Privacy Policy
At The
Gap Club Ltd, we respect the privacy and security of personal information of our
Parents, Carers and the children attending our settings or using our Sitters
service. The personal information that we collect and use relating to you, your
child and other contacts is used only to provide appropriate care for your child(ren),
maintain our service to you, and communicate with you effectively. Our legal
basis for processing the personal information relating to you and your child is
so that we can fulfil our contract with you in a safe and effective manner
under the childcare regulations.
The Gap Club is a “data
controller”, with data protection number ZA114355. This means that we are
responsible for deciding how we hold and use personal information about You. We
are required under data protection legislation to notify You of the information
contained in this privacy notice.
This notice applies to Employees,
Children and Parents. This notice does not form part of any contract of
employment or other contract to provide services. We may update this notice at
any time but if we do so, we will provide You with an updated copy of this
notice as soon as reasonably practical.
It is important that Children and
Parents read and retain this notice, together with any other privacy notice we
may provide on specific occasions when we are collecting or processing personal
information about You, so that You are aware of how and why we are using such
information and what Your rights are under the data protection legislation.
Data Protection Legislation
We will comply with data protection law. This says that the personal
information we hold about You must be:
1. Used lawfully,
fairly and in a transparent way.
2. Collected only
for valid purposes that we have clearly explained to You and not used in any
way that is incompatible with those purposes.
3. Relevant to the
purposes we have told You about and limited only to those purposes.
4. Accurate and
kept up to date.
5. Kept only as
long as necessary for the purposes we have told You about.
6.
Kept securely.
An overview of the type of information we hold about
you:
Personal data, or personal information, means any information about an
individual from which that person can be identified. It does not include data
where the identity has been removed (anonymous data).
There are “special categories” of more sensitive personal data which
require a higher level of protection, such as information about a person’s
health or sexual orientation.
Personal Data we collect includes:
We collect
personal information about Children and Parents from when the initial enquiry
is made by the Parents, through the enrolment process and until the Children
stop using the settings. We collect
personal data about you and your child to provide care and learning that is
tailored to meet your child’s individual needs.
We also collect information to
verify your eligibility for free childcare as applicable.
Personal details that we
collect about your child include:
·
Your child’s name,
date of birth, school attended, attendance information, home address, health, medical,
dietary needs, development needs, and any additional educational support needs,
parent & guardian contact details and emergency contact details
·
Where applicable
we will require you to provide or obtain records relating to individual
children eg child protection plans from social services, care and health care plans
from health professionals
·
We will also ask
for information about who has parental responsibility for your child and any
court orders pertaining to your child.
·
We may also collect,
store and use the following “special categories” of more sensitive personal
information:
o Information
about a Child’s race or ethnicity, spoken language and nationality.
o Information
about a Child’s health, including any medical condition, health and sickness
records.
o Information
about a Child’s accident or incident reports including reports of pre-existing
injuries.
o
Information about a Child’s incident forms / child
protection referral forms / child protection case details / reports.
Personal details that we
collect about you include:
·
Your name, home
and work address, phone numbers, emergency contact details, and family details.
·
Personal name,
contact details for emergency contacts or collectors
·
This information
will be collected from you directly in the registration/booking process.
·
If you apply for 15
or 30 hours free childcare or FEET funding, we will also collect:
o
Your national
insurance number or unique taxpayer reference (UTR), if you’re self-employed.
o
We may also
collect information regarding benefits and family credits that you are in
receipt of.
·
For payment of our
services, we will also collect bank/card/voucher payment method details to
allow monies to be collected and continuity of service.
·
We may
also collect, store and use the
following “special categories” of more sensitive personal information:
·
Information about a Parent’s race or
ethnicity, spoken language and nationality.
·
Conversations with Parents where staff of the setting
deem it relevant to the prevention of radicalisation or other aspects of the governments Prevent strategy.
Additionally, and in
accordance with our policies and procedures, the following personal data
records and information will also be used,
stored and maintained for the settings:
·
An up to date
record of all the staff, students and volunteers who work at the setting,
including their name; address; telephone number; DBS check status; references;
employment details and any other information (such as their Personal
Development Plan) accrued during their time spent working at the setting.
·
A record of any
other individuals who reside at, or regularly visit/spend time at the setting,
including their contact details.
·
Records of the
activities planned and implemented by the setting, including any off-site
visits and outings permissions.
·
Records of any
medication being held by staff on behalf of children, along with the authorised
Administration of Medication Forms, in accordance with the Health, Illness and
Emergency policy.
·
Records of
parental authorisation permitting staff to consent to emergency treatment for
children (in accordance with the Health, Illness and Emergency policy).
·
An inventory of
equipment owned or used by the setting, such as laptops, tablet devices, including
safety checks and repairs carried out, (in accordance with the Equipment
policy).
·
Accident and pre-existing
injuries forms.
·
Records of any reportable death, injury, disease or
dangerous occurrence
·
Observation, planning and assessment records of
Children
·
Photographs and video clips of the Child to for
general display purposes
·
Record book for each Child containing the work of
the Child whilst at the Pre-school and after school and holiday club settings,
observations about the Child’s development whilst at the settings from staff, specific
examples of the Child’s progress, photographs demonstrating the Child’s
development whilst at the settings, and personal details of the Child (e.g.
their date of birth) (“Progress Report”)
The setting supervisor has
overall responsibility for the maintenance and updating of children's records
and ensuring that they are accurate and secure when at settings.
How we will use Information about you
We will only use Your personal information when the law allows us to.
Most commonly, we will use Your personal information in the following
circumstances:
1. Where we need to
perform the contract we have entered with You.
2. Where we need to
comply with a legal obligation. * See Consents
3. Where it is
necessary for our legitimate interests (or those of a third party) and Your
interests and fundamental rights do not override those interests.
We may also use Your personal information in the following situations,
which are likely to be rare:
1. Where we need to
protect Your interests (or someone else’s interests).
2. Where it is needed in the public interest
or for official purposes.
Why we collect this information and the legal
basis for handling and using your data
For Children
We need all the categories of information mentioned above primarily to
allow us to perform our obligations (including our legal obligations to
Children). The situations in which we will process personal information of
Children are listed below.
·
Upon consent from the Parents, Personal
Data of Children will be shared with schools for progression into the next
stage of their education.
·
Personal information of Children will
be shared with local authorities without the consent of Parents where there is
a situation where child protection is necessary.
·
The personal information of Children
will be shared with local authorities without the consent of Parents for
funding purposes.
·
Ofsted will be allowed access to the
settings systems to review child protection records.
·
To ensure we meet the needs of the
Children eg to contact you in an emergency, care and learning
·
To enable the appropriate funding to be
received
·
Report on a Child’s progress and
wellbeing including any health, medical or dietary needs and their treatments authorised
whilst with the setting
·
To check safeguarding records
·
To check complaint records
·
To check attendance patterns are
recorded
·
When a Child’s
Progress Report is given to its Parent in order for that Parent to pass the
same Progress Report to a school for application or enrolment purposes
·
To
ensure your child is able to enjoy the full service of our childcare facility
in accordance with your specific consents and permissions.
For Parents
We need all the categories of information mentioned above primarily to
allow us to perform our contracts with Parents and to enable us to comply with
legal obligations. The situations in which we will process personal information
of Parents are listed below.
·
The personal information of Parents
will be shared with local authorities without the consent of Parents for
funding purposes.
·
To report on a Child’s attendance
·
To be able to contact a Parent or a
Child’s emergency contact about their Child
·
To ensure nursery fees are paid
We will use the
contact details you give us to contact you via phone, email, social media,
post, online portals or parent applications, so that we can send you
information about your child, our settings, services and other relevant news
with your approved consent *
If Parents fail to provide
personal information
If Parents fail to provide
certain information when requested, we may not be able to perform the
respective contracts we have entered into with Parents, or we may be prevented
from complying with our respective legal obligations to Children and Parents.
Change of purpose
We will only use Your personal
information for the purposes for which we collected it, unless we reasonably
consider that we need to use it for another reason and that reason is
compatible with the original purpose. If we need to use Your personal information
for an unrelated purpose, we will notify you, as is appropriate in the
circumstances, and we will explain the legal basis which allows us to do so.
Please note that we may process a
Child’s or a Parent’s personal information without their respective knowledge
or consent, as relevant to the circumstances, in compliance with the above
rules, where this is required or permitted by law.
How we use particularly sensitive
personal information
”Special categories” of particularly
sensitive personal information require higher levels of protection. We need to
have further justification for collecting, storing and using this type of
personal information. We have in place an appropriate policy document and
safeguards which we are required by law to maintain when processing such data.
We may process special categories of personal information in the following
circumstances:
1. In limited
circumstances, with Parent explicit written consent.
2. Where we need to
carry out our legal obligations or exercise rights in connection with Employee
employment.
3.
Where it is needed in the public interest, such as
for equal opportunities monitoring or in relation to our occupational pension
scheme. Less commonly, we may process this type of information where it is
needed in relation to legal claims or where it is needed to protect an
Employee, a Child or a Parents’ interests (or someone else’s interests) and the
Employee, Child or Parent as is appropriate is not capable of giving consent,
or where the Employee or Parent has already made the information public.
Data
Sharing
We may have to share Child or Parent data with third parties, including
third-party service providers and other entities in the group.
We require third parties to
respect the security of Your data and to treat it in accordance with the law
Why might the setting share Child
or Parent personal information with third parties?
We will share Your personal
information with third parties where required by law, where it is necessary to
administer the working relationship with You or where we have another
legitimate interest in doing so.
Which third-party service
providers process my personal information?
”Third parties”
includes third-party service providers (including contractors and designated
agents), local authorities, regulatory bodies, schools and other entities
within our group. The following third-party service providers process personal
information about you for the following purposes:
·
Local Authorities – for funding and
monitoring reasons (e.g. equal opportunities and uptake of funded hours)
·
Regulatory bodies – for ensuring
compliance and the safety and welfare of the children
·
Schools – to provide a successful
transition by ensuring information about the child’s progress and current level
of development and interests are shared
How secure is my information with
third-party service providers and other entities in our group?
All our third-party service
providers and other entities in the group are required to take appropriate
security measures to protect Your personal information in line with our
policies. We do not allow our third-party service providers to use Your personal
data for their own purposes. We only permit them to process Your personal data
for specified purposes and in accordance with our instructions.
When might you share my personal
information with others?
We will share Your personal
information with other entities / third party providers such as:
·
Ofsted – during an
inspection or following a complaint about our service
·
If legally
required to do so
·
have obtained your prior permission
·
To enforce or
apply the terms and conditions of your contract with us;
·
To protect your
child and other children; for example, by sharing information with social care
or law enforcement agencies eg the police;
·
It is necessary to
protect our/or others rights, property or safety
·
Banking services
to process chip and pin and/or direct debit payments (as applicable)
·
The Local
Authority (where you claim for childcare funding)
·
The government’s
eligibility checker (as above)
·
Our insurance
underwriter (if applicable)
·
Our setting
software provider(s) who process data on our behalf which includes Connect
Childcare and KidsClubHQ online booking systems, Barclays Bank, SharePoint, our
web hosting company, employment voucher scheme companies, Our accountant and
Xero system for financial management, KidsClubHQ Pay and Unipaas for processing
payments. These providers are required for our registration, bookings,
invoicing and payment/ funding processes.
·
The school that
your child will be attending
·
For our Sitters
service, where we act in a broker capacity, we share your details with the baby
sitter pool to identify a sitter that meets your timing requirements
We will never share your data
with any other organisation to use for their own purposes.
What about other third parties?
We may share Your personal
information with other third parties, for example in the context of the
possible sale or restructuring of the business. In this situation we will, so
far as possible, share anonymised data with the other parties before the transaction
completes. Once the transaction is completed, we will share Your personal data
with the other parties if and to the extent required under the terms of the
transaction.
We may also need to share Your
personal information with a regulator or to otherwise comply with the law for example, by law, by a court or the Charity
Commission
Data
Retention
How long will you use my
information for?
We will only retain Your personal
information for as long as necessary to fulfil the purposes we collected it
for, including for the purposes of satisfying any legal, accounting, or
reporting requirements. Details of retention periods for different aspects of
your personal information are available in our retention policy which is
available from the manager. To determine the appropriate retention period for
personal data, we consider the amount, nature, and sensitivity of the personal
data, the potential risk of harm from unauthorised use or disclosure of Your
personal data, the purposes for which we process Your personal data and whether
we can achieve those purposes through other means, and the applicable legal
requirements.
In some circumstances we may
anonymise Your personal information so that it can no longer be associated with
You, in which case we may use such information without further notice to You.
Once you are no longer a Child benefiting from The Gap Club’s services or a
Parent, as is appropriate, we will retain and securely destroy your personal
information in accordance with applicable laws and regulations.
Rights of
access, correction, erasure and restriction
Your duty to inform us of changes
It is important that the personal
information we hold about You is accurate and current. Please keep us informed
if your personal information changes during your working relationship with us.
Your rights in connection with
personal information
Under certain circumstances, by
law You have the right to:
·
Request access to Your personal information (commonly known as a “data subject access
request”). This enables You to receive a copy of the personal information we
hold about You and to check that we are lawfully processing it.
·
Request correction of the personal information that we hold about You. This enables You to
have any incomplete or inaccurate information we hold about You corrected.
·
Request erasure of your personal information. This enables Employees or Parents to ask
us to delete or remove personal information where there is no good reason for
us continuing to process it. You also have the right to ask us to delete or
remove Your personal information where You have exercised Your right to object
to processing (see below). Please note
o
we will not be
able to continue to care for your child if we do not have sufficient
information about them
o
even after your
child has left our care, we have a statutory duty to retain some types of data
for specific periods of time (see data retention ) so we can’t delete
everything immediately.
o
Data that is no
longer required is erased as soon as possible after your child has ceased
attending our settings and stopped use of our services.
·
Object to processing of Your personal information where we are relying on a legitimate
interest (or those of a third party) and there is something about Your
particular situation which makes You want to object to processing on this
ground. You also have the right to object where we are processing Your personal
information for direct marketing purposes.
·
Request the restriction of processing of Your personal information. This enables
Employees or Parents, as is appropriate, to ask us to suspend the processing of
personal information about You for example if You want us to establish its
accuracy or the reason for processing it.
·
Request the transfer of Your personal
information to another party.
If you want to review, verify, correct
or request erasure of your personal information, object to the processing of your
personal data, or request that we transfer a copy of your personal information
to another party, please contact the manager in writing.
No fee usually
required
Usually you will
not have to pay a fee to access Your personal information (or to exercise any
of the other rights).
What we may need from You
We may need to request specific
information from You to help us confirm your identity and ensure Your right to
access the information (or to exercise any of Your other rights). This is
another appropriate security measure to ensure that personal information is not
disclosed to any person who has no right to receive it.
Right
to withdraw consent
In the limited circumstances where You may have provided Your consent to
the collection, processing and transfer of Your personal information for a
specific purpose, You have the right to withdraw Your consent for that specific
processing at any time. To withdraw Your consent, please contact the address
below. Once we have received notification that You have withdrawn Your consent,
we will no longer process Your information for the purpose or purposes You
originally agreed to, unless we have another legitimate basis for doing so in
law.
Your
Rights
If you wish to exercise any of
these rights at any time or if you have any questions, comments or concerns
about this privacy notice, or how we handle your data please send a letter of
your request to our office address:
The Gap Club Ltd
1B Lyndwood Parade, St Lukes
Road, Old Windsor.
WINDSOR, Berkshire. SL4 2QX.
Stating your request, child
name, your name, your email/ address and contact details. We will respond to all such requests within one
month.
If you wish to exercise your rights, please request our subject access
request policy, on how the rights can be exercised.
If you continue to have concerns about the way your data is handled and
remain dissatisfied after raising your concern with us, you have the right to
complain to the Information Commissioner Office (ICO). The ICO can be contacted
at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF or ico.org.uk
*Consents
Where
we need to use personal data for marketing related type purposes and not for
delivering the childcare service, consent will be requested from parents, and
we will only use the data solely for the purpose in question if consent has
been provided.
The
purposes for which consent are required are on the registration forms (online
or paper), and include
·
Still and moving
images (i.e. photographs and video footage) within the setting will only be
taken by the setting’s staff and only following written parental consent for
the child/ren being photographed.
·
It is likely that
there will be occasions during a child’s time at the setting when staff may
wish to photograph or video children as part of an observation or to record an
achievement to show their parent/carer.
·
We will not use
the personal details or full name (first name and surname) of any child in a
photographic image on its website or in any other printed material without
consent.
·
Generally, images
of children will not have an accompanying name in the text or caption; if a
name is used in the text, the setting will not use an image of that individual
unless specific permission has been granted.
·
No images of
children will be released to press or media contacts without the relevant
written parental consent.
·
Cookies are often
used on website to improve customer experience of the website, parents can
choose to enable cookies or otherwise on the website, but this may sometimes
cause certain features to not appear as expected.
Data Security
How
we protect your data
We protect unauthorised access
to your personal data and prevent it from being lost, accidentally destroyed,
misused, or disclosed by various methods including:
·
Paper
documentations are held in lockable cupboards/cabinets at our settings/Head office
as needed
·
Our software
providers that are cloud based, provide user based secure access to the
registration and booking systems with password and user authentication methods
·
Excel is used for
some reporting monitoring of debt, which when distributed will be password
locked
·
All communications
with electronic documents are managed securely by the software providers or
using secure encrypted email.
·
Paper Registers
for sign-in/out/collection are transmitted by Our Staff to Head Office on a
periodic basis by authorise Gap Club staff.
·
Our
laptops/phone/tablet devices are password protected with encryption key
software
·
We ensure that
access to children’s files is restricted to those authorised and needing to see
them and make entries in them, this being, the supervisor, deputy or designated
person, the child’s key person, or other staff as authorised by the supervisor and
booking team for purpose of ensuring our service to parents is delivered and
paid for as agreed.
Data & image security:
·
Information and records
held on children is kept in secure locked location and cabinets
·
Restricted
documents must not be taken from the setting without agreement for transport
and storage. They must not be left unattended in cars or opened on public
transport.
·
All paper-based
files containing personal and or sensitive information that have exceeded their
retention period should be returned to head office for shredding. Such
documentation is shredded by an authorised company with supporting waste
transfer notes.
·
All electronic
personal and/or sensitive information including still and moving images is held
on a password protected computers accessed by authorised personell.
·
When not in use,
computers/devices are stored in a safe or locked cupboard/cabinet. The computer
must not leave the setting’s premises. We adhere to a clear desk and clear
screen policy
·
Images will be
stored directly on the computer and deleted from the device that captured or
recorded them originally.
Automated decision-making
We do not make any decisions
about your child based solely on automated decision-making, as we believe each
child is unique. We do use analytics on segmented data to help analyse and
understand childcare service trends, so we can offer relevant services to you.
Changes
to this privacy notice
We reserve the right to update this privacy notice at any time, and we
will provide You with a new privacy notice when we make any substantial
updates. We may also notify You in other ways from time to time about the
processing of your personal information.
