Kids Planet (“the Nursery” or “we”) is committed to protecting the privacy and security of your personal information. This privacy notice describes how the Nursery collects and uses personal information about employees of the Nursery (“Employees”), children attending the Nursery (“Child” or “Children”) and the parents of the Children (“Parents”) (known collectively as “You” or “Your”), in accordance with the General Data Protection Regulations (GDPR).
As part of the Kids Planet group, Kids Planet is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about You. We are required under data protection legislation to notify You of the information contained in this privacy notice.
This notice applies to Employees, Children and Parents, as well as visitors to Kids Planet. This notice does not form part of any contract of employment or other contract to provide services.
It is especially important that Employees and Parents read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about You, so that You are aware of how and why we are using such information and what Your rights are under the data protection legislation.
Employees, Parents and visitors can access this document on the Kids Planet website and can request a copy at any time from a Kids Planet reception desk or from our Central Support office.
Kids Planet are compliant with data protection legislation as it applies in the UK. There are seven key principles outlined in the legislation and with which we adhere:
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are “special categories” of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation. Details of the data processed by Kids Planet, can be viewed on our ICO registration page: https://ico.org.uk/ESDWebPages/Entry/Z9796098
We may collect, store, and use the following categories of personal information about Employees:
Kids Planet give particular weight to the rights and interests of children. This means, on the one hand, that we are especially concerned with the protection of children’s data. On the other hand, it means that our duty to safeguard the health and well-being of children is paramount and takes precedence over our duties under the GDPR. For example, paragraph 62 of Keeping Children Safe in Education affirms that while data protection legislation “…places duties on organisations and individuals to process personal information fairly and lawfully, it is not a barrier to sharing information, where the failure to do so would result in a child being placed at risk of harm. Fears about sharing information cannot be allowed to stand in the way of the need to promote the welfare and protect the safety of children.”
We may collect, store, and use the following categories of personal information about Children:
We will collect, store, and use the following categories of personal information about Parents:
We collect personal information about Employees through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.
We will collect additional personal information in the course of job-related activities throughout the period of when an Employee works for us.
We collect personal information about Children and Parents from when the initial enquiry is made by the Parents, through the enrolment process and until the Children stop using the Nursery’s services.
We will only use Your personal information when the law allows us to. Most commonly, we will use Your personal information in the following circumstances:
We may also use Your personal information in the following situations, which are likely to be rare:
We need all the categories of information in the list above (see Employee section within the Paragraph entitled ‘The Kind of Information We Hold About You’) primarily to allow us to perform our contracts with Employees and to enable us to comply with legal obligations. The situations in which we will process Employee personal information are listed below.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of an Employee’s personal information.
We need all the categories of information in the list above (see Children section within the Paragraph entitled ‘The Kind of Information We Hold About You’) primarily to allow us to perform our obligations (including our legal obligations to Children). The situations in which we will process personal information of Children are listed below.
We need all the categories of information in the list above (see Parents section within the Paragraph entitled ‘The Kind of Information we Hold About You’) primarily to allow us to perform our contracts with Parents and to enable us to comply with legal obligations. The situations in which we will process personal information of Parents are listed below.
If Employees and Parents fail to provide certain information when requested, we may not be able to perform the respective contracts we have entered into with Employees and Parents, or we may be prevented from complying with our respective legal obligations to Employees, Children and Parents.
We will only use Your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use Your personal information for an unrelated purpose, we will notify the Employee, Child or Parent, as is appropriate in the circumstances, and we will explain the legal basis which allows us to do so.
Please note that we may process an Employee’s, a Child’s or a Parent’s personal information without their respective knowledge or consent, as relevant to the circumstances, in compliance with the above rules, where this is required or permitted by law.
”Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:
We will use particularly sensitive personal information of Employees in the following ways:
It is our intention to respect the privacy of children, their families and our team. Measures in place for ensuring confidentiality include:
We do not need the consent of Employees if we use special categories of personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach Employees for their written consent to allow us to process certain particularly sensitive data. If we do so, we will provide Employees with full details of the information that we would like and the reason we need it, so that Employees can carefully consider whether they wish to consent. Employees should be aware that it is not a condition of their contract with the nursery that they agree to any request for consent from us.
We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect the interests of You (or someone else’s interests) and You are not capable of giving your consent, or where an Employee or a Parent, as is relevant to the circumstances, has already made the information public.
We envisage that we will hold information about criminal convictions.
We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so, which includes but is not limited to Disclosure and Barring Service (“DBS”) checks. Where appropriate, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you in the course of you working for us. We will use information about criminal convictions to conduct a DBS check on each Employee, to record the date of the DBS check, the number of the DBS check and the name of the body conducting the DBS check.
We are allowed to use your personal information in this way to carry out our obligations. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
You will not be subject to decisions that will have a significant impact on You based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified the Employee or the Parent as is appropriate in the circumstances.
We may have to share Employee, Child or Parent data with third parties, including third-party service providers and other entities in the group.
We require third parties to respect the security of Your data and to treat it in accordance with the law.
We will share Your personal information with third parties where required by law, where it is necessary to administer the working relationship with You or where we have another legitimate interest in doing so.
”Third parties” includes third-party service providers (including contractors and designated agents), local authorities, regulatory bodies, schools and other entities within our group. The following third-party service providers process personal information about you for the following purposes:
We will share personal data regarding your participation in any pension arrangement operated by a group company with the trustees or scheme managers of the arrangement in connection with the administration of the arrangements.
We may share Your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share Your personal data with the other parties if and to the extent required under the terms of the transaction.
We may also need to share Your personal information with a regulator or to otherwise comply with the law.
We will only retain Your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are shown in Appendix 1. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of Your personal data, the purposes for which we process Your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise Your personal information so that it can no longer be associated with You, in which case we may use such information without further notice to You. Once you are no longer an Employee, or a Child benefiting from the Nursery’s services or a Parent, as is appropriate, we will retain and securely destroy your personal information in line with this policy.
Your duty to inform us of changes
It is important that the personal information we hold about You is accurate and current. Please keep us informed if Your personal information changes during your working relationship with us.
Your rights in connection with personal information
The GDPR affords 7 individual rights. Not all of the rights are absolute –there are conditions attached to some and in most cases, a balanced approach to entitlement and interests, is promoted by the regulations.
1. The right to be informed about the processing of your data.
Kids Planet actively inform colleagues and parents about the data we process. Our policies and procedures for processing data, are transparent, accessible and intelligible. We issue privacy notices where appropriate.
2. The right to access data that Kids Planet hold about you or your child
You can request to be informed about or see data we hold about you or your child or request to verify the lawful basis for our processing of your data. For the Subject Access Request Procedure see Appendix 3
3. The right to rectify data that is incorrect or incomplete
Most rectification requests can be resolved informally, by speaking with the person in charge of the information, such as a Centre Manager, Customer Support or the reception team. Occasionally, a parent or colleague may wish to make a formal rectification request. Kids Planet will consider whether the data is inaccurate and other factors, such as whether an inaccurate account (such as a false allegation) was rectified but the inaccurate account was lawfully retained. If Kids Planet shared inaccurate information with third parties, we will where possible (and not disproportionate), inform them of rectifications made.
4. The right to erase your data – sometimes known as ‘the right to be forgotten’.
Kids Planet will consider the relevance of the data you wish to erase and whether it is necessary for us to retain or erase the information due to an overriding obligation or legitimate interest. If Kids Planet have shared the erased information with third parties, we will where possible (and not disproportionate), inform them of the erasure.
5. The right to restrict processing, by insisting that data held about you is not used.
Requests for data restriction are an alternative to erasure and may be temporary, such as while the lawfulness or accuracy of data processing is being verified or in order to support a legal claim. Procedures for restricting processing are variable, for example:
Removing the data from our website, but retaining within a password protected file.
Making an exception to auto-deletion of an ex-colleague’s file.
Creating a secure file for information that may be processed if and when the restriction is lifted.
You will be informed before a restriction is lifted, with reasons that the restriction no longer applies. If Kids Planet have shared the restricted information with third parties, we will where possible (and not disproportionate), inform them of the restriction.
6. The right to data portability allows you to reuse your data to access different services.
This right applies only to personal data that you provide to Kids Planet and is processed by automated means, such as website search / usage history. If the right applies, you can request a copy of the data and / or to have the data transmitted by Kids Planet, to another controller.
7. The right to object to the processing of your data
This right applies only when our lawful basis for processing the data is a legitimate interest of Kids Planet; used for direct marketing or used for research / statistics. You have an absolute right to object to direct marketing. If you object to receiving promotional offers, Kids Planet will no longer send you this information, even if you previously asked to be included. In other cases, the regulations require a balanced approach, weighing your particular situation and reasons for objecting, against any compelling reasons for processing the data.
In circumstances where You may have provided Your consent to the collection, processing and transfer of Your personal information for a specific purpose, You have the right to withdraw Your consent for that specific processing at any time. To withdraw Your consent, contact the person in charge of the nursery. Once we have received notification that You have withdrawn Your consent, we will no longer process Your information for the purpose or purposes You originally agreed to, unless we have another lawful basis for doing so.
Kids Planet provide colleagues with the tools they need to be responsible data processors, including:
Notifiable breaches must be reported to the ICO without undue delay and not later than 72 hours after becoming aware of it. Reasons for any delay must be given and information can be provided in phases rather than all at once, provided this is done without undue delay.
The ICO have an online self-assessment tool: https://ico.org.uk/for-organisations/report-a-breach/ The tool asks about whether the breach represents ANY risk to individuals and you may need expert assistance (for example from our IT providers) to help with answering this question.
The same ICO page [https://ico.org.uk/for-organisations/report-a-breach/] contains a link for reporting a notifiable breach if that is necessary. The online form asks for details such as the type of data breached; an account of the data breach; likely consequences and what we have done, for example to retrieve and re-secure the data. Once again, you may need expert advice (for example from our IT providers) when filling out the form.
The ICO Security Breach Helpline 0303 123 1113 is available Monday to Friday 9-5 if you have further questions about how to report the breach.
Failing to notify a breach when required to do so can result in a significant fine up to 10 million euros or 2 per cent of your global turnover. The fine can be combined the ICO’s other corrective powers under Article 58. So it’s important to make sure you have a robust breach-reporting process in place to ensure you detect and can notify a breach, on time; and to provide the necessary details.
If a breach is likely to result in a HIGH risk to the rights and freedoms of individuals, you must inform those concerned directly and without undue delay.
If the impact of the breach is more severe, the risk is higher; if the likelihood of the consequences is greater, then again the risk is higher. One of the main reasons for informing individuals is to help them take steps to protect themselves from the effects of a breach.
In clear and plain language, describe the nature of the data breach; a description of what happened and likely consequences, as well as measures we have taken to deal with the breach and potential adverse effects.
Document all data breaches, regardless of whether or not they need to be reported to the ICO. Record what happened, likely risks and consequences as well as measures taken, including the self-assessment when deciding whether to report the breach to the ICO. If appropriate, there should be an investigation and measures put in place to prevent a similar breach, such as re-training of individuals or a change in policy.
It may be appropriate to involve third parties such as the police, insurers, professional bodies, or bank or credit card companies who can help reduce the risk of financial loss to individuals.
By Post Kids Planet Day Nurseries – Head Office 231 Higher Lane Lymm WA13 0RZ
By Telephone 01925 753448
I work in the tots room at Salford Quays – I’ve been here for 8 months and in that time I’ve had an in-depth induction and lots of training. I love coming to work because the great staff make me feel welcome and the practice here is outstanding. Kids Planet are always offering me new learning opportunities – they want me to work my way up the company ladder. My management team are amazing and they are always looking for ways to support me.
During my apprentice journey I have become more passionate about working with children and grab every opportunity I can to gain more experience within an outstanding early years setting. Whilst working I have learnt to adapt to any situation and have been supporting parents throughout their child’s journey with us. But my biggest achievement is the knowledge that I have gained. I am now able to give each child the best start in life.
I have enjoyed doing my level 3. I feel like I have gained so much out of doing it. I know I received a nomination for apprentice of the year earlier this year. I now feel I understand legislations and the EYFS a lot more and what is expected. My practice has improved due to having more confidence with sharing ideas and views and also implementing them in Pre-school. My tutor, Lynne has supported and guided me through everything and answered all my questions I needed answering and she was always positive. From finishing my Level 3 I was then promoted to Senior and now I have become Room leader of Pre-School.