This notice applies to our websites and all services we provide, including childcare services provided at Gingerbread Day Nursery. For the purpose of this notice, we’ll just call them our ‘services’.
When we say ‘personal data’ we mean identifiable information about you or your child, such as your name, your child’s name, date of birth, gender, email, address, telephone number, funding eligibility and so on.
When we say ‘sensitive personal data’ we mean special category identifiable information about you or your child, such as racial or ethnic origin, physical or mental health conditions, religious beliefs or other beliefs of a similar nature, learning and progression records, digital photographic records and safeguarding data.
Who are ‘we’?
When we refer to ‘we’ (or ‘our’ or ‘us’), that means Childcare 360 Limited trading as Gingerbread Day Nursery. We’re based in Brighton, UK and provide home from home day nursery services in warm and caring environments where your child will feel safe, happy and valued.
For data protection purposes, we act as data controller in relation to your personal data.
Our principles of data protection
Our approach to data protection is built around three key principles. They’re at the heart of everything we do relating to personal data.
Transparency: We take a human approach to how we process personal data by being open, honest and transparent.
Security: Wherever possible we champion industry leading, cloud based approaches to securing the personal data and sensitive personal data entrusted to us.
Stewardship: We accept the responsibility that comes with processing personal data and sensitive personal data.
How we collect your data
When you use our services or visit our website, we collect personal data. The ways we collect it can be broadly categorised into the following:
Information you provide to us directly: When you use our services or visit some parts of our websites we might ask you to provide information to us. For example, when you first register your child we will ask for your contact information, your child’s name, gender, date of birth and certain sensitive categories of data such as your child’s racial or ethnic origin, allergies, physical or mental health conditions and/or religious beliefs or other beliefs of a similar nature. You don’t have to provide us with all of this data but it could restrict our ability to provide a full service and, in the event we’re unable to provide services in a manner that is conducive with the health, safety, safeguarding and protection of the children in our care, may mean we are unable to provide services at all.
Information we collect automatically: We collect some information about you automatically when you visit our websites or use our services, such as any contact information submitted, your IP address and device type. Some of this information is collected using cookies and similar tracking technologies. If you want to find out more about the types of cookies we use, why, and how you can control them, take a look at our cookie notice.
Information we get from third parties: The majority of information we collect, we collect directly from you for the sole purpose of providing childcare services. Infrequently, we may receive personal data from other sources such as public authorities or statutory bodies. This is rare and will normally be as a result of our statutory child protection and safeguarding obligations. You will normally be made aware if this involves you or your child, unless safeguarding protocol requires us to share information discreetly.
Ultimately though, we’re a childcare services provider and don’t collect much information either automatically or from third parties. The majority of personal data we hold is information you provide to us directly.
Where we collect personal data, we’ll only process it:
· to perform our contract with you, or
· in accordance with a legal obligation, or
· to protect a child’s life or someone else’s life (vital interests), or
· in the exercise of official authority or to perform a specific task in the public interest, or
· where we have legitimate interest to process the personal data and they’re not overridden by your rights, or
· where we have your consent.
How we use your data
First and foremost, we use your personal data to provide you with the services you’ve requested, to manage our relationship with you and to operate our websites. We also use your personal data for other purposes, which may include the following:
To communicate with you. This may include:
· advising you if your child has been taken ill whilst at nursery
· providing information you’ve requested, such as nursery space/session details when they become available
· sharing information we are required to send to you, such as periodic child progress reports
· providing contractual, billing and related financial data relating to the services you’ve requested
· operational communications, such as reminders to bring sun hats in summer months and rain coats in winter
· asking you for feedback or to take part in any research we are conducting (which we may engage a third party to assist with).
To support you: This may include working with you in recording, using and understanding your child’s development data; or in assisting you in making a claim for EYFE funding.
To enhance our services to you: Obtaining your feedback regarding experience and processing this data to continuously improve our services; making use of online photo repositories and other digital records of progress so you can feel closely attached to your child’s daily life at nursery.
To protect: Use of sensitive personal data to ensure the children in our care receive the correct medical, dietary and allergens support they need; use of personal contact information to ensure children go home only with those adults entrusted and authorised to collect them; sharing of personal data with the local authority safeguarding and child protection teams (if required to do so); use of data to identify unusual behavioural issues or patterns of attendance.
To promote: Use of your positive feedback responses to promote the nursery and its services.
To analyse, aggregate and report: Use of your ethnicity data for reporting to the local authority and onward into government statistics; we may also use the personal data we collect about you or your child to produce aggregated and anonymised reports, which we may be required to share with public authorities or statutory bodies.
How we can share your data
There will be times when we need to share your personal data with third parties. We will only disclose your personal data to:
· third party service providers who assist and enable us to provide enhanced levels of service. For example, the provision of online, cardless payment facilities to pay your service fees or the provision of industry leading childcare software to both secure and process you and your child’s personal data
· regulators, law enforcement bodies, government agencies, courts or other third parties where it’s necessary to comply with applicable laws or regulations, or to exercise, establish or defend our legal rights. Where possible and appropriate, we will notify you of this type of disclosure
· other people where we have your consent.
International Data Transfers
We are assured by our third party service providers that they are fully GDPR compliant, with our primary data hosting partner having worked with the NCC Group, who are leading global experts in cyber security and whose clients include HM Government and big financial services institutes including high street banks. They assure us that all sensitive data is safe, including all data saved within their software products which utilise Rackspace managed data centres in the UK and European Economic Area (EEA).
Security is a priority for us when it comes to your personal data. We’re committed to protecting your personal data and have appropriate technical and organisational measures in place to make sure that happens.
The length of time we keep your personal data depends on what it is and whether we have an ongoing business need to retain it (for example, to provide you with a service you’ve requested or to comply with applicable legal, tax or accounting requirements).
We’ll retain your personal data for as long as we have a relationship with you and for a period of time afterwards where we have an ongoing business need to retain it, in accordance with our statutory obligations and data retention policies and practices. Following that period, we’ll make sure it’s deleted or anonymised.
It’s your personal data and you have certain rights relating to it. When it comes to providing you with information you’ve requested, such as nursery space/session details when they become available or any other marketing or feedback request communications, you can ask us not to send you these at any time – just follow the unsubscribe instructions contained in the feedback request, or send your request to email@example.com.
You also have rights to:
· know what personal data we hold about you, and to make sure it’s correct and up to date
· request a copy of your personal data, or ask us to restrict processing your personal data or delete it
· object to our continued processing of your personal data
· You can exercise these rights at any time by sending an email to firstname.lastname@example.org.
If you’re not happy with how we are processing your personal data, please let us know by sending an email to email@example.com. We will review and investigate your complaint, and try to get back to you within a reasonable time frame. You can also complain to your local data protection authority. They will be able to advise you how to submit a complaint.
How to contact us
We’re always keen to hear from you. If you’re curious about what personal data we hold about you or you have a question or feedback for us regarding this notice, our services or websites, please get in touch.
We prefer to communicate with you by email – this ensures that we can reply to your request in a timely, transparent and discreet manner.
Our email is firstname.lastname@example.org.