Customer Privacy Notice

Data Protection Officer

Karen Seddon
karen.seddon@kidsplanetdaynurseries.co.uk

ICO Registration Number: Z2484469 (Tier 3 registration)

Introduction

Kids Planet is committed to protecting the privacy and security of your personal information. This privacy notice describes how we process your information in accordance with the UK General Data Protection Regulations (UK GDPR).

Kids Planet is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to registered parents / carers (henceforth ‘parents’) and registered children.

It is especially important that parents read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you.

Parents can access this document on the Kids Planet website and can request a copy at any time from a Kids Planet reception desk or from our Central Support office.

Legislation

  • We comply with legal requirements set out in the Statutory Framework for the Early Years Foundation Stage (EYFS) and accompanying regulations, in relation to the information we must process.
  • We also comply with the requirements of the UK GDPR, the Data Protection Act 2018 (DPA) and the Data (Use and Access) Act 2025 (DUAA), in upholding the rights of data subjects and ensuring all personal data is processed fairly and responsibly.

Personal data

Personal data, or personal information, means any information about an individual from which that person can be identified.

There are “special categories” of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation.

Details of the data processed by Kids Planet in relation to our families includes:

  • Personal data – data that personally identifies you, such as name and contact details.
  • Special Category data – data that may reveal a characteristic of identity, such as race or sexual orientation or your health. Examples include passports and health declarations.
  • Child data – as young children are unaware of their rights as data subjects, additional protections are built into our processing activities, to ensure that child data is processed and shared in the child’s best interests.

The data we process

The data we process in relation to registered children and families includes the following:

Children

  • Name
  • Date of birth
  • Gender
  • Home address
  • Dietary requirements and medical information including allergies
  • Attendance and absence information
  • Emergency contact’s contact details
  • Learning journey, assessments and observations
  • Information relating to any special educational needs or disabilities
  • Details of accidents and injuries
  • Records of reportable death, injury, disease or dangerous occurrence
  • Records of any safeguarding concerns or allegations, including referrals and meeting notes
  • Information about a Child’s spoken language
  • Incidents and referrals to external safeguarding agencies
  • CCTV footage – video and in some settings, audio

Parents

  • Name
  • Contact details including home address, telephone numbers and email addresses
  • National Insurance number
  • Bank account details / direct debit / transactions
  • Invoices, account balance / any debt on account
  • Parent signature e.g. on contracts and consent forms
  • Information about a Parent’s spoken language
  • Parent communications and conversations
  • CCTV footage

Safeguarding information

Kids Planet give particular weight to the rights and interests of children. This means, on the one hand, that we are especially concerned with the protection of children’s data. On the other hand, it means that our duty to safeguard the health and well-being of children is paramount and takes precedence over our duties under the data protection laws.

For example, paragraph 62 of Keeping Children Safe in Education affirms that while data protection legislation “…places duties on organisations and individuals to process personal information fairly and lawfully, it is not a barrier to sharing information, where the failure to do so would result in a child being placed at risk of harm. Fears about sharing information cannot be allowed to stand in the way of the need to promote the welfare and protect the safety of children.”

There are also circumstances in which we cannot share safeguarding information, such as in order to protect 3rd party data or in order not to undermine a public task or investigation. We process, share and withhold safeguarding information in the best interests of the child and we apply the appropriate exemptions and restrictions under UK GDPR.

Why we process your information and our lawful bases for doing so

  • Enrolment and parent contracts, provision of childcare services, parent communications, funding, billing and transactions: on the lawful basis of performance of contract.
  • Child safeguarding / protection, accident and incident management, claims and legal proceedings, security of premises and infection control: on the lawful basis of our legal obligations.

Key systems

The key system used for processing child and parent data is Famly. This is our nursery management system, used for billing and transactions, booking patterns and absences, signing in/out, dietary requirements / allergen management.

Other systems used include Funding Loop for applying funding and Microsoft Office.

Where international transfers are necessary in using these systems, the countries in receipt of employee personal data are listed as having full adequacy in UK law. This means that those countries have controls and policies in place that are equivalent to UK GDPR.

Data recipients

We may share your personal data with third parties when legally obliged to do so. We may share your personal data with:

  • Local Authorities
  • Child safeguarding agencies
  • Our regulators (Ofsted, HSE, ICO, Local Authorities)
  • Emergency services
  • Police, Courts, Lawyers
  • Public Health agencies
  • Our insurer (Aviva) and broker (Stanmore)

Data security

Kids Planet has robust controls in place that include but are not limited to:

  • Encryption
  • Access controls
  • Independent audits and PEN tests
  • Enforced policy and disciplinary procedures
  • Training and qualifications
  • On site lockable cabinets for paper data