Your Montessori Privacy Policy
PRIVACY NOTICE FOR CHILDREN & FAMILIES OF OUR NURSERY
In accordance with the General Data Protection Regulation (GDPR), we have implemented this privacy notice to inform you, our parents, of the types of data we process about you.
We also include within this notice the reasons for processing your data, the lawful basis that permits us to process it, how long we keep your data for and your rights regarding your data.
This notice applies to current and former children and parents.
A) DATA PROTECTION PRINCIPLES
Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that: a) processing is fair, lawful and transparent b) data is collected for specific, explicit, and legitimate purposes c) data collected is adequate, relevant and limited to what is necessary for the purposes of processing d) data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay e) data is not kept for longer than is necessary for its given purpose f) data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures g) we comply with the relevant GDPR procedures for international transferring of personal data
B) TYPES OF DATA HELD We keep several categories of personal data on our children in order to carry out effective and efficient processes. We keep this data in a file relating to each child and we also hold the data within our secure computer systems. Specifically, we hold the following types of data: a) Personal details such as name, address, phone numbers b) Gender c) Cultural or religious requirements d) Name and contact details of emergency contacts e) Medical details and immunisations f) Details of accidents that have taken place both in and outside of the setting g) Photographs of parents and children stored securely on a password protected system h) Your marital status, information of any disability your child may have or other medical information i) Information gathered via the registration process such as that entered into a registration form or ‘all about me’ form j) National Insurance numbers for funding purposes k) Consent for medical treatment, outings, photographs, plasters, sun cream and sharing of information l) Personal parent information such as national insurance number and date of birth
C)COLLECTING YOUR DATA
You provide several pieces of data to us directly during the registration process and subsequently when your child joins us. In some cases, we will collect data about you from third parties, such as previous settings, the local authority or local safeguarding agencies. Personal data is kept in files or within secure IT systems.
D) LAWFUL BASIS FOR PROCESSING The law on data protection allows us to process your data for certain reasons only. In the main, we process your data in order to comply with a legal requirement or in order to effectively manage the contract we have with you, including nursery school accounts. The information below categorises the types of data processing, appropriate to your status, we undertake and the lawful basis we rely on.
Activity requiring your data Lawful basis Carry out the service contract that we have entered into with you e.g. using your name, contact details, child’s developmental and progress information
Performance of the contract
Developmental information regarding your individual child
Performance of the contract
Ensuring funding is claimed and applied when eligible
Legal obligation
Administration of accounts Our legitimate interests Making reasonable adjustments for disabled children and/or parents
Legal obligation
Making decisions about suitable room placement of each child depending on their level of development
Our legitimate interests
Ensuring efficient administration of contractual benefits to you
Our legitimate interests
Maintaining comprehensive up to date personal records about you and your child to ensure, amongst other things, effective correspondence can be achieved and appropriate contact points in the event of an emergency are maintained
Our legitimate interests
Monitoring of absence management for the purpose of child protection
Our legitimate interests
Gaining expert medical opinion when necessary to ensure that all needs are met
Our legitimate interests
Dealing with legal claims made against us Our legitimate interests Preventing fraud Our legitimate interests Ensuring our administrative and IT systems are secure and robust against unauthorised access
Our legitimate interests
Providing developmental information to other educational settings
Legitimate interest of the prospective educator
E) SPECIAL CATEGORIES OF DATA
Special categories of data are data relating to your child’s:
a) Health b) Disability c) Religion and cultural requirements d) Gender e) Information regarding safeguarding and child protection
We carry out processing activities using special category data: a) To determine any additional needs or services that may be required b) To ensure that all individual needs are met c) To ensure that we provide a fully inclusive environment d) For funding purposes e) For monitoring purposes, such as cohort monitoring of development as required by Ofsted
Most commonly, we will process special categories of data when the following applies: a) You have given explicit consent to the processing b) We must process the data in order to carry out our legal obligations c) We must process data for reasons of substantial public interest d) You have already made the data public.
F) FAILURE TO PROVIDE DATA Your failure to provide us with data may mean that we are unable to fulfil our requirements for entering into a contract with you. This could include being unable to offer you our services, or administer contractual benefits.
G) WHO WE SHARE YOUR DATA WITH Employees within our company who have responsibility for admission, administration of accounts and payment of fees and contractual benefits will have access to your data which is relevant to their function. All employees with such responsibility have been trained in ensuring data is processed in line with GDPR.
Data is shared with third parties for the following reasons: For the administration of accounts and payment of fees, in order to obtain health information if relevant (with your consent) including use in an emergency, when external support from other agencies is necessary, for example to ensure the welfare of your child, special educational needs support, speech and language support and child developmental support. We do not share your data with bodies outside of the European Economic Area.
H) PROTECTING YOUR DATA We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such.
I)RETENTION PERIODS We only keep your data for as long as we need it. We are required, by law, to keep children’s records until they reach the age of 21 years or 24 years for child protection records. Photographs of individual children will be kept on our system for a maximum of 2 months, with the exception of photographs stored in children's individual records.
J) AUTOMATED DECISION MAKING Automated decision making means making decisions about you or your child using no human involvement e.g. using computerised filtering equipment. No decision will be made about you or your child solely on the basis of automated decision making (where a decision is taken about
you using an electronic system without human involvement) which has a significant impact on you.
K) SERVICE USER RIGHTS
You have the following rights in relation to the personal data we hold on you:
a) The right to be informed about the data we hold on you and what we do with it;
b) The right of access to the data we hold on you;
c) The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’;
d) The right to have data deleted in certain circumstances. This is also known as ‘erasure’;
e) The right to restrict the processing of the data;
f) The right to transfer the data we hold on you to another party. This is also known as ‘portability’;
g) The right to object to the inclusion of any information;
h) The right to regulate any automated decision-making and profiling of personal data.
L) CONSENT
Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.
M) MAKING A COMPLAINT
If you think your data rights have been breached, you are able to raise a complaint with the Information Commissioner (ICO). You can contact the ICO at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113 (local rate) or 01625 545 745