Abacus Children’s Services Trading as Bright Beginnings Community Nursery
PRIVACY NOTICE 2018
At Bright Beginnings we’re committed to protecting and respecting your privacy.
This Notice explains when and why we collect personal information about employees, children and parents, how we use it, the conditions under which we may disclose it to others and how we keep it secure.
We may change this Notice from time to time. The Data Protection Officer (the Nursery Manager) will alert you to any changes. Please consider these changes to ensure that you’re happy with them.
Any questions regarding this Notice and our privacy practices should be addressed to the Data Protection Officer. Alternatively, you may contact the Data Protection Officer by telephoning 0161 483 3500, emailing firstname.lastname@example.org or writing to the Data Protection Officer, Bright Beginnings Community Nursery, 120 Garners Lane, Adswood, Stockport SK3 8QW.
WHO WE ARE
We’re Bright Beginnings Community Nursery, the trading arm of Abacus Children’s Services Limited, a company limited by guarantee (no. 06582751). The registered address of the company is Alpha House, 4 Greek Street, Stockport SK3 8AB. The nursery operates at 120 Garners Lane, Adswood, Stockport SK3 8QW.
HOW DO WE COLLECT INFORMATION FROM YOU?
We obtain information about you when you apply for a post at the nursery either as an employee or requesting a place for your child and when your child starts at the nursery or your employment at the nursery begins.
PRINCIPLES OF DATA PROCESSING
The Processing of your Personal data forms an important part of our nursery provision to you and your child and in your employment with Bright Beginnings. We appreciate the trust you place in us when providing us with your Personal data, and consider your privacy an essential part of the services we offer. In order to safeguard your Personal data while providing our services and employment, we adhere to the following five general principles.
FREEDOM OF CHOICE
Your Personal data belongs to you. We strive not to make any assumptions regarding your privacy preferences and aim to design our services so that you can choose whether or not to share your Personal data with us.
BALANCE OF INTERESTS
Where the Processing of your Personal data is necessary for the pursuit of a legitimate interest, and where this interest outweighs the need to protect your privacy, we may process certain Personal data without obtaining your express consent if so permitted by law. In certain other situations, we may also process your Personal data without your consent if so required in accordance with applicable law. For more information, see the “Consent” section below. Where your Personal data is processed for the public interest, we base that on the potential benefits to (including the safety of) our customers and the general public.
Bright Beginnings will only process its customers’ Personal data if it is adequate, relevant and necessary in relation to the purpose for which it has been gathered. We aim to anonymize your Personal data when a function or service can be achieved with anonymized data. If we combine anonymized or non-Personal data with your Personal data, it will be treated as Personal data for as long as it remains combined.
TRANSPARENCY AND SECURITY
Bright Beginnings believes in being transparent about which Personal data we process and for which purposes. To us it is also vital to protect your Personal data since one of Bright Beginnings’ core values is to protect what is important to you. On request, Bright Beginnings will provide customers with further information regarding our Processing and protection of your Personal data.
It is Bright Beginnings’ policy to comply with the applicable laws, rules and regulations governing privacy and data protection in the UK and European Union..
The Personal data which Bright Beginnings collects about you and/or your child will be used:
To provide you with a service, including to verify your eligibility for certain of our services.
To inform you of updates to, or changes in, services, including, but not limited to changes to our terms and conditions and policies;
To inform you of new services and events;
To evaluate and improve our offering to, and communication with customers;
To comply with legal requirements or lawful authority requests;
To inform you about our services and identify those that may be of interest to you;
To carry out market research; and
For analysis and customer profiling purposes (online and social included) done by ourselves and our chosen suppliers and partners.
Bright Beginnings uses the following definitions:
“Data controller” means a natural or legal person, public authority, institution or any other body which alone or jointly with others determines the purposes and means of the Processing of Personal data.
“Data processor” means a natural or legal person, public authority, institution or any other body which processes Personal data on behalf of the Data Controller.
“Personal data” means all information relating to an identified or identifiable physical person (“registered”). An identifiable physical person is a person who can be identified, directly or indirectly.
“Processing” means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, limitation, erasure or destruction.
“Sensitive Personal data” as Personal data that is likely to cause harm or particular concern to the data subject if disclosed. Examples of such data are: Specific Personal data categories (as defined below), credit card number and other financial information about the person registered, personal ID number and location details.
“Special categories of data” means Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
You may provide us with information about you or your family when accessing Bright Beginnings’ services for example through our websites or direct contact (in this context, please note that phone calls may be recorded, with your consent, for quality assurance purposes). We may also obtain such data from Central and local Government, HMRC, DBS and other third parties. Such data (“Customer-provided personal data”) may include:
Your contact information (name, address, telephone number, email address, etc.);
Demographic information (age, marital status, household composition, etc.);
Criminal Records, HMRC, Health records
We are particularly careful and apply additional measures if and when collecting and Processing Sensitive Personal data, as required by applicable law. For avoidance of doubt, it is noted that applicable law may require other kind of data to also be treated as Sensitive Personal data.
Where reasonably practical or as required by applicable law, we will, in collecting or registering your Personal data, provide you with (i) specific information as to the purposes of the Processing of your Personal data, (ii) the identity of the Data Controller, (iii) the identities of any third parties to whom the data may be disclosed and (iv) other information which may be necessary to ensure that you are able to safeguard your rights. The above information may, for example, be provided when you register an interest in your child joining our nursery.
Where reasonably practical or as required by applicable law, we will obtain your consent prior to collecting or using your Personal data. The request for your consent will be clear and specific and provide you with a reasonable basis with which to make your decision. We will never take your consent for granted. Instead, we will make sure that you can actively consent in a clear and transparent manner. Your consent is voluntary and may always be revoked, for example by terminating a particular service or contacting Bright Beginnings at the address indicated in the “Information and Access” section below. If you do not give your consent, it may not be possible to use our services or parts of services.
COLLECTION AND PROCESSING OF PERSONAL DATA WITHOUT CONSENT
The collection and use Third party data may be necessary in order for (i) Compliance with legislation (ii) Bright Beginnings service development, for example enhancements of the child safety, (iii) managing Bright Beginnings’ duty of care and (iv) fulfilment of legal requirements. When collecting or using third party data for these purposes, and for similar legitimate interests pursued by Bright Beginnings, we will generally not seek your consent unless this is deemed necessary in the individual case or required by applicable law.
THIRD PARTY APPLICATIONS
You may access applications and other services linked with Bright Beginnings but provided by a third party, which may, for example Facebook, may require transmission of location data and other data to this third party. Bright Beginnings is not responsible for the collection or use of Personal data in applications or services provided by a third party, and recommends that you carefully review applicable terms for (and any integrity policy related to) such applications or services before you use them. If you have questions concerning a certain third party’s use of your Personal data, please contact the third party directly.
For most Processing acts, you are able to terminate our use of your Personal data by updating your preferences, terminating a particular service, revoking your consent to the Processing by contacting Bright Beginnings at the address indicated in the “Information and Access” section below or as otherwise instructed by us. However, and unless otherwise follows from applicable law, you may generally not opt out of the Processing of your Personal data:
We will only retain your Personal data for as long as it is necessary to fulfil the purposes outlined in this policy or the purposes of which you have otherwise been informed. This means that when you have consented to our Processing of your Personal data, we will retain the data for as long as the customer relationship lasts (and, where applicable, until the legal timescale, 21 years in Childcare, generally 7 years for other information) or until you withdraw your consent. If you have revoked your consent, we may nevertheless retain certain Personal data for the period required in order for us to meet our legal obligations and defend ourselves in legal disputes. If we have not received your consent for Processing, the data will only be retained to the extent we are permitted to do so by law.
When we process your Personal data, we strive to ensure that it is correct and up to date. We attempt to delete or correct Personal data that is incorrect or incomplete. For more information regarding your right to ensure the accuracy of your Personal data held by us, please see the “Information and Access” section below.
INFORMATION AND ACCESS
As stated in the “Notice” section above, we may provide you with specific information concerning our Processing of your Personal data when collecting or registering such data. Once per year you have the right to request, and receive free of charge, information on (i) what Personal data relating to you that we process, (ii) where the Personal data is collected, (iii) the purpose of the Processing, and (iv) the recipients or recipient categories with which the Personal data is shared. Requests for such information must be made in writing and be signed by you personally, and include information on the name, address and ideally the email address as well. You are also entitled to request that we correct, block or delete any incorrect information related to you. Requests should be sent to the legal entity stipulated in the end of this document. Your requests will be dealt with in a prompt and proper manner. Requests to delete Personal data will be subject to any applicable legal requirements. Where the applicable law provides for an administrative fee for complying with such a request, such a fee may be charged by Bright Beginnings.
Bright Beginnings has taken technical and organisational measures in order to protect your Personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other unlawful forms of Processing.
DISCLOSURES TO THIRD PARTIES
Bright Beginnings may share your Personal data:
Among any future Bright Beginnings settings
In connection with the sale or transfer of a Bright Beginnings entity or its assets;
As required by law, for example in connection with a safeguarding inquiry, dispute or other legal process or request
When we, in good faith, believe that disclosure is necessary in order to protect our rights, for example in order to investigate potential violations of our terms and conditions or to detect, prevent or disclose fraud or other security issues
With our service providers who work on our behalf in connection with the above uses, such as wireless service providers, companies that host or operate our website, send communications, perform data analytics, credit card processors, or system providers necessary to process, store, or manage credit card or financial information; and
With emergency services providers, such as law enforcement, and health care professionals, Social services, in order to deliver related services and legal obligations.
Bright Beginnings, as the legal entity being the data controller of your Personal data will, as a general rule, only disclose your Personal data to a third party if it has received your consent to do so. However, if permitted by law we may share your Personal data without your consent, unless we consider your consent necessary in the individual case or your consent is required by law, in the following situations:
Situations in which disclosure is required by law; and
Situations in which disclosure is necessary for the purpose of a legitimate interest pursued by Bright Beginnings (for example in order to protect our legal rights, as described above).
DATA PROCESSING ON OUR BEHALF
We restrict access to your Personal data to Bright Beginnings’ employees and suppliers who need to use the information in order to process it on our behalf, and who are contractually required to keep your Personal data secure and confidential. We aim to choose the option for data processing services that best safeguards the integrity of your Personal data towards any third party.
We will not sell or trade your Personal data with third parties, unless we have your consent to do so. We will not share your Personal data with third parties for their marketing purposes, unless we have received your consent for such disclosures. If you have provided such consent, but wish to stop receiving marketing materials from a third party, please contact that third party directly. We may provide you with information regarding new products, services, events or similar marketing activities. If you wish to unsubscribe to a particular e-mail newsletter or similar communication, please follow the instructions in the relevant communication.
WEBSITES AND COOKIES
THIRD-PARTY SERVICES AND APPS
Our services are intended for use by children aged 0 to 5
When we refer to a child we mean anyone under the age of 18. This is in accordance with the UN Convention on the Rights of the Child which defines a child as everyone under 18 unless, “under the law applicable to the child, majority is attained earlier” (Office of the High Commissioner for Human Rights, 1989). The UK has ratified this convention.
When Bright Beginnings refer to someone with parental responsibility for a child we mean someone who, according to the law in the UK, has the legal rights and responsibilities for a child that are normally afforded to parents. This will not always be a child’s ‘natural parents’ and parental responsibility can be held by more than one natural or legal person.
Bright Beginnings rely upon legitimate interests as the lawful basis for processing a child’s data. We have balanced Bright Beginnings own (or a third party’s) legitimate interests in processing the personal data against the interests and fundamental rights and freedoms of the child. This involves a judgement as to the nature and purpose of the processing and the potential risks it poses to children. Bright Beginnings take appropriate measures to safeguard against those risks
Bright Beginnings Complies with the data protection principles and in particular fairness which is central to all our processing of children’s personal data.
Bright Beginnings acknowledge that children have the same rights as adults over their personal data. These include the rights to access their personal data; request rectification; object to processing and have their personal data erased.
As a result of legal requirements, we have to monitor how our setting works. This means that we collect data and share with third parties as required by law.
HOW YOU CAN ACCESS AND UPDATE YOUR INFORMATION
The accuracy of your information is important to us. If you change address, email address or telephone numbers, or any of the other information we hold is inaccurate or out of date, please write to:
Data Protection Officer,
Bright Beginnings Community Nursery,
120 Garners Lane, Adswood,
0161 483 3500
You have the right to ask for a copy of the information Bright Beginnings holds about you.
REVIEW OF THIS NOTICE
We keep this Notice under regular review. This Notice was first produced in May 2018.