Privacy Policy

Purpose of This Privacy Notice

Attraction Nurseries Group – Privacy Notice (UK GDPR)

Attraction Nurseries Group takes the privacy of children, parents/carers, staff, visitors and all individuals whose personal data we process seriously. We are committed to protecting personal data and handling it responsibly, lawfully, securely and transparently, in accordance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• Applicable safeguarding and childcare legislation
• The Early Years Foundation Stage (EYFS) Statutory Framework
• Ofsted requirements and expectations

This Privacy Notice explains what information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and your rights.

Who This Privacy Notice Applies To

This Privacy Notice applies to personal information relating to:

• Children attending our nurseries and preschool settings
• Parents and carers
• Prospective families making enquiries or attending visits
• Staff, volunteers, apprentices, students and job applicants
• Contractors and suppliers
• Visitors to our sites
• Individuals captured by security systems such as CCTV (where installed)
• Any other individuals whose information we process in the normal course of providing childcare services and operating our settings

Who We Are (Data Controller)

Attraction Nurseries Group (including all associated companies, nurseries and trading names) is the data controller for the personal data processed within our nursery settings. This means we determine the purposes and means of processing personal data. Our nursery settings may operate under the following names (including but not limited to):

• Attraction Nurseries
• Finkley Down Farm Nursery and Preschool
• Finkley Week Nursery
• Finkley East Anton Nursery
• Finkley Hudson’s Field Nursery
• Avon Valley Nursery and Preschool
• Tri Lakes Nursery and Preschool
• Solstice Play
• Little Druids Nursery (including any rebranded trading name)

This list may change as the group expands, restructures, acquires new settings, or rebrands. If you require confirmation of the legal entity operating your nursery setting, please request this from the nursery manager.

Contact Details

If you have any questions about this Privacy Notice or how your personal information is used, please contact:

The Nursery Manager (your setting)
or
Group Data Protection Contact: Alison Dennis
Attraction Nurseries Group

What Personal Data We Collect

We collect personal information to ensure we can provide safe childcare services, comply with legal duties, and support children’s learning and development. Children’s Information

• Full name, date of birth, age and home address
• Sex/gender and home language
• Photographs and videos (where lawful)
• Attendance, booking and learning records
• Medical information, allergies, dietary needs and immunisation information
• NHS number and GP details (where provided)
• Accident, incident, behaviour and safeguarding records
• SEND and inclusion information
• Court orders or legal restrictions (where relevant)

Parent/Carer Information

• Names, addresses, telephone numbers and email addresses
• Relationship to the child and parental responsibility information
• Emergency contact details
• Identification documents (where required)
• National Insurance number (for funded childcare checks where required)
• Payment, billing and communication records
• Authorised collector information

Staff, Volunteers and Students (Where Applicable)

• Contact and employment details
• Training records, DBS checks and safeguarding information
• Payroll, emergency contact and health information where required

Visitors, Contractors and Suppliers

• Names and contact details
• Visitor logs and signing-in information
• Vehicle registration details (where recorded)
• CCTV footage (where installed)

Special Category Data

Some personal data we collect is classed as special category data, including:

• Health and medical information
• Allergies and dietary requirements
• Disabilities and SEND needs
• Ethnic origin and religious beliefs (where recorded)
• Safeguarding and child protection information

We only process this data where necessary and permitted under UK GDPR, including for safeguarding, EYFS compliance, medical care, legal obligations and protection of vital interests.

How We Collect Personal Data

Personal data may be collected:

• Directly from parents/carers during enquiries, registration and induction
• Through paper and digital forms
• Via online platforms such as Wufoo, Jotform and similar systems
• Through nursery management and learning journal systems
• From communications, previous providers, local authorities or professionals
• Through safeguarding referrals or statutory agencies
• Via CCTV systems (where installed)

Why We Process Personal Data

We process personal data to:

• Provide childcare and early education services
• Ensure children’s health, safety and wellbeing
• Support learning, development and transitions
• Administer medication, allergies and medical needs
• Meet EYFS, safeguarding and legal requirements
• Manage attendance, funding, invoicing and payments
• Communicate with parents/carers and emergency contacts
• Manage staffing, insurance, complaints and legal matters

Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Contract
• Legal obligation
• Vital interests
• Consent
• Legitimate interests

Where consent is required, it can be withdrawn at any time.

Photographs, Video and CCTV

Photographs and videos may be used for learning records, internal displays and parent communications. Marketing use requires consent unless another lawful basis applies.

Where CCTV is installed, footage is used only for safeguarding and security, stored securely, accessed by authorised persons and retained for limited periods. Requests for access will be handled in line with UK GDPR and ICO guidance.

Who We Share Personal Data With

Where lawful and necessary, we may share information with:

• Local authorities and government agencies
• Ofsted and other regulators
• Health, education and safeguarding professionals
• Emergency services
• Insurance providers and professional advisers
• IT and software providers
• Debt recovery or legal enforcement agencies (where necessary)

We do not sell personal data.

International Data Transfers

Some systems may store data outside the UK. Where this occurs, appropriate safeguards are in place in line with UK GDPR requirements.

How We Protect Your Data

We take appropriate measures to ensure personal data is:

• Stored securely
• Accessed only by authorised personnel
• Protected by password and system controls
• Disposed of securely when no longer required

Data Retention

We retain personal data only for as long as necessary in line with legal requirements and our retention schedule. Data is securely disposed of once retention periods expire.

Your Rights

Under UK GDPR, you have the right to:

• Access personal data held about you or your child
• Request correction of inaccurate data
• Request deletion (where legally permitted)
• Object to or restrict processing
• Request data portability (where applicable)
• Withdraw consent at any time

Complaints

If you have concerns about how personal data is handled, please raise them with the nursery manager or Group Data Protection Contact in the first instance.

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: https://ico.org.uk

Further Information

This Privacy Notice should be read alongside our Data Protection Policy, Safeguarding Policy, Retention Schedule and Photograph/Video Policy, which are available upon request.

Approved by Attraction Nurseries Group