At Home-Grown we take our responsibility for your personal data very seriously – please see below sample copies of our Data Protection policy and our Privacy policy:
Home-Grown in Malvern DATA PROTECTION POLICY
In order to provide a quality early years and childcare service and comply with legislation, I will need to request information from parents about their child and family. Some of this will be personal data.
I take families’ privacy seriously, and in accordance with the General Data Protection Regulation (GDPR), I will process any personal data according to the seven principles below:
- I must have a lawful reason for collecting personal data, and must do it in a fair and transparent way. I will be clear about what data I am collecting, and why.
- I must only use the data for the reason it is initially obtained. This means that I may not use a person’s data to market a product or service to them that is unconnected to the reasons for which they shared the data with me in the first place.
- I must not collect any more data than is necessary. I will only collect the data I need to hold in order to do the job for which I have collected the data.
- I will ensure that the data is accurate, and ask parents to check annually and confirm that the data held is still accurate.
- I will not keep data any longer than needed. I must only keep the data for as long as is needed to complete the tasks it was collected for.
- I must protect the personal data. I am responsible for ensuring that I, and anyone else charged with using the data, processes and stores it securely.
- I will be accountable for the data. This means that I will be able to show how I (and anyone working with me) am complying with the law.
Procedure (how I put the statement into practice)
I have registered with the Information Commissioner’s Office, the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
I expect parents to keep private and confidential any sensitive information they may accidentally learn about my family, setting or the other children and families attending my setting, unless it is a child protection issue.
I will be asking parents for personal data about themselves and their child/ren in order to deliver a childcare service (see privacy notice). I am required to hold and use this personal data in order to comply with the statutory framework for the early years foundation stage, Ofsted, Department for Education and my local authority.
Subject access
Parents have the right to inspect records about their child at any time. This will be provided without delay and no later than one month after the request, which should be made in writing. I will ask parents to regularly check that the data is correct and update it where necessary.
Storage
I will keep all paper-based records about children and their families securely locked away in a storage cupboard.
If I keep records relating to individual children on my computer, externally or in cloud storage such as iCloud, Google Drive or Dropbox, including digital photos or videos, I will obtain parents’ permission. This also includes CCTV. I will store the information securely, for example, in password-protected files, to prevent viewing of the information by others with access to the computer.
Backup files will be stored on an encrypted memory stick which I will lock away when not being used. Firewall and virus protection software are in place.
If I store any records using a digital solution such as Kinderly, I will ensure I have carried out due diligence to ensure they are compliant with GDPR.
Information sharing
I am expected to share information with other childcare providers if a child also attends another setting.
I am also required to share information with Worcestershire County Council in regards to the childcare and early years entitlements.
I will not share any information with anyone without parents’ consent, unless there is a child protection concern.
Ofsted may require access to my records at any time.
Record keeping
I record all accidents in an accident book.
I will notify PACEY of any accidents which may result in an insurance claim, e.g. an accident resulting in a doctor or hospital visit. PACEY will log and acknowledge receipt of the correspondence and forward the information to the company providing my public liability insurance policy to enable a claim number to be allocated.
I will inform Ofsted, the local child protection agency and the Health and Safety Executive of any significant injuries, accidents or deaths as soon as possible.
I record all significant incidents in an incident book and I will share these with parents so that together we can work to resolve any issues.
I will only share information if it is in a child’s best interests to do so. For example in a medical emergency I will share medical information with a healthcare professional. If I am worried about a child’s welfare I have a duty of care to follow the Local Safeguarding Children Board procedures and make a referral. Where possible I will discuss concerns with you before making a referral.
Safe disposal of data
I am required by law to keep some data for some time after a child has left the setting. I have a review plan in place and ensure that any data is disposed of appropriately and securely.
Suspected breach
If I suspect that data has been accessed unlawfully, I will inform the relevant parties immediately and report to the Information Commissioner’s Office within 72 hours. I will keep a record of any data breach.
Manager’s name:
Manager’s signature:
Date:
Parent(s) name(s):
Parent(s) signature(s):
Date:
Date Policy was written:
This policy is due for review on the following date:
This policy supports the following safeguarding and welfare requirements: England
Meeting the Early Years Foundation Stage Safeguarding and Welfare Requirements Information and records.
Home-Grown in Malvern Privacy Notice
I/We take your privacy seriously, and in accordance with the General Data Protection Regulation, I/We will commit to the following:
I/We will be asking you for personal data about you and your child/ren in order to deliver a childcare service to you. I/We must have a legal basis for collecting this data, and there are six lawful bases:
(a) Consent:
The individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract:
The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation:
The processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests:
The processing is necessary to protect someone’s life.
(e) Public task:
The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests:
The processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
I will be processing your data under the following bases: consent, contract, legal obligation
Where I require consent, I will provide a way for you to positively make a decision about the information that you make available and how this is shared.
This information will be collected by the setting manager as part of the child’s induction to the setting. I/We will be asking for this data verbally at our initial meeting and recording it on paper forms/digitally. I/We will ask for this information at regular intervals to ensure it is up to date. I/We will do this by asking you to complete and return a data form.
The information that I/We require will be:
- Child’s name
- Child’s date of birth
- Child’s age
- Child’s address
- Parents’ names, addresses, contact numbers
- Who has parental responsibility for the child
- Emergency contact names, addresses and contact number
- Child’s doctor’s name and contact number
- Health clinic/health visitor
- Any allergies/medical history/ requirements
- Whether the child has any special educational needs or disabilities
- Ethnic group
- Religion
- Home language
- Child and/or parents’ National Insurance number for the purpose of 30 hour funding
I am required to hold and use this personal data in order to comply with the statutory framework of England/Wales, Ofsted/CIW, the Department for Education and my local authority early years team. This data will be used to:
- support your child’s development
- monitor and report on your child’s progress
- share information about activities in our setting
- contact named people in an emergency
- share with other professionals in accordance with legislation
- ensure a contract of service is delivered and maintained
- ensure that this setting receives the statutory funding for which it is eligible.
With your permission this data may be, when necessary, shared with:
- Other professionals supporting your child, for example health visitor, pre-school, nursery, school, other health or education professional
- My local authority through the Free Childcare and Early Education Entitlement headcount and annual Early Years Census (England)
- My local authority for the purposes of funded services that they support e.g Flying Start or the Childcare Offer (Wales)
- The local safeguarding children’s board or Social Services Referral and Assessment Team if I ever have any concerns about the safety of your child.
- Ofsted/CIW
If you want to see a copy of the information I/we hold and share about you or your child then please contact Denise Williams
I am required by law to keep some information about your child for a period of time after a child has left the setting. I will keep a record of this and dispose securely at the correct time.
Please see my data protection policy for further information on data sharing, safe storage and your rights to access your data.
Parent/Carer Signature:
Date: