GDPR stand for General Data Protection Regulation and covers personal data relating to individuals that must be collected and used fairly, stored safely and not disclosed unlawfully.
Policy Statement:
CJ’s Little Pickles needs to gather and use certain information about individuals. This includes anyone who is connected with the nursery, such as parents, children, staff, suppliers and business contacts. We must comply with data protection law and follow good practice, protect the rights of individuals connected with the nursery and explain how we store and process individuals’ data.
Rights for Individuals
The Right to be Informed:
CJ’s Little Pickles is required to collect, process and manage certain data.
The data we require is:
Employees: Names, Addresses, Telephone Numbers, Email Addresses, Date of Birth, National Insurance Numbers, Bank Details, Photographic I.D (Passport and Driving Licence).
This information is also required for Disclosure and Barring Service Checks (DBS) and proof of eligibility to work in the UK.
Parents/Carers: Names, Addresses, Telephone Numbers, Email Addresses, Date of Birth, National Insurance Numbers, Passwords for Invoices and Passwords for an alternative person collecting your child.
Children: Names, Addresses, Date of Birth, Ethnicity, Religion, Sessions, Copy of I.D (Passport or Birth Certificate), Medical Information, Permission Forms, Routine Forms.
For parents/carers claiming the free entitlement funding we are requested to provide this data to West Sussex County Council (WSCC); this information is uploaded to a secure online portal which has a username and password log in.
Visitors: Name, Company Name, Reason for Visiting the Nursery, Time Signed In, Time Signed Out and a Signature.
The Right of Access:
At any point individuals can request to see their data, which the nursery will respond to within 7 days. The request however can be refused, if we have a lawful obligation to retain data, but we will inform the individual of the reasons why. The individual will have the right to complain to the International Commission’s Office (ICO) if they are not happy with the decision.
The Right to Erasure:
You have the right to request the deletion of your data where there is no compelling reason for its continued use. However, the nursery has a legal duty to keep the details of children and their parent/carer for a reasonable amount of time. The data is archived safely and securely on site and once the retention period has passed the data will be shredded.
The right to restrict processing:
Any individual can object to CJ’s Little Pickles processing their data. This means that records can be stored but must not be used in any way.
The right to object:
Any individual can object to their data being used for certain activities, such as marketing or research. We may use photos from the nursery to put on the nursery website; however, permission is sought from parents/carers and staff for this prior to them starting at the nursery
The right not to be subject to automated decision making:
We will always involve individuals in the decision making with regards to their data. We will not make a decision by automated means.
Storage and Use of Personal Data:
All paper copies of children and staff records are kept in locked filing cabinets in the office. The office is also locked at night and over the weekends. Staff have access to the children’s files; however, these are kept in the office at all times. The information about individual children is confidential and the records remain on site at all times. Staff can request to see their own personal file at any time and will only have access to their file. Staff and children’s files are shredded after the retention period for records has passed.
Information about individual children is used in certain documents, such as daily registers, medicine forms, accident books and referrals to external professionals. These documents include data such as children’s names, date of birth and address. These records will be shredded after the retention period for records has passed.
CJ’s Little Pickles collects large amounts of personal data annually, including names and addresses of those on the waiting list. These records are shredded if the child ends up not attending the setting or they are added to the child’s file and stored safely and securely once they start at the nursery.
Any information regarding a family’s involvement with other agencies is stored safely on the office computer and is password protected and also in the child’s file, which is in a locked cabinet in the office. These records are shredded after the retention period for records has passed.
When a child leaves the nursery to go to school or to another setting, data held on the child may be shared with the receiving school/setting. Alternatively, this information could be given to the parent/carer to pass on to the school/setting, such as their child’s learning journal.
We store photos of the children on the main office computer, which is password protected. These photos are used for children’s peg pictures, the dietary board, to display around the nursery, to use as evidence with observations in learning journals and also for the nursery website. We obtain consent from parents/carers for photos to be displayed around the nursery, for use in other children’s learning journals as evidence with observations and for the nursery website.
Access to the office computer and the staff laptop is password protected. Any portable storage, such as USB sticks, are password protected and/or stored in the office, which is locked overnight and at weekends.
Data Protection Risks:
Everyone at the nursery has a responsibility for ensuring data is collected, stored and handled appropriately. However, there are always risks that come with data protection.
These could be:
Breaches of confidentiality – If any information is given out inappropriately
Not offering choice – all individuals should be free to choose how Abracadabra Day Nursery uses data relating to them
Reputational Damage – Any information that is successfully gained by hackers or a break in
Complaints:
If any individual has concerns about the way Abracadabra Day Nursery handles, processes and stores data please raise it with the management team. Alternatively, you can contact the International Commissioner’s Office (ICO): Telephone Number: 0303 123 1113 Web Address: https://ico.org.uk/concerns/