Why This Policy Exists
This privacy protection policy sets out the rules that all personal data collected, processed, stored, shared and disposed of on behalf of Excel Childcare Services is compliant with the obligations of the General Data Protection Regulation (GDPR).
This policy has been put in place to ensure Excel Childcare Services: – Complies with the requirements set out by GDPR – Protects the rights and privacy of any individual the company holds data on, including but not limited to; staff, contractors, parents and children – Reduces the risk of a data breach – Has a clear and consistent approach to the collection, storage and management of data
The General Data Protection Regulation (GDPR) has been in force since 25th May 2018. It applies to all organisations who offer services to monitor or process the personal data of subjects residing in the EU. Failure to comply with the GDPR can result in fines up to 4% of annual global turnover or €20 million.
Who controls personal information collected by Excel Childcare Services?
Excel Childcare Services (and through its related affiliates) is the data controller for the information collected about you.
In the United Kingdom, the data controller for information collected about you for Excel Childcare Services branded services is Excel Childcare Services (No. 04381726)
We have our registered office at:-
96 Forest Hill Road London SE22 0RS
Room Leaders are responsible for ensuring that data collected, handled and processed within their area of control is done so in line with the GDPR and this policy.
The Room Leaders will ensure:
Why does Excel Childcare Services collect personal information?
We limit the collection of personal information to what is necessary to provide you with high quality services, to support your specific needs and requests, and to meet our business needs in connection with the services. Below we have highlighted the reasons for the collection of your personal information:
whom we provide services;
General Staff Guidelines:
All Excel Childcare Services employees are required to comply with the following guidelines to ensure all personal data held by the company is used, stored and managed in the most appropriate way possible:
How do you consent to Excel Childcare Services’ use of your personal information?
We require your consent to be able to display the children’s pictures, work and images in the nursery in displays and on our database and this may have their names and identifiable information. We will be mindful of where we display this information and will remove them when the child leaves the nursery or after 6 months whichever is sooner.
What personally identifiable information does Excel Childcare Services collect?
The type of business relationship you have with Excel Childcare Services will determine the specific information we will need to collect from you.
If you are prospective customer/parent, we will collect:
If you are an employee, apprentice, student or applicant, we will collect:
Personally Identifiable Data
Excel Childcare Services only collect, process and store personal data where we have a valid lawful basis to require it. We do the following to be transparent:
As a childcare company Excel Childcare Services collects, holds and processes a lot of children’s data. There is an increased need to protect children’s personal data because they are classed as vulnerable individuals.
Where a child is under the age of 16, consent for the processing of the child’s data is required from the child’s parent or guardian.
Additional care should be taken when handling or sharing children’s data to ensure that it is shared with only those that need to know the information.
Some data such as medical data will need to be shared with staff to ensure that any emergency medical care can be given when needed however this should not be shared with people outside the organisation unless there is a legal requirement to do this. Staff Data We collect, hold and process data on employees as part of our legal responsibilities and in order that we can support and manage them in their work.
Much personal data on employees is held on Connect Software and employees should ensure that they inform the manager and amend the information held on a regular basis
Sensitive Personal Data
Excel Childcare Services has recognised that special categories of personal data need to be processed as part of our business activities and this data need.
Where does Excel Childcare Services store personally identifiable information?
Who does Excel Childcare Services share personally identifiable information with?
How can individuals access or update their personally identifiable information?
Excel Childcare Services is committed to collecting personal information that is accurate, complete, current and reliable for its intended use. If you would like to access or update your personal information or obtain copies of the information, the following steps can be taken by you:
For informal requests:
For subject access request under a Data Protection Act in the United Kingdom, Ireland or Netherlands:
You will need to complete the Excel Childcare Services’ Data Subject Request Form at the link below and send it (and the required payment) to the attention of Excel Childcare Services, Through 96 Forest Hill Road London SE22 0RS
How can individuals contact Excel Childcare Services?
Address: 96 Forest Hill Road London SE22 0RS
How does Excel Childcare Services protect your personal information?
Excel Childcare Services utilizes appropriate technical, administrative and physical safeguards to protect against the loss, unauthorized access, destruction, misuse, modification and improper disclosure of the personal information we collect in both physical and electronic format. We provide information security awareness training to our staff and conduct periodic quality assurance audits. However, no computer system or information can ever be fully protected against every possible hazard. As a result, Excel Childcare Services cannot guarantee the security and privacy of the information you provide to us.
What are the terms for you to use Excel Childcare Services websites?
In this Policy the following terms shall have the following meanings:
“Account” means collectively the personal information and credentials used by Users to access Material and/or any communications System on the Web Site;
“Content” means any text, graphics, images, audio, video, software, data compilations and any other form of information capable of being stored in a computer that appears on or forms part of this Web Site;
“Data” means collectively all information that you submit to the Web Site. This includes, but is not limited to, Account details and information submitted using any of our Services or Systems;
“Excel Childcare Services” means Excel Childcare Services, 96 Forest Hill Road London SE22 0RS
“Service” means collectively any online facilities, tools, services or information that Excel Childcare Services makes available through the Web Site either now or in the future;
“System” means any online communications infrastructure that Excel Childcare Services makes available through the Web Site either now or in the future. This includes, but is not limited to, web-based email, message boards, live chat facilities and email links;
“User” / “Users” means any third party that accesses the Web Site (our website developers) and is not employed by Excel Childcare Services and acting in the course of their employment:
“Web Site” means the website that you are currently using (hhttp:www.excelchildcareservices.com) and any sub-domains of this site unless expressly excluded by their own terms and conditions.
Without limitation, any of the following Data may be collected:•
The types of data documents that we may hold within our provision include:
We may also hold data in a number of places:
2.1 demographic information such as postcode, preferences and interests.
The Nursery recognises that parents have a right to know that information they share with the Nursery will be regarded as confidential.
Parents will be informed about the circumstances, and reasons, when the Nursery is obliged to share information.
We are obliged to share confidential information without authorisation from the person who provided it or to whom it relates if it is in the public interest when:
The decision will not be made as an individual, but with the support and guidance of RUSUs Data Protection Lead, Early Education Authority (LEA) advisors without disclosing confidential information. Critical criteria for disclosing information is:
The Nursery will aim to:
The Nursery will aim to:
7. Reasons for decisions to share information, or not, are recorded. Consent Parents have a right to be informed that their consent to share information will be sought in most cases, as well as the kinds of circumstances when their consent may not be sought, or their refusal to give consent may be overridden.
We do this as follows:
Under the Protection of Freedoms Act 2012, the processing of personal data captured by CCTV systems (including images identifying individuals) is governed by the Data Protection Act and the Information Commissioner’s Office (ICO) has issued a code of practice on compliance with legal obligations under that Act. The use of CCTV by schools is covered by the Act, regardless of the number of cameras or how sophisticated the equipment is.
The school uses CCTV equipment to provide a safer, more secure environment for pupils and staff and to prevent bullying, vandalism and theft. Essentially it is used for:
The role of the data controller is delegated to the Directors; they have the responsibility for the control of images and deciding how the CCTV system is used. The nursery is registered with the Information Commissioner’s Office, the registration includes the use of CCTV images and the purpose for which the images are used. The Directors with access to images are aware of the procedures that need to be followed when accessing the recorded images. All operators are made aware of their responsibilities under the CCTV Code of Practice. Access to recorded images is restricted to staff that need to have access in order to achieve the purpose of using the equipment. All employees are aware of the restrictions in relation to access to, and disclosure of, recorded images.
In areas where CCTV is used the school will ensure that there are prominent signs placed at both the entrance of the CCTV zone and within the controlled area. The signs will: · Be clearly visible and readable. · Be an appropriate size depending on context.
Image storage, viewing and retention
Recorded images will be stored in a way that ensures the integrity of the image and in a way that allows specific times and dates to be identified.
Access to live images is restricted to the CCTV operator unless the monitor displays a scene which is in plain sight from the monitored location.
Recorded images can only be viewed in a restricted area by approved staff.
The recorded images are viewed only when there is suspected criminal activity and not for routine monitoring of pupils, staff or visitors.
The nursery reserves the right to use images captured on CCTV where there is an activity that the nursery cannot be expected to ignore such as criminal activity, potential gross misconduct, or behaviour which puts others at risk. Images retained for evidential purposes will be retained in a locked area accessible by the system administrator only.
Where images are retained, the Director will ensure the reason for its retention is recorded, where it is kept, any use made of the images and finally when it is destroyed. Neither the Data Protection Act nor the Information and Records Management Society prescribes any specific minimum or maximum periods which apply to CCTV recorded images. The nursery ensures that images are not retained for longer than is necessary. Once the retention period has expired, the images are removed or erased routinely by the recorder.
Disclosure of the recorded images to third parties can only be authorised by the data controller. Disclosure will only be granted:
NB: Disclosure may be authorised by law enforcement agencies, even if a system was not established to prevent or detect crime if withholding it would prejudice the prevention or detection of crime.
Subject access requests
Individuals whose images are recorded have a right to view images of themselves and, unless they agree otherwise, to be provided with a copy of the images. If the school receives a request under the Data Protection Act it will comply with requests within 40 calendar days of receiving the request.
The school may charge a fee for the provision of a copy of the images. If the school receives a request under the Freedom of Information Act it will comply with requests within 20 working days of receiving the request. As a general rule, if the viewer can identify any person other than, or in addition to, the person requesting access, it will be deemed personal data and its disclosure is unlikely as a Freedom of Information request. Those requesting access must provide enough detail to allow the operator to identify that they are the subject of the images, and for the operator to locate the images on the system.
Requests for access should be addressed to the data controller.
Refusal to disclose images may be appropriate where its release is:
Collecting and Processing Personal Data Lawful Processing
Excel Childcare Services will only collect and process personal data when at least one of the following lawful processes apply:
A data subject has given consent to the processing on his/ her personal data
Processing is necessary for the performance of a contract
Processing is necessary for compliance with a legal requirement
Processing is necessary to protect the vital interests of the data subject
Processing is necessary for the legitimate interests pursued by the data controller or third party unless there is a good reason to protect the individuals’ data which override those legitimate interests Excel Childcare Services makes automatic decisions on the processing and use of data where it is:
Processing Employee Data
All personal data regarding an employee processed by Excel Childcare Services is mandatory in order to fulfil the requirements of the contract. Failure to provide this information will result in the individual being unable to join Excel Childcare Services as an employee.
Where processing is based on consent, Excel Childcare Services shall demonstrate that the data subject has consented to the storage and processing of his/ her personal data. For the collection of personal data which relies on explicit consent, data subjects are given the opportunity to freely give their consent to us processing that data for the specified purpose. Some examples of where explicit consent (outside the terms and conditions of the contract) is required are detailed below:
Excel Childcare Services recognises the taking of photographs is not compulsory for the fulfilment of a contract and is not required for legal reasons.
Considering this, parents are given the opportunity to give or withdraw their consent for photographs of their child to be taken, displayed or used in various ways by Excel Childcare Services.
This information is collected as part of the application pack.
Excel Childcare Services recognises individuals are required to give explicit consent to be contacted for marketing purposes. Parents are given the opportunity to freely give their consent to being contacted for marketing purposes. Consent is given in a granular manner to show clearly what is being agreed to.
This information is collected as part of the application pack.
Excel Childcare Services use Facebook and other social media outlets as a means to communicate positive messages about the organisation. They are updated with regular posts showing a selection of the activities for children, news and special offers.
This is carefully managed by the Excel Childcare Services Marketing team. All photographs of children used on the Excel Childcare Services Facebook page require parents’ consent before they are posted. Photos are not to be posted on this or any social media or internet sites without this consent.
The Manager will ensure that parents complete a consent form and that the appropriate permissions for the use of photographs have been given. The consent form should be updated at least once a year to ensure the parents are still happy for images to be used. We are not responsible for any social media groups which are detached from the company and have been set up by parents such as forum groups. Below are links to the privacy policies for the social media platforms used by Excel Childcare Services, you should familiarise yourself with these if you are using these forums to post information about Excel Childcare Services.
3.1 Any personal Data you submit will be retained by Excel Childcare Services for as long as you use the Services and Systems provided on the Web Site. Data that you may submit through any communications System that we may provide may be retained for a longer period of up to 6 months.
3.3 All personal Data is stored securely in accordance with the principles of the Data Protection Act 1998.
3.4 Any or all of the above Data may be required by us from time to time in order to provide you with the best possible service and experience when using our Web Site. Specifically, Data may be used by us for the following reasons:
3.4.1 internal record keeping;
3.4.2 improvement of our products/services;
3.4.3 transmission by email of promotional materials that may be of interest to you;
3.4.4 contact for market research purposes which may be done using email, telephone, fax or mail. Such information may be used to customise or update the Web Site.
Excel Childcare Services does employ the services of other parties for dealing with matters that may include but are not limited to, payment handling, delivery of purchased items, search engine facilities, advertising and marketing. The providers of such services do not have access to certain personal Data provided by Users of this Web Site.
In addition, if you linked to our website from a third party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site.
6.1 Excel Childcare Services may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties. Data provided by Users will, where it is relevant to any division so transferred, be transferred along with that division and the new owner or newly controlling party will, under the terms of this Policy, be permitted to use the Data for the purposes for which it was supplied by you.
6.2 In the event that any Data submitted by Users will be transferred in such a manner, you will be contacted in advance and informed of the changes. When contacted you will be given the choice to have your Data deleted or withheld from the new owner or controller.
7.1 Wherever you are required to submit Data, you will be given options to restrict our use of that Data. This may include the following:
7.1.1 use of Data for direct marketing purposes; and
7.1.2 sharing Data with third parties.
8.1 You may access certain areas of the Web Site without providing any Data at all. However, to use all Services and Systems available on the Web Site you may be required to submit Account information or other Data.
9.1 You have the right to ask for a copy of your personal Data on payment of a small fee and after completing our application requesting form which you can get from the nursery at – 96 Forest Hill Road SE22 0RS
10.1 Data security is of great importance to Excel Childcare Services and to protect your Data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure Data collected online.
All Excel Childcare Services employees who are aware that a data breach has occurred should report the breach to their manager and the Data Protection Officer.
The Data Protection Officer will then ensure that the breach is recorded.
Excel Childcare Services is required under the GDPR to notify the Information Commissioners Office of a high-risk data breach, where the breach is likely to result in a risk for the right and freedoms of the individual. Excel Childcare Services will report the breach within 72 hours of first becoming aware of the breach. Excel Childcare Services will also notify the individual concerned directly and advise them of what is being done to manage the risk.