Privacy Policy
At The Gap Club Ltd, we
respect the privacy and security of personal information of our Parents, Carers
and the children attending our settings or using our Sitters service. The
personal information that we collect and use relating to you, your child and
other contacts is used only to provide appropriate care for your child(ren),
maintain our service to you, and communicate with you effectively. Our legal
basis for processing the personal information relating to you and your child is
so that we can fulfil our contract with you in a safe and effective manner
under the childcare regulations.
The
Gap Club is a “data controller”, with data protection number: ZA114355 This
means that we are responsible for deciding how we hold and use personal
information about you. We are required under data protection legislation to
notify you of the information contained in this privacy notice.
This
notice applies to Employees, Children and Parents. This notice does not form
part of any contract of employment or other contract to provide services. We
may update this notice at any time but if we do so, we will provide you with an
updated copy of this notice as soon as reasonably practical.
It is
important that Children and Parents read and retain this notice, together with
any other privacy notice we may provide on specific occasions when we are
collecting or processing personal information about you, so that you are aware
of how and why we are using such information and what your rights are under the
data protection legislation.
Data Protection Legislation
We will comply with data protection law. This says
that the personal information we hold about you must be:
1. Used
lawfully, fairly and in a transparent way.
2. Collected
only for valid purposes that we have clearly explained to you and not used in
any way that is incompatible with those purposes.
3. Relevant
to the purposes we have told you about and limited only to those purposes.
4. Accurate
and kept up to date.
5. Kept
only as long as necessary for the purposes we have told you about.
6.
Kept securely.
An overview of the type of information we hold about you:
Personal data, or personal information, means any
information about an individual from which that person can be identified. It
does not include data where the identity has been removed (anonymous data).
There are “special categories”
of more sensitive personal data which require a higher level of protection,
such as information about a person’s health or sexual orientation.
Personal Data we collect
includes:
We collect personal information about Children
and Parents from when the initial enquiry is made by the Parents, through the
enrolment process and until the Children stop using the settings. We
collect personal data about you and your child to provide care and learning
that is tailored to meet your child’s individual needs. The main categories
under GDPR that we collect personal information data fall under the lawful
basis of: Contract, Consent and Legitimate Interest. Collecting data under the
lawful basis of contract means
that we need this data to provide a place at our settings for your child.
Because of that, you won’t be able to ask for us to delete or stop processing
this data without ending the contract with us.
We also collect information to verify your eligibility for
free childcare as applicable.
Personal details that we collect
about your child include:
·
Your child’s name, date of birth, school
attended, other setting currently attended, attendance information, home address,
health, medical, dietary needs, development needs, and any additional educational
support needs, parent & guardian contact details and emergency contact
details, home language, observation, planning and assessments, 2-year checks.
·
Where applicable we will require you to provide
or obtain records relating to individual children eg child protection plans
from social services, care and health care plans from health professionals.
·
We will also ask for information about who has
parental responsibility for your child and any court orders pertaining to your
child.
· We may
also collect, store and use the
following “special categories” of more sensitive personal information:
•
Information about a Child’s race or
ethnicity, spoken language and nationality.
•
Detailed Information about a Child’s
health, including any medical condition, health and sickness records.
•
Information about a Child’s accident or
incident reports including reports of pre-existing injuries.
•
Information about a Child’s incident forms /
child protection referral forms / child protection case details / reports.
Personal details that we collect
about you include:
·
Your name, home address, phone numbers, email
address, emergency contact details, and family details.
·
Personal name, contact details for emergency
contacts or collectors.
·
This information will be collected from you
directly in the registration/booking process.
·
If you apply for 15 or 30 hours free childcare
or FEET funding, we will also collect:
o
Your national insurance number or unique
taxpayer reference (UTR), if you’re self-employed.
o
We may also collect information regarding
benefits and family credits that you are in receipt of.
·
For payment of our services, we will also
collect bank/card/voucher payment method details to allow monies to be
collected and continuity of service.
·
We may also collect, store and use the following
“special categories” of more sensitive personal information:
·
Information about a Parent’s race or
ethnicity, spoken language and nationality.
·
Conversations with Parents where staff of the setting
deem it relevant to the prevention of radicalisation or other aspects of the
governments Prevent strategy.
Additionally, and in accordance with our policies and procedures, the
following personal data records and information will also be used, stored and maintained for the settings:
·
An up to
date record of all the staff, students and volunteers who work at the setting,
including their name; address; telephone number; DBS check status; references;
employment details and any other information (such as their Personal
Development Plan) accrued during their time spent working at the setting.
·
A record
of any other individuals who reside at, or regularly visit/spend time at the setting,
including their contact details.
·
Records
of the activities planned and implemented by the setting, including any
off-site visits and outings permissions.
·
Records
of any medication being held by staff on behalf of children, along with the authorised
Administration of Medication Forms, in accordance with the Health, Illness and
Emergency policy.
·
Records
of parental authorisation permitting staff to consent to emergency treatment
for children (in accordance with the Health, Illness and Emergency policy).
·
Records of any reportable death, injury, disease or
dangerous occurrence
·
Photographs and video clips of the Child/ren to for
general display and marketing purposes
·
Record
book for each Child containing the work of the Child whilst at the Pre-school
and after school and holiday club settings, observations about the Child’s
development whilst at the settings from staff, specific examples of the Child’s
progress, photographs demonstrating the Child’s development whilst at the
settings, and personal details of the Child (e.g. their date of birth)
(“Progress Report”)
The setting
supervisor has overall responsibility for the maintenance and updating of
children's records and ensuring that they are accurate and secure when at
settings.
How we will use information about you
We will only use your personal information when the
law allows us to. Most commonly, we will use your personal information in the
following circumstances:
1. Where
we need to perform the contract, we have entered into with you.
2. Where
we need to comply with a legal obligation. * See Consents
3. Where
it is necessary for our legitimate interests (or those of a third party) and
Your interests and fundamental rights do not override those interests.
We may also use your personal information in the
following situations, which are likely to be rare:
1. Where
we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official
purposes.
Why
we collect this information and the legal basis for handling and using your
data
For Children
We need all the categories of
information mentioned above primarily to allow us to perform our obligations
(including our legal obligations to Children). The situations in which we will
process personal information of Children are listed below.
· Upon consent from the Parents, Personal Data of Children will be shared
with schools for progression into the next stage of their education.
- Personal information of
Children will be shared with local authorities without the consent of
Parents where there is a situation where child protection is necessary.
- The personal information of
Children will be shared with local authorities without the consent of
Parents for funding purposes.
- Ofsted will be allowed access
to the settings systems to review child protection records.
- To ensure we meet the needs
of the Children eg to contact you in an emergency, care and learning.
- To enable the appropriate
funding to be received.
- Report on a Child’s progress and
wellbeing including any health, medical or dietary needs and their
treatments with authorisation whilst with the setting.
- To check safeguarding records.
- To check complaint records.
- To check attendance patterns
are recorded.
- When a Child’s Progress Report is given
to its Parent in order for that Parent to pass the same Progress Report to
a school for application or enrolment purposes.
For Parents
We need all the categories of
information mentioned above primarily to allow us to perform our contracts with
Parents and to enable us to comply with legal obligations. The situations in
which we will process personal information of Parents are listed below.
- The personal information of
Parents will be shared with local authorities without the consent of
Parents for funding purposes.
- To report on a Child’s
attendance.
- To be able to contact a
Parent or a Child’s emergency contact about their Child.
- To ensure nursery fees are
paid.
·
We will use the contact details you give us to
contact you via phone, email, social media, post, online portals or parent
applications, so that we can send you information about your child, our
settings, services, updates and other relevant news with your approved consent.
*
If
Parents fail to provide personal information
If
Parents fail to provide certain information when requested, we may not be able
to perform the respective contracts we have entered into with Parents, or we
may be prevented from complying with our respective legal obligations to
Children and Parents.
Change
of purpose
We
will only use your personal information for the purposes for which we collected
it, unless we reasonably consider that we need to use it for another reason and
that reason is compatible with the original purpose. If we need to use your
personal information for an unrelated purpose, we will notify you, as is
appropriate in the circumstances, and we will explain the legal basis which
allows us to do so.
Please
note that we may process a Child’s or a Parent’s personal information without
their respective knowledge or consent, as relevant to the circumstances, in
compliance with the above rules, where this is required or permitted by law.
How we use
particularly sensitive personal information
”Special
categories” of particularly sensitive personal information require higher
levels of protection. We need to have further justification for collecting,
storing and using this type of personal information. We have in place an
appropriate policy document and safeguards which we are required by law to
maintain when processing such data. We may process special categories of
personal information in the following circumstances:
1. In
limited circumstances, with Parent explicit written consent.
2. Where
we need to carry out our legal obligations or exercise rights in connection
with Employee employment.
3.
Where it is needed in the public
interest, such as for equal opportunities monitoring or in relation to our
occupational pension scheme. Less commonly, we may process this type of
information where it is needed in relation to legal claims or where it is
needed to protect an Employee, a Child or a Parents’ interests (or someone
else’s interests) and the Employee, Child or Parent as is appropriate is not
capable of giving consent, or where the Employee or Parent has already made the
information public.
Data Sharing
We may have to share Child or Parent data with
third parties, including third-party service providers.
We
require third parties to respect the security of your data and to treat it in accordance
with the law.
Why
might the setting share Child or Parent personal information with third
parties?
We
will share your personal information with third parties where required by law,
where it is necessary to administer the working relationship with you or where
we have another legitimate interest in doing so.
Which
third-party service providers process my personal information?
”Third parties” includes third-party
service providers (including contractors and designated agents), local
authorities, regulatory bodies, schools and other entities within our group.
The following third-party service providers process personal information about
you for the following purposes:
- Local Authorities –
for funding and monitoring reasons (e.g. equal opportunities and uptake of
funded hours).
- Regulatory bodies –
for ensuring compliance and the safety and welfare of the children.
- Schools – to provide a
successful transition by ensuring information about the child’s progress
and current level of development and interests are shared.
How
secure is my information with third-party service providers?
All
our third-party service providers and other entities in the group are required
to take appropriate security measures to protect your personal information in
line with our policies. We do not allow our third-party service providers to
use your personal data for their own purposes. We only permit them to process your
personal data for specified purposes and in accordance with our instructions.
When
might you share my personal information with others?
We
will share your personal information with other entities / third party
providers such as:
·
Ofsted – during an inspection or following a
complaint about our service
·
If legally required to do so
·
having
obtained your prior permission
·
To enforce or apply the terms and conditions of
your contract with us
·
To protect your child and other children; for
example, by sharing information with social care or law enforcement agencies eg
the police;
·
It is necessary to protect our/or others rights,
property or safety
·
Banking services to process chip and pin and/or
direct debit payments (as applicable)
·
The Local Authority (where you claim for
childcare funding)
·
The government’s eligibility checker (as above)
·
Our insurance underwriter (if applicable)
·
Our setting software provider(s) who process
data on our behalf which includes Connect Childcare and KidsClubHQ online booking
systems, Barclays Bank, SharePoint, our web hosting company, employment voucher
scheme companies, mailchimp for campaigns. These providers are required for our
registration, bookings, invoicing and payment/ funding processes.
·
The school that your child will be attending for
transitions.
·
For our Sitters service, where we act in a
broker capacity, we share your details with the baby sitter pool to identify a
sitter that meets your timing requirements.
We will never share your data
with any other organisation to use for their own purposes.
What
about other third parties?
We may
share your personal information with other third parties, for example in the
context of the possible sale or restructuring of the business. In this
situation we will, so far as possible, share anonymised data with the other
parties before the transaction completes. Once the transaction is completed, we
will share Your personal data with the other parties if and to the extent
required under the terms of the transaction.
We may
also need to share your personal information with a regulator or to otherwise
comply with the law for example, by law, by a court or the Charity
Commission
Data Retention
How
long will you use my information for?
We
will only retain your personal information for as long as necessary to fulfil
the purposes we collected it for, including for the purposes of satisfying any
legal, accounting, or reporting requirements. Details of retention periods for
different aspects of your personal information are available in our retention
policy which is available from our head office, see address below. To determine
the appropriate retention period for personal data, we consider the amount,
nature, and sensitivity of the personal data, the potential risk of harm from
unauthorised use or disclosure of your personal data, the purposes for which we
process your personal data and whether we can achieve those purposes through
other means, and the applicable legal requirements.
In
some circumstances we may anonymise your personal information so that it can no
longer be associated with you, in which case we may use such information without
further notice to you. Once you are no longer a Child benefiting from The Gap
Club’s services or a Parent, as is appropriate, we will retain and securely
destroy your personal information in accordance with applicable laws and
regulations.
Rights of access, corrections, erasure
and restriction.
Your
duty to inform us of changes
It is
important that the personal information we hold about you is accurate and current.
Please keep us informed if your personal information changes during your
working relationship with us.
Your
rights in connection with personal information
Under
certain circumstances, by law You have the right to:
- Request access to your personal information (commonly known as a “data subject access
request”). This enables you to receive a copy of the personal information
we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you
to have any incomplete or inaccurate information we hold about you
corrected.
- Request erasure of your personal information. This enables Employees or Parents to
ask us to delete or remove personal information where there is no good
reason for us continuing to process it. You also have the right to ask us
to delete or remove your personal information where you have exercised your
right to object to processing (see below). Please note: we will not be able to continue to care for your
child if we do not have sufficient information about them and even after
your child has left our care, we have a statutory duty to retain some
types of data for specific periods of time (see data retention ) so we
can’t delete everything immediately. Data that is no longer required is
erased as soon as possible after your child has ceased attending our
settings and stopped use of our services.
- Object to
processing of your personal information
where we are relying on a legitimate interest (or those of a third party)
and there is something about your particular situation which makes you
want to object to processing on this ground. You also have the right to object where we are processing your
personal information for direct marketing purposes without consent.
- Request the restriction of
processing of your personal information. This
enables Employees or Parents, as is appropriate, to ask us to suspend the
processing of personal information about you for example if you want us to
establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
·
If You want to review, verify, correct
or request erasure of your personal information, object to the processing of your
personal data, or request that we transfer a copy of your personal information
to another party, please contact The Gap Club in writing at the address below.
No fee
usually required
You
will not have to pay a fee to access your personal information (or to exercise
any of the other rights).
What
we may need from You
We may
need to request specific information from you to help us confirm your identity
and ensure your right to access the information (or to exercise any of your
other rights). This is another appropriate security measure to ensure that
personal information is not disclosed to any person who has no right to receive
it.
Right to withdraw consent
In the limited circumstances
where you may have provided your consent to the collection, processing and
transfer of your personal information for a specific purpose, you have the
right to withdraw your consent for that specific processing at any time. To
withdraw your consent, please contact the address below. Once we have received
notification that you have withdrawn your consent, we will no longer process your
information for the purpose or purposes you originally agreed to, unless we
have another legitimate basis for doing so in law.
Your Rights
If you wish to exercise any of
these rights at any time or if you have any questions, comments or concerns
about this privacy notice, or how we handle your data please send a letter of
your request to our office address:
The Gap Club Ltd
1B Lyndwood Parade, St Lukes
Road, Old Windsor.
WINDSOR, Berkshire. SL4 2QX.
Stating your request, child name,
your name, your email and address and contact details. We
will respond to all such requests within one month.
If you continue to have concerns
about the way your data is handled and remain dissatisfied after raising your concern
with us, you have the right to complain to the Information Commissioner Office
(ICO). The ICO can be contacted at Information Commissioner’s Office, Wycliffe
House, Water Lane, Wilmslow, Cheshire, SK9 5AF or ico.org.uk
*Consents
Where we need to use personal data for marketing related type purposes
and not for delivering the childcare service, consent will be requested from
parents, and we will only use the data solely for the purpose in question if
consent has been provided.
The purposes for which the lawful basis of consent are required are on
the registration forms (online or paper), and include:
·
Still
and moving images (i.e. photographs and video footage) within the setting will
only be taken by the setting’s staff and only following written parental
consent for the child/ren being photographed.
· It is likely that there will be occasions
during a child’s time at the setting when staff may wish to photograph or video
children as part of an observation or to record an achievement to show their
parent/carer.
·
We will
not use the personal details or full name (first name and surname) of any child
in a photographic image on its website or in any other printed material without
consent.
·
Generally,
images of children will not have an accompanying name in the text or caption;
if a name is used in the text, the setting will not use an image of that
individual unless specific permission has been granted.
·
No
images of children will be released to press or media contacts without the
relevant written parental consent.
·
Cookies
are often used on website to improve customer experience of the website,
parents can choose to enable cookies or otherwise on the website, but this may
sometimes cause certain features to not appear as expected.
Data Security
How we protect your data
We protect unauthorised access to
your personal data and prevent it from being lost, accidentally destroyed,
misused, or disclosed by various methods including:
·
Paper documentations are held in lockable
cupboards/cabinets at our settings/Head office as needed.
·
Our software providers that are cloud based,
provide user based secure access to the registration and booking systems with
password and user authentication methods.
·
Excel is used for some reporting monitoring of
debt, which when distributed is password locked.
·
All communications with electronic documents are
managed securely by the software providers or using secure encrypted email.
·
Paper Registers for sign-in/out/collection are
transmitted by Our Staff to Head Office on a periodic basis by authorised Gap
Club staff.
·
Our laptops/phone/tablet devices are password
protected with encryption key software.
·
We
ensure that access to children’s files is restricted to those authorised and
needing to see them and make entries in them, this being, the supervisor,
deputy or designated person, the child’s key person, or other staff as
authorised by the supervisor and booking team for purpose of ensuring our
service to parents is delivered and paid for as agreed.
Data & image security:
·
Information and records held on children is kept
in secure locked location and cabinets.
·
Restricted documents must not be taken from the
setting without agreement for transport and storage. They must not be left
unattended in cars or opened on public transport.
·
All paper-based files containing personal and or
sensitive information that have exceeded their retention period should be
returned to head office for shredding. Such documentation is shredded by an
authorised company with supporting waste transfer notes.
·
All electronic personal and/or sensitive
information including still and moving images is held on a password protected
computers accessed by authorised personnel.
·
When not in use, computers/devices are stored in
a safe or locked cupboard/cabinet. The computer must not leave the setting’s
premises. We adhere to a clear desk and clear screen policy
·
Images will be stored directly on the computer
and deleted from the device that captured or recorded them originally.
Automated
decision-making
We do not make any decisions
about your child based solely on automated decision-making, as we believe each
child is unique. We do use analytics on segmented data to help analyse and
understand childcare service trends, so we can offer relevant services to you.
Changes to this privacy notice
We reserve the right to update this privacy
notice at any time, and we will provide You with a new privacy notice when we
make any substantial updates. We may also notify You in other ways from time
to time about the processing of your personal information.