Privacy Policy

All our policies comply with all necessary regulations and are available upon request.

Our privacy notice is as follows:
St John’s Pre-school Hook, St John’s Church Hall, London Road, Hook, Hampshire RG27 9EG
Data Protection Officer – Sarah Brown, Director & Business Manager


We at St John’s Pre-school Hook (STJ) are committed to ensuring that any personal data we hold about you and your child is protected in accordance with data protection laws and is used in line with your expectations. The processing of personal data is governed by the General Data Protection Regulation (GDPR).

Personal information is any information that identifies you or your child as an individual and relate to you or your child/ren.

It is a requirement of our registration with the Information Commissioners Office (ICO) to provide you with information about the data we keep about you and your child/ren.

This privacy notice explains what personal data we collect, why we collect it, how we use it and how we protect it.

What personal data do we collect?

We collect personal data about you and your child to provide care and learning that is tailored to meet your child’s individual needs. We also collect information in order to verify your eligibility for free childcare as applicable.

Personal details that we collect about your child include:

  • your child’s name, date of birth, address, emergency contact details, this is also in line with the Early Years Foundation Stage (EYFS) (requirement 3.72) personal details required by the Statutory Framework and/or the local Authority for funding purposes (if applicable).
  • health, care and medical needs, including allergies, ongoing medical conditions, required medications and vaccination information.
  • developmental needs
  • any special educational needs.
  • Characteristics – native language, nationality & religion
  • Contractual details including attendance/registers, absences/reasons and fees information.
  • Records of accidents involving your child which occurred whilst at the setting
  • Records of injuries accumulated at home which results in bruises/cuts or visible wounds
  • Information about family circumstances which might affect your child’s welfare or happiness. This is so that we can safeguard the welfare and wellbeing of you child whilst at our setting.
  • Information relating to SEN (special educational needs)
  • Any records required to support your child such as shared information from other settings, agencies and professionals.

Where applicable we will obtain child protection plans from social care and health care plans from health professionals.

We will also ask for information about who has parental responsibility for your child and any court orders pertaining to your child.

We will also maintain records of developmental information including:

  • Any relevant information shared by you
  • Your child’s 2 year progress check (if applicable)
  • Assessments, observations, individual planning & regular progress summaries. This includes parents information evening, school leaver report. Observations made may include photos or videos of your child.
  • Behavioural plans and reports

Personal details that we collect about you include:

  • your name, home and work address, phone numbers, email address, emergency contact details, and family details.

This information will be collected from you directly in the registration form or by email for the purposes of going on the waitlist.

If at any point you were to apply for up to 30 hours free childcare, we will also collect:

  • your national insurance number or unique taxpayer reference (UTR), if you’re self-employed. We may also collect information regarding benefits and family credits that you are in receipt of.

Why we collect this information and the legal basis for handling your data

STJ record, process and keep personal information about you and your child to meet legal requirements in accordance with Article 6 and Article 9 of the General Data Protection Regulations (GDPR, May 2018), The Education Act 1996 and the Statutory Framework. The legal basis for processing the personal data is that of contract. The processing is necessary for the contract we have with parents and staff, in additional to the child/ren information under Vital interest.

We use personal data about you and your child in order to provide childcare services and fulfil the contractual arrangement you have entered into.

This includes using your data to:

  • update you about setting information
  • contact you in case of an emergency
  • to support your child’s wellbeing and development
  • to manage any special educational, health or medical needs of your child whilst at our setting
  • to carry out regular assessment of your child’s progress and to identify any areas of concern
  • to maintain contact with you about your child’s progress and respond to any questions you may have
  • to process your claim for up to 30 hours free childcare (only where applicable)
  • to keep you updated with information about our services

We hold information about you and your child/ren to allow us to comply with the EYFS 2017. Some of the data we process relates to the Early Years Inspection Handbook (2016). Most of the information that we collect is statutory; when information is optional, we will inform you that you have a choice whether to share it with us or not.

With your consent, we will also record your child’s activities for their individual learning record. This may include photographs and videos. You will have the opportunity to withdraw your consent at any time, for images taken by confirming so in writing.

We have a legal obligation to process safeguarding related data about your child should we have concerns about their welfare. We also have a legal obligation to transfer records and certain information about your child to the school that your child will be attending. 

What we do with your data and who we share it with

The primary reason that we collect and use your data is to ensure “the safe and efficient management of the setting” (EYFS requirement 3.68). This includes ensuring that the need of all the children are met and to provide your child/ren with an educational environment.

We are required to ensure that your data is treated confidentially and only share data when there is a need for it to be shared. As such, in order for us to deliver childcare services we may share your data as required with the following categories of recipients:

  • Ofsted – during an inspection or following a complaint about our services
  • Health Visitor – if we complete 2 year check we are required by EYFS to share progress
  • banking services to process deposit returns (as applicable)
  • the Local Authority – for the purposes of funding
  • the government’s eligibility checker (if 30 hours applicable)
  • Local SENCO – when advice is sought for a child
  • our insurance underwriter (if applicable)
  • our setting software management provider (if applicable)
  • the school that your child will be attending, or other settings, including but not limited to learning journal.
  • HMRC – details about income & expenses (invoices and payments) for tax credits
  • Local safeguarding Children board
  • The police or other emergency services in the event of an emergency at the setting
  • Accountant for payroll, invoice, scheduling and funding purposes
  • Website design – staff photos and parent testimonies only

We will also share your data if:

  • We are legally required to do so, for example, by law, by a court or the Charity Commission;
  • to enforce or apply the terms and conditions of your contract with us;
  • to protect your child and other children; for example by sharing information with social care or the police;
  • it is necessary to protect our/or others rights, property or safety
  • we transfer the management of the setting, in which case we may disclose your personal data to the prospective buyer so they may continue the service in the same way.

We will never share your data with any other organisation to use for their own purposes

How do we protect your data?

We protect unauthorised access to your personal data and prevent it from being lost, accidentally destroyed, misused, or disclosed by:

  • keeping any hard copy documents in a secure, locked file
  • keeping all electronic personal data within a secure Cloud or security protected device.

Please refer to full GDPR full policy for further details.

How long do we retain your data?

The EYFS (requirement 3.70) states that “data must be retained for a reasonable period of time”. We retain your child’s personal data for up to 3 years after your child no longer uses our setting, or until our next Ofsted inspection after your child leaves our setting. Medication records and accident records are kept for longer according to legal requirements. Your child’s learning and development records are maintained by us and handed to you when your child leaves.

In some instances (child protection, or other support service referrals) we are obliged to keep your data for longer if it is necessary to comply with legal requirements.

Your rights with respect to your data

You have the right to:

  • be informed about how the setting uses your personal data (by way of this policy and any further updates)
  • request access, amend or correct your/your child’s personal data
  • request that the processing of your data be restricted.
  • Object to your personal data being processed for certain activities
  • Where any of the processing of your data is based on your consent, you have the right to withdraw this consent at any time by providing written notice to the nursery Manager.
  • request that we delete your/your child’s personal data, for example where the data is no longer necessary for the purposes of processing (‘Right to be forgotten’); and
  • request that we transfer your, and your child’s personal data to another person

If you wish to exercise any of these rights at any time or if you have any questions, comments or concerns about this privacy notice, or how we handle your data please contact us. If you continue to have concerns about the way your data is handled and remain dissatisfied after raising your concern with us, you have the right to complain to the Information Commissioner Office (ICO). The ICO can be contacted on 0303 123 1113 or via email: or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

Changes to this notice

We keep this notice under regular review. You will be notified of any changes where appropriate.

For more information about how your data is processed in paper or online, please ask to see a copy of the Data Mapping GDPR file.

May 2018