainbow Day Nursery School requires data to be transferred from one IT system to another; such as from the main Nursery computer to the Local Authority. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.
#6 The right to object
Parents, visitors, and staff can object to their data being used for certain activities like marketing or research. Permission will be sought before any data is used in such as way.
#7 The right not to be subject to automated decision-making including profiling
Automated decisions and profiling are used for marketing-based organisations. Rainbow Day Nursery School does not use personal data for such purposes.
Storage and use of personal information
All paper copies of children’s records are kept in cupboards in the child’s room, high storage in Child’s rooms or in a locked cupboard in the Management office. Practitioners are present in the rooms at all times to ensure personal data is not shared and practitioners can have access to these files, but information taken from the files about individual children is confidential and apart from archiving, these records remain on site. These records are shredded after the retention period. Personal details are taken on outing for safeguarding reasons however full risk assessments are completed before an outing.
Information about individual children is used in certain documents, such as, a weekly register, medication forms, referrals to external agencies and disclosure forms. These documents include data such as children’s names, date of birth and sometimes address. These records are shredded after the relevant retention period.
Rainbow Day Nursery School collects a large amount of personal data every year including; names and addresses of those on the waiting list. These records are shredded if the child does not attend or added to the child’s file and stored appropriately. Information regarding families’ involvement with other agencies is stored both electronically on an external hard drive and in paper format, this information is kept in a locked cupboard. These records are shredded after the relevant retention period.
Upon a child leaving Rainbow Day Nursery School and moving on to school or moving settings, data held on the child may be shared with the receiving school. Such information will be sent via the Royal Postal Mail or via a secure file transfer system.
Rainbow Day Nursery School stores personal data held visually in photographs or video clips or as sound recordings, additional permission is obtained for this data. No names are stored with images in photo albums, displays, on the Nursery website.
Access to all Office computers is password protected. When a member of staff leaves the company, these passwords are changed in line with this policy and our Safeguarding policy. Any portable data storage used to store personal data, e.g. USB memory stick, are password protected and/or stored in a locked filing cabinet.
GDPR means that Rainbow Day Nursery School must;
- Manage and process personal data properly
- Protect the individual’s rights to privacy
- Provide an individual with access to all personal information held on them