General Data Protection Regulation - Privacy
Policy (GDPR)
SEASHELLS
NURSERY
Community Centre
Albert Road
Eyemouth
TD14 5DE
Tel. 018907 52082
Email: seashellsnursery@hotmail.co.uk
www.seashellsnursery.jimdo.com
|
LAST UPDATED / REVIEWED ON |
SIGNATURE |
|
26th February 2020 |
Miriam Lindsay |
|
|
|
|
|
|
This policy was adopted at a meeting of:
(Insert name of Early Learning and Childcare (ELC) Setting) Seashells Nursery ELCC
On (date) 26th February 2020
Signed M. Lindsay Designation Nursery Manager
Statement of Purpose
Seashells Nursery ELCC is required to gather particular personal data and information in order to comply with legislation relating to early learning and childcare in Scotland.
Seashells Nursery ELCC will gather and process all personal data and relevant consents; verbal or written, following GDPR guidance. Data will be treated confidentially and will uphold the rights of all individuals, involved in the service, children, parents, staff, students and volunteers.
Seashells are required to hold information about the children and families using the service as well as staff working within the setting, ensuring compliance within the regulation. Processes will be in place to ensure the safe and secure storage of all data belonging to our service users; the detail of this storage is as follows;
In a lockable filing cabinet, within the nursery office.
General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and expands on the current regime established by the Data Protection Act 1998 (DPA).
The term parents will be used to include all main caregivers.
Seashells Nursery Privacy Policy
Who we are
Seashells Nursery gathers and processes your personal information in accordance with this privacy policy and in compliance with the relevant data protection Regulation and law. This notice provides you with the necessary information regarding your rights and obligations, and explains how, why and when we collect and process your personal data.
Our designated Data Protection Officer for the organisation is Miriam Lindsay and can be contacted on 018907 52082. They are responsible for ensuring systems are in place to process and handle all data appropriately, updating policies, undertaking an annual audit of data and monitoring staff regarding data handling and processing.
We are registered with the Information Commissioner’s Office (ICO) and our registration number is ZA692478
The personal data that we collect from you may include:-
* Name
* Gender - When applicable
* Date of Birth - When applicable
* Home Address
* Personal Email – When applicable
* Business Email – When applicable
* Home and or Mobile Telephone Number
*Information and observations to support your child’s learning
* Payroll information for staff
We collect information in the following ways:-
* On-line forms – When applicable
* In person - When applicable
* Over the phone - When applicable
* By e-mail - When applicable
Information that we collect
Seashells Nursery processes your personal information to meet our legal, statutory and contractual obligations and to provide you with our services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than already specified in this notice.
How we use your personal data
Seashells Nursery takes your privacy very seriously and will never disclose, share or sell your data without your consent, unless required to do so by law. We only retain your data for as long as is necessary and for the purposes specified in this notice. Where you have consented to us providing you with promotional offers or marketing, you are free to withdraw consent at any time.
The purposes and reasons for processing your personal data are detailed below:-
* We collect your personal data to support a contract or a service requested by you.
* We collect and store your personal data as part of our legal obligation for business accounting and tax purposes.
Your rights
You have the right to access any personal information that Seashells Nursery processes about you and to request information about: –
* What personal data we hold about you
* The purposes of the processing
* The categories of personal data concerned
* The recipients to whom the personal data has/will be disclosed
* We intend to store your personal data for the duration of our contract/service with you and will operate within existing legal requirements
* If applicable, where we gathered any supplementary information
If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will endeavour to make the corrections as a matter of urgency. If there is a valid reason for not doing this, we will contact you and update you about this situation.
You also have the right to request the deletion of your personal data or to restrict processing in accordance with General Data Protection Regulation, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use. This relates to required communications in relation to the service we provide to you.
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.
Sharing and disclosing your personal information
We do not share or disclosure any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement. The processors acting on our behalf only process your data in accordance with instructions from us and comply fully with this privacy notice, which we have agreement of. They have agreed to adhere to the data protection laws and work within the requirements of required confidentiality and security measures. Regulatory requirements from governing bodies supercede the requirements of the regulation; where request is made by a non-regulatory organisation, your consent will requested.
We are required to share information without consent if:
· There is evidence that a child is suffering or at risk of suffering significant harm
· There is reasonable cause to suspect that a child may be suffering or at risk of suffering significant harm
· It will prevent a crime being committed or provide information where a crime may have been committed
· Refusing to share the information will have a negative outcome
Consequences of not providing your data
You are not obligated to provide your personal information to Seashells Nursery where is does not relate directly to our service to you, however, if this information is required for us to provide you with our services it may have a direct impact upon the level of service we can provide you with.
How long we keep your data
Seashells Nursery only ever retains personal information for as long as is necessary, for the duration of our contract/service with you, or until your child turns 18 years old. Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent. Regulatory requirements from governing bodies supercede the requirements of the regulation.
Marketing
Seashells Nursery would like to contact you with details of relevant services and information. If you consent to us using your contact details for these purposes, you have the right to modify or withdraw your consent at any time by contacting Seashells Nursery directly.
Controlling information about you
When you fill in a form or provide your details you will see one or more tick boxes allowing you to:
* Opt-in to receive marketing communications from us by email, telephone, text message or post.
* Opt-in to receive marketing communications from our third-party partners by email, telephone, text message or post.
If you have agreed that we can use your information for marketing purposes, you can change your mind easily by contacting us below:
Contact us at seashellsnursery@hotmail.co.uk or 018907 52082
We will never distribute or sell your personal information to third parties unless we have your permission or the law requires us to.
Any personal information we hold about you is stored and processed under our data protection policy, in line with the Data Protection Act 1998 and (from 28th May 2018 onwards) Regulation (EU) 2016/679 (“GDPR”), the Privacy and Electronic Communications (EC Directive) Regulations (all as amended, updated or re-enacted from time to time), any law based on or seeking to enact any such provisions in the United Kingdom to the GDPR; and any applicable guidance or codes of practice issued by Working Party 29, the European Data Protection Board or Information Commissioner from time to time (all as amended, updated or re-enacted from time to time).
Security
We will always hold your information securely.
To prevent unauthorised disclosure or access to your information, we have implemented strong physical and electronic security safeguards.
Links from our site
Our website may contain links to other websites.
Please note that we have no control of websites outside our domain (seashellsnursery.jimdo.com). If you provide information to a website to which we link, we are not responsible for its protection and privacy.
We would advise you to read any such site’s data protection and privacy policies fully to ensure your own security.
Lodging a complaint
Seashells Nursery only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority.
Information Commissioner’s Office
The Information
Commissioner's Office – Scotland
45 Melville Street
Edinburgh
EH3 7HL
Telephone: 0303 123 1115
Email: Scotland@ico.org.uk
The Information Commissioner’s Office (ICO) provides a comprehensive guide to working within GDPR https://ico.org.uk/
Additional information to support confidentiality
Records and Storage of Records
To ensure the smooth running of the setting we keep a variety of records including health and safety records, financial records, employment records of staff, students and volunteers and development plans.
We also keep records of the children including:
· Personal Records
· Developmental Records
· Personal Care Plans
Personal Records will record information including registration and consent forms, contact information, correspondence from other agencies regarding the child and or family, health issues and any other, relevant, confidential information. These records will be stored securely in a lockable cabinet. Parents will have access only to their own child’s file.
Developmental Records may include samples of the children’s work, photographs, observations of the child’s progress in the setting and any other relevant information pertaining to the child’s progress. These records are usually kept within the playroom and can be accessed and contributed to by children, staff and parents. Parents will only have access to their own child’s records.
All information regarding children and /or their families will be accurate and up to date and shared only with the appropriate personnel. Each child’s personal records concerning information relating to medical matters, child protection matters, additional support needs will be retained for a ten year period and safely disposed of by shredding, pulping or burning. In collecting, holding and processing personal data the setting complies with current Data Protection rules and guidance. This also complies with GDPR as highlighted under Information you hold: you should document what personal data you hold, where it came from and who you share it with.
Staff Records
All issues regarding the employment and management of staff are confidential to the people directly involved i.e. the staff member and those involved in making the decisions. Staff will have their own personal record containing relevant information and they will have access only to their own personal record. Records will be kept securely by the person specified by the employer as having access to the personnel files. In committee managed settings these names will need to be reviewed regularly, at least annually, and any changes recorded as appropriate. Records will be disposed of by burning, shredding or pulping and will be kept no longer than necessary. This may be changed on advice from your local authority. Records should be regularly reviewed and information no longer required should be deleted.
Any personal information regarding a member of staff will not be passed to another person without their prior knowledge and consent. Information regarding an individual’s performance will be confidential as will any disciplinary or grievance matters in which they are directly involved.
Data breaches: You should make sure that you have the right procedures in place to detect, report and investigate a personal data breach. Any breach of the procedures will be investigated and will result in disciplinary action being taken if involving a staff member. In a committee managed service any breach of the procedures will result in a complaint being raised against them.
Monitoring of this Policy
It will be the responsibility of Miriam Lindsay, Nursery Manager to ensure that all staff, including new or temporary staff, are familiar with this policy and to monitor that it is being implemented. Parents should be made aware of this policy through the parents` handbook and the enrolment procedure.
The policy will be reviewed annually to ensure all records are relevant and up to date.
See also:
Additional Support Needs Policy
Administration of Medication Policy
Child Protection Policy
Complaints Policy
Use of ICT Policy
Safe Recruitment Policy
Staff Development
Whistleblowing Policy
Anti-bullying and Harassment Policy
Retention of Documents
Links to national landscape:
Your practice and policy must adhere to the the Health and Social Care Standards - http://www.gov.scot/Resource/0052/00520693.pdf