Data Protection Policy

 

 

Pals works in accordance with all relevant legislation including the General Data Protection Regulations.

General Data Protection Regulations state that personal data should be ‘processed fairly & lawfully’ and ‘collected for specified, explicit and legitimate purposes’ and that individuals data is not processed without their knowledge and are only processed with their ‘explicit’ consent.

Pals is committed to protecting the rights and freedoms of individuals with respect to the processing of children's, parents, visitors and staff personal data. Under GPDR individuals have the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.

Pals is registered with the Information Commissioners

GDPR includes 7 rights for individuals

1)      THE RIGHT TO BE INFORMED

Pals Christ Church is a registered Childcare provider with Ofsted and as so, is required to collect and manage certain data. We need to know parent’s names, addresses, telephone numbers, email addresses, date of birth and National Insurance numbers. We need to know children’s’ full names, addresses, date of birth and Birth Certificate number. For parents claiming the free nursery entitlement we are requested to provide this data to Bromley Council; this information is sent to the Local Authority via a secure electronic file transfer system. We are required to collect certain details of visitors to our pre-schools. We need to know visitors names and where appropriate company name. This is in respect of our Health and Safety and Safeguarding Policies. As an employer Pals Christ Church is required to hold data on its employees; names, addresses, email addresses, telephone numbers, date of birth, National Insurance numbers, photographic ID such as passport and driver’s license, bank details. This information is also required for Disclosure and Barring Service checks (DBS) and proof of eligibility to work in the UK.

2) THE RIGHT OF ACCESS

At any point an individual can make a request relating to their data and we will need to provide a response within 1 month. We can refuse a request if we have a lawful obligation to retain data i.e. from Ofsted in relation to the EYFS, but we will inform the individual of the reasons for the rejection. The individual will have the right to complain to the ICO if they are not happy with the decision.

3) THE RIGHT TO ERASURE

You have the right to request the deletion of your data where there is no compelling reason for its continued use. However Pals has a legal duty to keep childrens and parents details for a reasonable time. Pals retain copies of childrens tracking and progress records for 3 years after they leave pre-school, registers for 6 years in accordance with the Local Authority funding requests. Children's accident and injury records are kept for 19 years (or until the child reaches 21 years), and Child Protection Records are kept for 22 years (or until the child reaches 24 years). Staff records must be kept for 6 years after the member of leaves employment, before they can be erased. This data is archived securely offsite and shredded after the legal retention period. There is a full Risk Assessment in place for transportation and storage.

4) THE RIGHT TO RESTRICT PROCESSING

Parents, visitors and staff can object to Pals processing their data. This means that records can be stored but must not be used in any way, for example reports or for communications.

5) THE RIGHT TO DATA PORTABILITY

Pals Christ Church requires data to be transferred from one IT system to another; such as to the Local Authority or to shared settings. These recipients use secure file transfer systems and have their own policies and procedures in place in relation to GDPR.

6) THE RIGHT TO OBJECT

Should Pals use Data for non necessary reasons such as marketing or research parents, visitors and staff can object to their data being used for such purposes.

7) THE RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISION-MAKING INCLUDING PROFILING

Automated decisions and profiling are used for marketing based organisations. Pals does not use personal data for such purposes.

STORAGE AND USE OF PERSONAL INFORMATION

Whilst on site paper copies of children's and staff records are kept in a filing cabinet in a locked storage room. Certain Data is stored at the pre-schools registered office at Teresa’s home. All such data is kept securely either in a filing cabinet or password protected if on a computer. We do have permission from Ofsted for staff to take childrens records home for administration purposes but if this occurs then they stored securely at all times and for transportation all personal data is removed from the records. These records are shredded after the retention period. Information about individual children is used in certain documents, such as, a weekly register, medication forms, referrals to external agencies and disclosure forms. These documents include data such as children's names, date of birth and sometimes address. These records are shredded after the relevant retention period

Pals collects a large amount of personal data every year including; names and addresses of those on the waiting list. These records are shredded if the child does not attend or added to the child’s file and stored appropriately. Information regarding families’ involvement with other agencies is stored both electronically (password protected) and in paper format, this information is kept in a filing cabinet in a locked storage room. These records are shredded after the relevant retention period. When a child moves onto school or another setting data held on the child may be shared with the receiving school. Such information will be passed on via secure email or by Pals Staff in person wherever possible. Failing this then the parent will be given the data to pass on or it will be sent via the post with parental permission. Pals stores photographs both in the children’s records and occasionally these are used to enhance our learning objectives. On the rare occasion that a child could be identified by a photograph on our website parental permission will always be obtained.

Any portable data storage used to store personal data, e.g. USB memory stick, are password protected and/or stored in a locked filing cabinet.

We have copies of the Pre-School Learning Alliance documentation on retention periods for records available for parents should you wish.