Nursery privacy notice

Birmingham Day Nurseries (‘the Nursery’) are part of the University of Birmingham. This page provides information about how the University uses personal data of users of the Nursery. It supplements the page on our website ‘Data Protection – How the University Uses Your Data’.

It is important that the personal information we hold about you is accurate and current. Please keep your personal information updated during your relationship with us.

How does this Privacy Notice relate to other Privacy Notices

This page explains how nursery users’ personal data is processed by the Nursery.  Some data relating to Nursery users is processed by other departments of the University and is not covered by the information on this page, for example the information which is provided for the purpose of the University’s Finance Office.

What personal data will be processed?

Personal information about the parent/carer and child/children is collected in our enquiry form. This includes:

  • Name, address and contact details of the parent/carer;
  • Name and date of birth of the child.

After the initial enquiry, parents/carers will provide additional personal information including:

  • parent/carer relevant employment/study details (for University staff and students only);
  • designated person details (we assume that they have agreed to this information being provided to us);
  • doctor/health visitor information;
  • health and dietary information;
  • personal preferences;
  • a photograph of the child;
  • the child’s gender;
  • the child’s religion;
  • emergency contacts and their contact details (we assume you will have their permission to provide these details to us);
  • Any other personal information provided to us in subsequent correspondence relating to the enquiry or application.

We collect and keep a record of personal information about children during their attendance at the Nursery including:

  • Photographs – if parents/carers consented as part of the application and induction process to photographs being taken of their child at the Nursery.  Consent can be withdrawn at any time;
  • Observations – these are made in line with the Early Years Foundation Stage (EYFS) and are made up of both written and photographic evidence (as agreed with parents/carers on induction) to form a reflection of the child’s learning at nursery.
  • Records of referrals to specialist early years’ services; including safeguarding and child protection concerns (which may necessitate retaining information about people connected with the child solely for the purposes of a referral).
  • Records of any contact between the Nursery and medical practitioners or health visitors.
  • CCTV footage.  This is processed in accordance with the University’s CCTV Code of Practice and can be viewed on request.

In addition, the University will process financial information relating to the payment of fees.

Some of the information which is processed by the nursery is special category data of a sensitive nature.  This includes:

  • Biometric finger print information of parents/carers for entry to Nursery premises;
  • Ethnicity data relating to the child;
  • Medical conditions and disability information relating to the child;
  • Health information relating to the child;
  • Sickness records relating to the child;

We make sure that access to and the sharing of special category data are controlled very carefully.

What is the purpose of the processing?

The Nursery will process Nursery users’ personal data for the following purposes:

  • Receiving, effectively checking and responding to requests from perspective parents for availability;
  • Corresponding with and contacting parents/carers in relation to our services when requested;
  • Providing a high level of care and education for the children in our care, including the creation of a learning journey and necessary assessment and keeping parents/carers informed;
  • Sending newsletters, information about events, outings and external educators;
  • Implementing and making decisions based on the University’s Child Safeguarding Policy and procedures, keeping every child safe from neglect and harm;
  • To refer to external professionals when there is a concern about medical or educational need, gaining the necessary support and advice;
  • Gaining or administering emergency care or first aid;
  • Fulfilling our legal, regulatory and safeguarding obligations.

What is the legal basis of the processing?

We ask for your consent to process some personal data.  If we do, we will collect it at the appropriate time, explaining why we are collecting the data and how we will use it, and this consent can be withdrawn this at any time.

In other cases, it is necessary to process personal data relating to parents/carers and to children in our care in order to:

  • perform our contract with parents/carers to provide the Nursery’s services, or as a necessary preliminary step before we enter into a contract with parents/carers;
  • comply with the legal obligations  which the University and the Nursery have,  including child protection and safeguarding requirements (such as Working Together to Safeguard Children 2015) requirements, OFSTED and EYES 2007 requirements, equal opportunities, immigration and public safety requirements;
  • For the purposes of the University’s legitimate business interests (for example, for the purpose of planning, reviewing, managing and developing the Nursery’s and the University’s business, (but not to make any decisions about parents/carers or children)).

We will only process special category data with explicit consent or if it is necessary:

  • For the establishment, exercise or defence of legal claims;
  • To comply with the legal obligations  which the University and the Nursery have,  including child protection and safeguarding requirements (such as Working Together to Safeguard Children 2015) requirements;
  • Very occasionally, when it is needed to protect a parent/carer’s or a child’s vital interests and they are not capable of giving their consent (for example, in an emergency);

Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Who will your personal data be shared with?

Within the Nursery and the University, your data is shared with only those staff who need access for the purpose of delivering our services and facilities.

Personal data is shared with a range of external organisations as is necessary for the purposes set out above and as permitted or required by law,  including the following:

  • We will disclose information about children in our care and/or their parents/carers when it is necessary to meet child protection and safeguarding requirements and procedures.  This is likely to occur when the Nursery has reason to believe that there is a threat to a child and referral to the local authority needs to be made.  This will be done in accordance with our Child Safeguarding Policy and the advice of the local safeguarding children’s board;
  • Data must be presented to OFSTED when requested, for example, as part of an inspection or when the identity of the inspecting officer has been verified;
  • Information will be shared with the local authority to enable access to free education funding, but only when signed consent has been provided to us .
  • We may provide information or CCTV footage to the police or other enforcement agencies for the purposes of the prevention or detection of crime;

Some personal data about children and parents/carers is routinely displayed within the Nursery, including health and medical information about children, where it can be viewed by those in the Nursery. We only do so with the consent of parents/carers following discussions during induction so an informed decision can be taken by parents/carers.  

Except as we have explained, we will not publish or disclose any personal data to other external enquirers or organisations unless you have asked us to do or have consented to it, or unless it is in yours or your child’s vital interests to do so (e.g. in an emergency situation).

Your personal data is shared as is necessary, on a considered and confidential basis, with several external organisations which assist with processing your information. These organisations act on our behalf in accordance with our instructions and do not process your data for any purpose over and above what we have asked them to do.  We make sure we have appropriate contracts in place with them.  Sometimes your personal data is processed by these organisations outside the European Economic Area (for example, because they use a cloud-based system with servers based outside the EEA), and if so, we make sure that appropriate safeguards are in place to ensure the confidentiality and security of your personal data. 

We do not sell personal data to any third parties and we do not provide personal data relating to Nursery users to direct marketing complies or other such organisations.

How long is your data kept?

The Nursery has created a table which details paper retention periods which can be viewed below. The general retention period for data collected and stored by the nursery will be six years after the child leaves the setting. Some data which is held by the Nursery must be held in accordance with current OFSTED or Local Authority requirements meaning that it will be held securely for much longer periods of time.

Nursery Paper Retention Table - Updated May 2018

Document Type Related to Children

Time to be kept for

Person (s) Responsible for Disposing of Confidentially

Paper Application Form/ T&Cs/ Parental Consents

6 Years After Leaving Date 01/09 Onwards at Point of Induction

Management Team

Confirmation of Place Form

6 Years After Leaving Date

Management Team

Change of Nursery Usage

6 Years After Leaving Date

Management Team

Office Induction Paperwork Including Any Court Orders/ Care Plan/ Adoption Paperwork

01/09 Completed Copy to be Scanned into Alphabetised Folder then 6 Years

Management Team

All About Me Document

Point  of Renewal at Transition to New Room

Room Senior Practitioner

Existing Injury Form

6 Years/ 21 years for Serious Accident *

Management Team

Incident Form

6 Years/ 21 years for Serious Accident *

Management Team

Confidentiality Form

6 Years/ 25 years if Safeguarding Concern

Management Team

CR8/CR10 Forms

6 Years/ 25 years if Safeguarding Concern

Management Team

Accident Book

6 Years/ 21 years for Serious Accident *

Management Team

Medication Form

6 Years Unless Significant

Management Team

Alert Card for Asthma/Allergy

Point  of Renewal in New Room

Room Senior Practitioner

Children’s Paper Registers

1 Year

Management Team

Staff’s Paper Registers

21 Years

Management Team

Entrance Signing In and Out

21 Years

Management Team

Nappy/ Toileting Chart

1 Month

Room Senior Practitioner

Next Steps / Planning Sheet

1 Year

Room Senior Practitioner

Printed Cohort Trackers

Confidential Waste After Use

Room Senior Practitioner

BECO/ SENDCO obs

6 Years After Leaving Date

Management Team

Connect/ IConnect

Indefinitely with parent choice to anonymise

Management Team

Extra-Curricular Lists Rooms/ Office

Termly

Room Senior Practitioner/

Management Team

Termination Forms

6 Years After Leaving Date

Management Team

Sun Cream Chart

Review April/ September

Room Senior Practitioner

Monthly Billing - Office Copy

1 Year

Management Team

Staffing – Room Copy

1 week

Room Senior Practitioner

Staffing – Office Copy

1 year

Management Team

Parent Declaration EEE

Await info from BCC

Management Team

*Serious Accident – Head Injuries/ Scalds/ Broken Limbs                                             *All child

Documents to be filed with their application forms at point of leaving so that at 6 year point they will all be disposed of confidentiality at the same time.

Electronic records are currently stored on our online system indefinitely for archiving purposes.

Your rights in relation to your data

Details about your rights are set out on the website page ‘Data Protection – How the University Uses Your Data’.  This also explains how to ask any questions you may have about how your personal data is used, exercise any of your rights or complain about the way your data is being handled.

Are changes made to this webpage?

This privacy notice is effective from 27 September 2018. It is reviewed when necessary and at least annually. Any changes will be published here and you will be notified by email or as appropriate.