This page explains how nursery users’ personal data is processed by the Nursery.  Some data relating to Nursery users is processed by other departments of the University and is not covered by the information on this page, for example the information which is provided for the purpose of the University’s Finance Office.

Personal information about the parent/carer and child/children is collected in our enquiry form. This includes:

• Name, address and contact details of the parent/carer;
• Name and date of birth of the child.

After the initial enquiry, parents/carers will provide additional personal information including:

• parent/carer relevant employment/study details (for University staff and students only);
• designated person details (we assume that they have agreed to this information being provided to us);
• doctor/health visitor information;
• health and dietary information;
• personal preferences;
• a photograph of the child;
• the child’s gender;
• the child’s religion;
• emergency contacts and their contact details (we assume you will have their permission to provide these details to us);
• Any other personal information provided to us in subsequent correspondence relating to the enquiry or application.

We collect and keep a record of personal information about children during their attendance at the Nursery including:

• Photographs – if parents/carers consented as part of the application and induction process to photographs being taken of their child at the Nursery. Consent can be withdrawn at any time;
• Observations – these are made in line with the Early Years Foundation Stage (EYFS) and are made up of both written and photographic evidence (as agreed with parents/carers on induction) to form a reflection of the child’s learning at nursery.
• Records of referrals to specialist early years’ services; including safeguarding and child protection concerns (which may necessitate retaining information about people connected with the child solely for the purposes of a referral).
• Records of any contact between the Nursery and medical practitioners or health visitors.
• CCTV footage. This is processed in accordance with the University’s CCTV Code of Practice and can be viewed on request.

In addition, the University will process financial information relating to the payment of fees.

Some of the information which is processed by the nursery is special category data of a sensitive nature. This includes:

• Biometric finger print information of parents/carers for entry to Nursery premises;
• Ethnicity data relating to the child;
• Medical conditions and disability information relating to the child;
• Health information relating to the child;
• Sickness records relating to the child;

We make sure that access to and the sharing of special category data are controlled very carefully.

When using video conferencing applications such as Zoom or Microsoft Teams, your name, user name, email address, your computer’s IP address, MAC address and device name may be collected.

The Nursery will process Nursery users’ personal data for the following purposes:

• Receiving, effectively checking and responding to requests from perspective parents for availability;
• Corresponding with and contacting parents/carers in relation to our services when requested;
• Providing a high level of care and education for the children in our care, including the creation of a learning journey and necessary assessment and keeping parents/carers informed;
• Sending newsletters, information about events, outings and external educators;
• Implementing and making decisions based on the University’s Child Safeguarding Policy and procedures, keeping every child safe from neglect and harm;
• To refer to external professionals when there is a concern about medical or educational need, gaining the necessary support and advice;
• Gaining or administering emergency care or first aid;
• Fulfilling our legal, regulatory and safeguarding obligations.

Video conferencing applications

When using video conferencing applications, such as Zoom and Microsoft Teams, personal data such as your IP address and device name may collected by the companies who own these applications in order to schedule and create a record of meetings, improve and tailor your experience when using these applications. Where video conferencing applications are used to record meetings, personal data captured within the recording are stored within the cloud service owned by that company. Where recording is taking place, you will be notified at the beginning of or as you enter the recording session.

Data held and used by the University are compliant with GDPR. Personal data stored by a service provider within the cloud may be stored outside of the European Economic Area.

We ask for your consent to process some personal data. If we do, we will collect it at the appropriate time, explaining why we are collecting the data and how we will use it, and this consent can be withdrawn this at any time.

In other cases, it is necessary to process personal data relating to parents/carers and to children in our care in order to:

• perform our contract with parents/carers to provide the Nursery’s services, or as a necessary preliminary step before we enter into a contract with parents/carers;
• comply with the legal obligations which the University and the Nursery have, including child protection and safeguarding requirements (such as Working Together to Safeguard Children 2015) requirements, OFSTED and EYES 2007 requirements, equal opportunities, immigration and public safety requirements;
• For the purposes of the University’s legitimate business interests (for example, for the purpose of planning, reviewing, managing and developing the Nursery’s and the University’s business, (but not to make any decisions about parents/carers or children)).

We will only process special category data with explicit consent or if it is necessary:

• For the establishment, exercise or defence of legal claims;
• To comply with the legal obligations which the University and the Nursery have, including child protection and safeguarding requirements (such as Working Together to Safeguard Children 2015) requirements;
• Very occasionally, when it is needed to protect a parent/carer’s or a child’s vital interests and they are not capable of giving their consent (for example, in an emergency);

Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Within the Nursery and the University, your data is shared with only those staff who need access for the purpose of delivering our services and facilities.

Personal data is shared with a range of external organisations as is necessary for the purposes set out above and as permitted or required by law, including the following:

• We will disclose information about children in our care and/or their parents/carers when it is necessary to meet child protection and safeguarding requirements and procedures. This is likely to occur when the Nursery has reason to believe that there is a threat to a child and referral to the local authority needs to be made. This will be done in accordance with our Child Safeguarding Policy and the advice of the local safeguarding children’s board;
• Data must be presented to OFSTED when requested, for example, as part of an inspection or when the identity of the inspecting officer has been verified;
• Information will be shared with the local authority to enable access to free education funding, but only when signed consent has been provided to us .
• We may provide information or CCTV footage to the police or other enforcement agencies for the purposes of the prevention or detection of crime;

Some personal data about children and parents/carers is routinely displayed within the Nursery, including health and medical information about children, where it can be viewed by those in the Nursery. We only do so with the consent of parents/carers following discussions during induction so an informed decision can be taken by parents/carers.

Except as we have explained, we will not publish or disclose any personal data to other external enquirers or organisations unless you have asked us to do or have consented to it, or unless it is in yours or your child’s vital interests to do so (e.g. in an emergency situation).

Your personal data is shared as is necessary, on a considered and confidential basis, with several external organisations which assist with processing your information. These organisations act on our behalf in accordance with our instructions and do not process your data for any purpose over and above what we have asked them to do. We make sure we have appropriate contracts in place with them. Sometimes your personal data is processed by these organisations outside the European Economic Area (for example, because they use a cloud-based system with servers based outside the EEA), and if so, we make sure that appropriate safeguards are in place to ensure the confidentiality and security of your personal data.

We do not sell personal data to any third parties and we do not provide personal data relating to Nursery users to direct marketing complies or other such organisations.

The Nursery has created a table which details paper retention periods which can be viewed below. The general retention period for data collected and stored by the nursery will be six years after the child leaves the setting. Some data which is held by the Nursery must be held in accordance with current OFSTED or Local Authority requirements meaning that it will be held securely for much longer periods of time.

Nursery Paper Retention Table - Updated May 2018

*Serious Accident – Head Injuries/ Scalds/ Broken Limbs *All child

Documents to be filed with their application forms at point of leaving so that at 6 year point they will all be disposed of confidentiality at the same time.

Electronic records are currently stored on our online system indefinitely for archiving purposes.

Details about your rights are set out on the website page ‘Data Protection – How the University Uses Your Data’.  This also explains how to ask any questions you may have about how your personal data is used, exercise any of your rights or complain about the way your data is being handled.

This privacy notice is effective from 27 September 2018. It is reviewed when necessary and at least annually. Any changes will be published here and you will be notified by email or as appropriate.