Rascals Privacy Policy

​

General Data Protection

Regulation 2018

​

Policy Statement 

​

The record keeping systems at Rascals meet the legal requirements for storing and sharing information within the framework of the General Data Protection Regulations 2018 and the Human Rights Act 1998.

This policy and procedures work in conjunction with our Confidentiality Policy and our Information Sharing Policy. 

General Data Protection Regulation 2018 (GDPR) came into effect on 25th May 2018. GDPR states that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individual’s data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals. 

Rascals Pre-School Playgroup is committed to protecting the rights and freedoms of individuals with respect to the processing of children's, parents, visitors and staff personal data. GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. 

​

 

Procedures

​

Data Controller

Rascals Pre-School Playgroup is registered as a data controller with the Information Commissioner’s Office (ICO).  Registration number:A8289481.  This registration is renewed annually and updated as and when necessary.  The Data Protection officer for Rascals Pre-School Playgroup is Tracey Hubbard.   We ensure that your data is processed fairly and lawfully, is kept secure and is kept for no longer than is necessary*.

 

The legal basis for us collecting data

We are required to collect data to comply with our legal requirements as an Early Years setting.  This is in accordance with Ofsted regulation, in accordance with the statutory requirements of the Early Years Foundation Stage (EYFS) and to fulfil our role with regards to West Sussex County Council.

 

How we use information

We collect and hold personal information relating to staff, volunteers, students, children, parents, carers and other family members or friends who have authority to collect children from our setting.  We may share information with other Early Years settings or local authorities when a child moves setting. In addition, we may share information with other professional services such as health care professionals, schools and financial institutions.  We only share information relating to your child with other professionals with your permission unless the safety of the child is at risk as per our information sharing policy. 

 

Who the information is processed about

We process personal information about:

1. Past, current and future employees

2. Children attending the setting and their families/carers

3. People enquiring about our setting

4. Students and volunteers

5. Visitors to the setting

 

Reasons/purposes for processing information

We process personal information to enable us to provide educational play, to maintain our own accounts and records and to support and manage our staff.

• Children’s records - We maintain two kinds of records about children attending our setting:

Developmental Records – These include observations of children in the setting, photographs, samples of their work and summary developmental reports.  Each child’s journal will contain photographs of themselves plus their friends and may contain written observations including other children’s first names.

Personal Records – These include registration documents and admission forms, signed consent forms and correspondence concerning the child or family, reports or minutes from meetings concerning the child from other agencies, an ongoing record of relevant contact with parents, and observations by staff on any confidential matter involving the child, such as developmental concerns or child protection matters.

In addition to these records children’s names and photographs are shared amongst the setting when the setting is open on the following basis:

• Welcome board – Full name of each child and a photograph of each child. (The names are locked in a cupboard when the setting is closed and the photographs are stored away from the public eye when the setting is closed).

• Coat peg – First name of each child.  (The names are on show at all times).

• Toilet list – First names of children are displayed on a list in the toilet area and stored away in a cupboard when the setting is closed.

 

• Parent/Carer’s records 

Contact Details - We maintain an ongoing record of Parent/Carer contact details including names, addresses, telephone numbers and email addresses.

Personal information – We are required to collect and store information in order to organise free entitlement funding for children within the setting.  To enable us to process this funding we are required to maintain records including parent/carer’s National Insurance Numbers and date of birth.  This information is requested on our registration document and again on the Free Entitlement Parent Declaration form supplied to us by West Sussex County Council.  

 

• Staff/volunteer records

We are required to maintain personal records relating to staff members, which include the following documents:

1. Application form

2. References

3. Certificates relating to qualifications

4. Copies of identification such as passport or driving license 

5. P45

6. Records from Supervisory meetings and appraisals

Safeguarding - In order to adhere to the Early Years Foundation Stage (EYFS) requirements we are also required to retain a record of DBS certificate numbers.  

Salary payments - In order to process wages we are required to maintain a record of National Insurance Numbers and bank details.  This information is held securely in paper form with one of the managers and is also used online to process wage payments.  This requires the information to be input into the HMRC PAYE online system which is accessed via a password protected laptop and is also used to process wage payments through our bank account.

Health information- We are required to maintain an ongoing record of any regular medication taken by members of staff and contact details of their Doctor.

Emergency contact details – We are required to maintain an ongoing record of emergency contact details for each member of staff.

​

Who the information is shared with

We sometimes need to share personal information we process with the individual themselves and also with other organisations.  Where this is necessary we are required to comply with all aspects of the Data Protection Act (DPA).

Below is a list of individuals or groups who we may share information with:

• Families attending our setting

• Healthcare professionals 

• Social and welfare advisers or practitioners

• Financial organisations and professional advisers

• Debt collection and tracing agencies

• Local schools

• Current, past and prospective employees 

• Local and central government

• Suppliers

• Service providers

• Other Early Years Providers

• Photographic development services

• The Methodist Church 

 

 

Retention periods

Personal information is not held any longer than is necessary and complies with guidelines from local government and Ofsted*.

​

Your rights

The GDPR has 7 individual rights:

​

1. The right to be informed – you must be given clear information about data collection 

Rascals Pre-School Playgroup is a registered Childcare provider with Ofsted and as such, is required to collect and manage certain data. We need to know parent/carer’s names, addresses, telephone numbers, email addresses, date of birth and National Insurance numbers. We need to know children’s full names, addresses, date of birth and Birth Certificate number. For parents claiming the free nursery entitlement we are requested to provide this data to West Sussex County Council; this information is sent to the Local Authority via a secure electronic file transfer system. We are required to collect certain details of visitors to our pre-schools. We need to know visitor’s names, and an appropriate emergency contact telephone number.  This is in conjunction with our Health and Safety and Safeguarding Policies. 

As an employer Rascals Pre-School Playgroup is required to hold data on its employees; names, addresses, email addresses, telephone numbers, date of birth, National Insurance numbers, photographic ID such as passport and driver’s license, bank details. This information is also required for Disclosure and Barring Service checks (DBS) and proof of eligibility to work in the UK. This information is sent via a secure file transfer system for the processing of DBS checks. 

Rascals Pre-School Playgroup uses Cookies on its website to collect data, this data is anonymous and a cookie notices is attached to our website informing visitors. 

​

2. The right to access – staff and families are allowed to request access to their data

Rascals Pre-School Playgroup is owned by Rustington Methodist Church and falls under the umbrella of the church charity registration no: 1134885.  At any point an individual can make a request relating to their data and Rascals Pre-School Playgroup will need to provide a response (within 1 month). Rascals Pre-School Playgroup can refuse a request but we will inform the individual of the reasons for the rejection. The individual will have the right to complain to the ICO if they are not happy with the decision.  The ICO can be contacted as follows: Tel:  0303 123 1113.

​

3. The right to rectification – if data is incorrect you have the right to ask for it to be updated

Under Article 16 of the GDPR individuals have the right to have inaccurate personal data rectified. An individual may also be able to have incomplete personal data completed – although this will depend on the purposes for the processing. This may involve providing a supplementary statement to the incomplete data.  We will reply to requests within 1 month.

​

4. The right of erasure – You can ask for your data to be ‘forgotten’ once it’s use has expired.

Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.  Individuals have the right to have their personal data erased if:

• the personal data is no longer necessary for the purpose which we originally collected or processed it for;

• we are relying on consent as our lawful basis for holding the data, and the individual withdraws their consent;

• we are relying on legitimate interests as our basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;

• we are processing the personal data for direct marketing purposes and the individual objects to that processing;

• we have processed the personal data unlawfully 

• we have to do it to comply with a legal obligation; or

• we have processed the personal data to offer information society services to a child.

The GDPR specifies two circumstances where we should tell other organisations about the erasure of personal data:

• the personal data has been disclosed to others; or

• the personal data has been made public in an online environment (for example on social networks, forums or websites).

If we have disclosed the personal data to others, we will contact each recipient and inform them of the erasure, unless this proves impossible or involves disproportionate effort.  

​

5. The right to restrict processing – You can object to your data being used in certain ways

Article 18 of the GDPR gives individuals the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that Rascals Pre-School Playgroup uses their data. This is an alternative to requesting the erasure of their data.

Individuals have the right to restrict the processing of their personal data where they have a particular reason for wanting the restriction.  Rascals Pre-School Playgroup will respond to a request as soon as it is received or at the latest 30 days after the request.

​

6. The right to data Portability – Our systems must move data safely and securely 

Rascals Pre-School Playgroup requires data to be transferred from one IT system to another; such as from Rascals Pre-School Playgroup to the Local Authority, to shared settings, to financial institutions, to other professionals for example. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.

​

7. The right to object – you have the right to object to data being used in a way that runs counter to the original use.

Article 21 of the GDPR gives individuals the right to object to the processing of their personal data.  This effectively allows individuals to ask us to stop processing their personal data.

Individuals have the absolute right to object to the processing of their data if it is for direct marketing purposes.  Rascals Pre-School Playgroup never passes your data onto marketing companies.

*Retention periods

All records are held for a period of time as recommended or stipulated by either the Pre-School Learning Alliance or Ofsted. The main documents are shown below:

• Registration documents are kept for a period of 3 years after a child has left our setting.

• Funding forms are maintained for a period of 1 year after a child has left our setting.

• Staff/volunteer records are kept for 6 years following a member of staff leaving the setting.

• Accident records are kept for 3 years for adults and until the child has reached 18 years of age.

 

Legal Framework

• Data Protection Act 1998

• General Data Protection Regulation 2018

• Human Rights Act 1998

 

This policy was adopted at a meeting of Rascals Pre-school Playgroup

Held: 19th January 2023

Date to be reviewed: January 2024

Name of signatories: Tracey Hubbard

Role of signatories: Manager