Data Protection and Privacy Policy

Privacy Policy for website users

Visitors to our website may provide us with two types of information:

• Personal Information on an individual basis during an enquiry i.e. name, contact details, child’s DOB
• Website use information collected as you and others browse our Website.

We maintain the highest standards of security, however the transmission of information via the internet is not completely secure. So, whilst we will do our best to protect personal Information, we cannot ensure the security of data transmitted to our Website.

Any information is submitted at sender’s own risk. Once we have received Information we will use strict procedures and security features to minimise the risk of unauthorised access.

Similar to other commercial websites, our Website uses a technology called "cookies" (explained below) and web server logs to collect information about how our Website is used. Information gathered through cookies and web server logs may include the date and time of visits, the pages viewed, time spent on our Website, and the websites visited just before and just after our Website.

We use Information provided to us in the following ways:

• To ensure that content from our Website is presented in the most effective and efficient manner for the visitor
• To allow visitors to register, request information or order any products and services available on our Website
• To notify any changes to our service
• In accordance with authorisation at the point of Registration
• If consent has been given at the point of Registration, we may contact the visitor with information about products, services and special offers that we provide, or that we feel may be of interest, or to participate in one of our customer satisfaction surveys

We may pass Information to carefully selected third party organisations:

• If we buy or sell any business or assets in which case we may disclose personal Information to the seller or buyer of such business or assets
• If we are under a duty to disclose or share personal data to comply with any legal obligation or in order to enforce or apply our terms and conditions and other agreements or protect the rights, property, or safety of our parents/carers, children, employees, or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction.

How we protect personal information

Email is not recognised as a secure medium of communication. For this reason, we request that private, sensitive or confidential information is not sent by email, and should it occur, it is at the sender’s own risk.

Storage of data

The data provided to us via the website will be held on our software systems. Personal data relating to families will be kept in the nursery. Personal data held within a software system will be securely protected with individual logins, which will only be given to those who need to access the data.

Data subject rights

Subjects may request access to the Information that we collect online and maintain in our database by writing to us at the following address: Data Controller, Small Fries Day Nursery, Hertford Place, Coventry CV1 3JZ. We are obliged under GDPR to complete your request free of charge and within 1 month of receipt of the request.

Consent

By using our website, consent is granted to our collection and use of Information as described in this Privacy Policy. If we change our privacy policies and procedures, we will post those changes on our Website to make aware of what information is collected, how we use it and under what circumstances we may disclose it.

Where we store personal data

We do not transfer personal data outside the European Economic Area (EEA). If ever this changes we will take all steps reasonably necessary to ensure that personal Information is treated securely and in accordance with this Privacy Policy.

Cookies

A cookie is a very small text document, which often includes an anonymous unique identifier. When users visit a website, that site's web server/computer asks visitor’s computer for permission to store this file in a part of the hard drive specifically designated for cookies. Each website can send its own cookie to a browser if a browser's preferences allow it, but (to protect a privacy) a browser will only permit a website to access the cookies it has already sent, not the cookies sent by other websites, therefore private information supplied to one web site cannot be read by another company.

A more detailed look at how we use cookies on the Small Fries web site can be found by clicking this link www.smallfries.co.uk/cookie-policy. You can also find further useful information at https://cookiepedia.co.uk/giving-consent-to-cookies

How We Use Information We Collect from Cookies

As visitors browse and navigate around our website, the website uses cookies to differentiate users to prevent unnecessary advertisements or requiring a log in more than is necessary for security. Cookies, in conjunction with our web server's log files, allow us to calculate the aggregate number visitors to our website and which parts of the website are most popular. This helps us gather feedback so that we can improve our website and better serve our visitors. Cookies do not allow us to gather any personal Information and we do not generally store any Information provided to us in cookies.

Third-party links outside of our control

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share visitor’s data. We do not control these third-party websites and are not responsible for their privacy statements.

On leaving our website, we encourage visitors to read the privacy notice of every website visited.

Privacy Notice for Parents

Small Fries is the data controller for any personal information provided regarding families. This means we decide how personal data is processed and for what purpose. Small Fries is required to collect and process data for a number of purposes concerning its employees, contractors, parents/carers, children and any other individual who comes into contact with the company. In gathering and using this data Small Fries is committed to protecting all individual’s rights of freedom and privacy and meeting the requirements of the General Data Protection Regulation 2018 (GDPR).

What personal data we collect about families

Small Fries contractual responsibilities include, but are not limited to, the collection of the following personal data:

• Personal details (name, date of birth, gender)
• Attendance information (start date, hours in nursery)
• Medical, health and GP information
• Personal characteristics
• Dietary requirements and preferences (allergies on intolerances, food likes/dislikes)
• Special Educational Needs information
• Development records

The information we hold about parents/carers include:

• Personal details (name, date of birth, national insurance number)
• Contact details (address, telephone number, email address)
• Bank details (name of bank, account number and sort code)

We do hold some special category data about families regarding race, ethnic origin, religion and health information. The special category data is only collected as required by the Local Authority or other public bodies for legal and contractual purposes. We comply fully with the requirements of GDPR in relation to special category data and are aware of the sensitive nature of the information.

It is the duty of the Data Subject to let us know of any changes or corrections to personal data. We will provide annual declaration forms to ensure the data we hold is accurate.

How we process personal data

Small Fries complies with its obligations under the GDPR by keeping personal data up to date; storing and destroying it securely; not collecting or retaining excessive amounts of data; protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. All the data we process, we do so to fulfil the contract we have with parents/carers.

Small Fries holds and processes data to be able to:

• Provide the appropriate care for children
• Support children’s learning
• Monitor and report on children’s progress
• Ensure the right first aid and medication is provided to children in cases where they become ill or have an accident in our care

There is certain data we hold about parents/carers to be able to successfully carry out the contract. The information we hold includes name and address, contact details, bank details and signatures. We hold this personal data and use it to:

• Be able to contact parents/carers in case of emergency
• Be able to take payment for services
• Prove consent of an agreement to our contract terms and conditions

Whilst much of the data provided is mandatory to carry out the contract held with us, some of it is provided on a voluntary basis. To comply with the GDPR we will inform parents/carers at the time of collection whether the information requested is mandatory. Where personal data is not required for legal or contractual reasons, we will give the opportunity to provide consent for us to use the data for that purpose. This can include the ability to take photographs of children and using personal details for direct marketing. This data will only be processed if explicit consent is given.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service contract.

The lawful basis in which we process this data

Small Fries collects and process all the information provided to us as a parent/carer under the contractual lawful process. It is necessary to process this data to be able carry out the requirements of the contract. Without this data we will not be able to fulfil a contract and thus not be able to provide a service. The request for health and medical data regarding children is a legal requirement and is vital to keep children safe whilst in our care.

Data regarding children's ethnicity, race and religion is processed under the requirements of Local Authorities and public bodies and the upholding of Small Fries Equal Opportunities policy and the Equality Act 2010.

Who collects this data

Small Fries collects most of its data directly from the individual themselves. The information we collect about families is obtained from application forms completed at the point of enrolment, or online forms. Additional data is collected as part of the Annual Declaration and on an ad-hoc basis.

Storage of data

Data is kept on our nursery management software, servers or in paper format. Data relating to families will always be kept in the nursery. Personal data held within our nursery management software is securely protected with individual logins, which will only be given to those who need to access the data. Data stored in paper format is kept in a safe location where only those who are authorised to access it, can. This includes a banker’s safe and a locked filing cabinet.

Who and why we share this data

We are legally obliged to pass some details on to third parties for legal reasons such as public bodies. This includes Local Authorities, Ofsted, NHS, Police and enforcing agencies. We will not give information about families to anyone outside of the company without explicit consent, or unless the law or our terms and conditions allow us to.

We may also share data with organisations for trend analysis. We are not legally required to process this kind of data and therefore we will ask for explicit consent to share data for this purpose. We may share children’s progress data with schools as they transfer from nursery, however, this again will only be carried out with the explicit consent of parents/carers.

Data retention periods

Small Fries is committed to ensuring we do not hold personal data for any longer than necessary.

Data which we hold under contract is subject to specified retention periods. These are as follows:

• Parent/carer and children’s personal data – until the child is 25 years old
• Safeguarding information – until the child is 25 years old
• Medical and health data – will not be destroyed
• Accident data – will not be destroyed
• Child learning progress – paper data will be given to parents/carers when the child leaves the nursery. Electronic data will be destroyed 6 years after a child has left our nursery

Once the data has been used for its original purpose and the retention period has expired, we will appropriately dispose of the data.

Further processing

If we wish to use personal data for a new purpose, not covered by this Data Protection Privacy Notice, we will provide a new notice explaining this new purpose. Where and whenever necessary, we will seek consent to the new processing.

Data subject rights

Under the GDPR data subjects have the right to request access to any of the data held about them. To fulfil this request a Subject Access Request form must be completed which can be accessed from the Data Protection Officer (DPO). If it is felt Small Fries has not handled personal details adequately, or how a data request has been handled, contact the Data Protection Officer (DPO).

Privacy Notice for Employees

Small Fries is the data controller for any personal information provided to us regarding employment at Small Fries. This means we decide how personal data is processed and for what purpose.

Small Fries is required to collect and process data for a number of purposes concerning employees, contractors, parents/carers, children and any other individual who comes into contact with the company. In gathering and using this data Small Fries is committed to protecting all individual’s rights of freedom and privacy and meeting the requirements of the General Data Protection Regulation 2018 (GDPR).

Small Fries contractual responsibilities include but are not limited to the collection of the following personal data:

• Personal information (name, national insurance number)
• Contact information (phone number, email address, postal address)
• Emergency contact telephone numbers. This could be a parent/carer, other relation, husband/wife
• Work absence information, including holidays (number and reasons)
• Qualification and educational history
• Bank details (name of bank, account number and sort code)
• Medical and health information
• Contract information (start date, hours worked, salary information)

We do hold some special category data about employees regarding race, ethnic origin, religion and health information. The special category data we hold we only process if it is essential for the purpose of a contract, or required for legal reasons, and is adequately protected. We only use this information for equal opportunity research and feedback. It is the duty of the employee to inform us of any personal data that has changed so we can update our records and ensure the data we hold is accurate.

How we process employee’s personal data

Small Fries complies with its obligations under the GDPR by keeping personal data up to date; storing and destroying it securely; not collecting or retaining excessive amounts of data; protecting personal data from loss, misuse, unauthorised access and disclosure, and by ensuring that appropriate technical measures are in place to protect personal data. All the data we process from employees, we do so to fulfil the contract.

Small Fries hold and processes employee’s data to be able to:

• Payroll
• Human resources
• Employee contact
• In case of emergency

The lawful basis in which we process this data

Small Fries collects and processes all the information of an employee under the contractual lawful process. It is necessary to process this data to be able carry out the requirements of the contract. Without this data we will not be able to fulfil the contract and thus not be able to consider employment at Small Fries.

Health and medical data provided to us is legally required and is vital to keep employees safe whilst at work. It is also under contractual obligations that sick notes are provided as evidence of proof of illness and to ensure payment for these days.

Data regarding ethnicity, race and religion is only processed for monitoring and upholding Small Fries Equal Opportunities policy and the Equality Act 2010.

Recruitment

Unsuccessful applicants will have their data disposed of after six months unless explicit consent has been provided for us to keep this information for any longer.

Who collects this data

Small Fries collects most of its data directly from the individual themselves. The information we collect will be obtained from forms provided during the recruitment process or new starter pack. Additional data is collected as part of the Annual Declaration and on an ad-hoc basis as required.

Storage of data

All data is either kept in our nursery management software systems, server or in paper format. Nursery manager data is held by the director and all bank details are held in payroll. Personal data held within software systems will be securely protected with individual logins, which will only be given to those who need to access the data.

All data stored in paper format will be kept in a safe environment where only those who need it can access it. This may include being locked in a banker’s safe or locked filing cabinet.

Who and why we share this data

We are legally obliged to pass some details on to third parties such as public bodies or civil services. These may include, the police, the courts, HMRC, payroll services and pension providers. We limit the sharing of data to third parties as far as practicable and only share data where it is necessary for legal reasons or for the processing of the contract.

Data retention periods

Small Fries is committed to ensuring we do not hold personal data for no longer than necessary. We are required by law to hold some personal data for certain periods of time. Medical, health and accident data will not be destroyed and both financial and personal data will be held for 6 years after termination of contract, after this period data will be disposed of appropriately. Further information can be found on our Record Keeping and Retention Periods document.

Further processing

If we wish to use personal data for a new purpose, not covered by this Data Protection Notice, we will provide a new notice explaining this new purpose. Where and whenever necessary, we will seek consent to the new processing.

Data subject rights

Under GDPR employees have the right to request access to any of the data held by Small Fries. Employees who wish to make a Subject Access Request (SAR) can contact the Data Protection Officer (DPO).

If it is felt that Small Fries has not handled personal details adequately or concern is raised with how a data request has been dealt with, please contact the Data Protection Officer (DPO) or the Information Commissioners Office on 0303 123 1113.

Consent

Small Fries is committed to ensuring where consent is required, it is freely given, specific and unambiguous. Where consent is required for additional processing, data subjects are given the opportunity to freely give consent to us processing that data for the specified purpose. Additional consent forms will be distributed to gather additional permission.

Contact Us

If you have any questions or suggestions regarding our privacy policy, please contact us:
DPO
Carefield Childcare
Small Fries Day Nursery
Hertford Place
Coventry CV1 3JZ
Email: hello@smallfries.co.uk

Statutory information about Carefield Childcare Limited
Registered in England and Wales Registered Company No: 9157595
Registered Office: Small Fries Day Nursery, Hertford Place, Coventry CV1 3JZ