General Data Protection Regulations (GDPR)
GDPR states that personal data should be ‘processed fairly and lawfully’, ‘collected for specified, explicit and legitimate purposes’ and that the individual’s data is not processed without their ‘explicit consent’. GDPR covers personal data relating to individuals. Chingford House Nursery is committed to protecting the rights and freedom of individuals with respect to the processing of the personal data of children, parents, visitors and staff.
For the purposes of this policy, Chingford House Nursery is deemed to be the Data Controller for the purposes of data protection law.
GDPR includes 7 rights for individuals
1. The right to be informed
Chingford House Nursery is a registered nursery with Ofsted and is required to collect and manage certain data. We need to know the parents/carers names, address, telephone numbers, email address and – when accessing the 30 hours funding - date of birth and National Insurance number. We need to know a child’s full name, address and date of birth.
We are required to collect certain details of visitors to our nursery. This will include names, telephone numbers, addresses and company name (if applicable). This is required under our Health and Safety and Safeguarding policies.
As an employer, Chingford House Nursery is required to hold data on its employees; names, addresses, telephone numbers, date of birth, bank details, National Insurance numbers and photographic identification such as a passport or driving license. This information is also required for the Disclosure and Barring Service checks (DBS) that are carried out and to check proof of eligibility to work in the United Kingdom. This information is sent via a secure file transfer system to the processor of the DBS checks.
2. The right to access
At any point, an individual can make a request relating to their data and Chingford House Nursery will need to provide a response to any request within 1 month. We can refuse a request, if there is a lawful obligation to retain the data i.e. from Ofsted, in relation to the EYFS. We will always inform the individual of the reason for rejection. The individual has the right to complain to the ICO if they are unhappy with the decision.
3. The right to erasure
You have the right to request deletion of your data, where there is no compelling reason for its continued use. However, Chingford House Nursery has a legal duty to retain children and parents details for a reasonable amount of time. By law we are obliged to retain children and parents records for 3 years after the child has left the nursery. Accident and Injury records must be kept until the child reaches the age of 21. Child protection records must be retained until the child reaches the age of 24. Staff records must be kept for 6 years after the employment ceases. All of the data that we retain as paper copies is kept securely in a locked cupboard. All data retained on the nursery computer is password-protected and only accessed by the nursery manager, nursery owner, and administrator. All data is shredded/deleted after the legal retention period.
4. The right to restrict processing
Parents and staff can object to Chingford House Nursery using their data. This means that records can be stored, but must not be used in any way.
5. The right to share data
Chingford House Nursery is required to share some data with a third party, including the London Borough of Waltham Forest for the children and parents data and the payroll processing department for staff salaries. LBWF data is shared using secure, file transfer systems and LBWF have their own policies and procedures in place in relation to GDPR.
6. The right to object
Parents, visitors and staff can object to their data being used for certain activities, such as marketing or research.
7. The right to not be subject to automated decision-making, including profiling
Chingford House Nursery does not use personal data for such purposes.
Storage and use of personal information
All paper copies of children and staff records are kept securely in a locked cupboard at the pre-school. Only the owner, nursery manager and administrator have access to these records and staff has limited access.
Records held on the computer are backed up on a weekly basis and can only be accessed by the ‘Data Controller’ – in this instance the Data Controller includes the nursery manager, owner and administrator. These records are password protected.
All records are kept on site at all times. Archived records are shredded after the retention period.
In the event of any wrongful disclosures of confidential information, it will be investigated immediately.
Upon a child leaving Chingford House Nursery and moving on to school or a new setting, data held on the child may be shared with the receiving school/setting.
It is the parent’s responsibility to ensure that the information given to us in the registration forms is correct and kept up to date.
Under the GDPR regulations, Chingford House Nursery must:
• Manage and process personal data properly.
• Protect the individual’s rights to privacy.
• Provide individuals with access to all personal data that is held on them, unless there is a lawful reason for rejection of a request to access data.
If any person wishes to know what information we hold on them, they should speak to the owner, Zarkar Akhtar.
Parents, visitors and staff are directed to read our Privacy Policy which gives fuller information on how we use the data collected as outlined above.
Policy created by: Yolande Farrell Manager
Signed off by: Zarkar Akhtar Owner
Date of next review: March 2025