Privacy Policy

Agreed On: March 2026

Review Date: March 2028

As a childcare provider we must follow the new General Data protection Regulations which come into effect from 25th May 2018.

There are 7 principals that we need to adhere to;

Lawful, fair and transparent processing, We must have Lawful reasons for collecting personal data and must do so in a clear and transparent way.
Purpose limitation, We must have a lawful and legitimate purpose for processing the information and only use the data for the reason it was initially obtained.
Data Minimisation We must ensure the data we collect is adequate, relevant and limited. We will only collect the data that is necessary and will only store minimum data for which it is required.
Accurate and up to date, We must make sure the data we have collected is kept up to date(valid), remains accurate and fit for purpose.
Limitation of storage, We must only store personal information for as long as necessary. We follow Pre-school learning Alliance (PLA) retention guidelines.
Confidential and secure. We are solely responsible for implementing appropriate security measures in protecting the data we collect. We must ensure these measures are proportionate to the risks and rights of individual data subjects.
Accountability and liability, We must demonstrate compliance. We must be sure that every step within the GDPR strategy is auditable and can be complied as evidence quickly and efficiently.

Waterloo Road Pre-school has adopted a ‘Privacy Notice’ which sets out in more detail how we are in compliance with the General Data Protection Regulations. The Privacy notice explains in detail what personal data we collect, why we collect it, how we will use it and we are protecting it. This can be found in our policy folder in the foyer. Paper copy available upon request.

Privacy Notice

Data protection officer: Emma Clements (Manager)

Introduction

Here at Waterloo Road Community Pre-school we take your privacy seriously and are committed to ensuring that any personal data we hold about you and your child is protected in accordance with data protection laws and is used in line with your expectations.

This privacy notice explains what personal data we collect, why we collect it, how we use it, the control you have over it and how we protect it.

When we refer to “we”, “us” or “our”, we mean Waterloo Road Community Pre-School CIO.

What personal data do we collect?

We collect personal data about you and your child to provide care and learning tailored to meet your child’s individual needs.

Personal details that we obtain from you includes your child’s: name, date of birth, address, and health, development and any special educational needs information. We will also ask for information about who has parental responsibility for your child and any other agency involvement in relation to your child.

Personal data that we collect about you includes: your name, home and work address, phone numbers, email address, emergency contact details, and family details.

This information will be collected from you directly in the registration form, from identity documents; from correspondence with you; or from health and other professionals.

If you apply for Working Families funded childcare, we will also collect: your national insurance number or unique taxpayer reference (UTR), if you’re self-employed. Please note that if this information is not provided, then we cannot claim funding for your child. For funding purposes we may also collect information regarding benefits and family credits that you are in receipt of.

We may collect other data from you when you voluntarily contact us.

Where applicable we will obtain details of your child’s social worker, child protection plans from social care, and health care plans from health professionals and other health agencies.

We may collect this information in a variety of ways. For example, data will be collected from you directly in the registration form; from identity documents; from correspondence with you; or from health and other professionals

We will ask you to update your information on a regular basis, such as during parent evenings, to ensure that information we hold is up to date and accurate to ensure your ongoing funding entitlements and to continue to provide care learning for your child.

Why we collect this information and the legal basis for handling your data

We use personal data about you and your child in order to provide childcare services and fulfil the contractual arrangement you have entered into. This includes using your data to:

contact you in case of an emergency
to support your child’s wellbeing and development
to manage any special educational, health or medical needs of your child whilst at our setting
to carry out regular assessment of your child’s progress and to identify any areas of concern
to maintain contact with you about your child’s progress and respond to any questions you may have
to process your claim for funded childcare, where applicable
to keep you updated with information about our service, for example about any service changes, special events or newsletters

With your consent we would also like:
To collect your child’s ethnicity and religion data for monitoring purposes.
Transfer your child’s records to the receiving school when s/he transfers.
Record your child’s activities for their individual learning record. This may include photographs and videos. To use any images of your child for marketing purposes we seek your written consent through the form provided at registration. You also retain the right to withdraw your consent at any time for images taken, by confirming so in writing.

We have a legal obligation to process safeguarding related data about your child should we have concerns about their welfare. We also have a legal obligation to transfer records and certain information about your child to the school that your child will be attending (see Transfer of Records policy).

Who we share your data with

In order for us to deliver childcare services we will also share your data as required with the following categories of recipients:

Ofsted – during an inspection or following a complaint about our service
banking services to process direct debit/bacs payments
the Local Authority, if you claim any funded childcare
the government’s eligibility checker for the above
our insurance underwriter and Preschool Learning Alliance, where applicable
Tapestry, our online learning journal software
the school that your child will be attending
Funding Loop, a third-party online tool for helping us to submit our funding claims to the Local Authority

We will also share your data if:

We are legally required to do so, for example, by law, by a court or the Charity Commission;
to enforce or apply the terms and conditions of your contract with us;
to protect your child and other children; for example by sharing information with social care or the police;
it is necessary to protect our or others rights, property or safety
We transfer the management of the setting, in which case we may disclose your personal data to the prospective manager/buyer so they may continue the service in the same way.

We will never share your data with any other organisation to use for their own purposes

How do we protect your data?

We take the security of your personal data seriously and have internal policies and controls in place to try to ensure that it is not lost, accidentally destroyed, misused, or disclosed and to prevent unauthorised access.

Only personnel of the Pre-school have access to yours and your child’s personal data. It is kept on manual files securely on the premises in a locked filing cabinet. We keep a data base of registers electronically which is kept on a password safe laptop which is also locked away securely. We use a removable hard drive to back up our files.
We keep data in accordance with the retention periods and only destroy after this date. Until this date children’s files are kept in sealed envelopes with clearly labelled destroy dates. All files are kept in filing boxes in a locked cupboard. Only the Pre-school have access to the cupboard.
We have strict confidentiality procedures which all staff and volunteers must follow to ensure data is not misused or disclosed unnecessarily. We adhere to a strict need to know basis procedure for sharing information and gain parental consent for any data being shared unless for safeguarding concerns we follow or safeguarding procedures.
We enter into agreements with the third-party services we use (Tapestry and Funding Loop) to ensure that they have robust systems for protecting the data shared. They are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
Staff who regularly handle and process personal data have completed GDPR training.
Any new sharing of data will be risk assessed. We follow ICO guidance on carrying out a Data Protection Impact Assessment (DPIA) if required

How long do we retain your data?

Records are kept and archived in line with our relevant Documentation and Record Keeping and Safeguarding Policies (5,6, 35,36) and following the requirements provided to us by the Early Years Alliance.

We retain your child’s personal data for up to 3 years after your child no longer uses our setting, or until our next Ofsted inspection after your child leaves our setting.

Medication and accident records are kept for 21years and 3 months.

Your child’s learning and development records are maintained by us and transferred to you when your child leaves.

In some instances (child protection, or other support service referrals) we are obliged to keep your data for longer if it is necessary to comply with legal requirements (see our Children’s and Provider Records policies).

Your rights with respect to your data

As a data subject, you have the right to:

request access, amend or correct your/your child’s personal data
request that we delete or stop processing yours/your child’s personal data, for example where the data is no longer necessary for the purposes of processing or where you wish to withdraw consent; and
request that we transfer your, and your child’s personal data to another person

If you wish to exercise any of these rights at any time or if you have any questions, comments or concerns about this privacy notice, or how we handle your data please contact us. If you continue to have concerns about the way your data is handled and remain dissatisfied after raising your concern with us, you have the right to complain to the Information Commissioner Office (ICO). The ICO can be contacted at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or ico.org.uk/

Changes to this notice

We keep this notice under regular review. Any changes to this notice will be shared with you so that you may be aware of how we use your data at all times.