Introduction

2. Policy Aims

Kindred Education Limited is committed to being transparent about how it collects and uses the personal data of its families and its workforce, and to meeting its data protection obligations. This policy sets out the organisation’s commitment to data protection, and individual rights and obligations in relation to personal data.

 

3. Prospective Parent/Carer/Child Information Collected

When you express interest in one of our nurseries, we will collect and process the following data from you:

• your name
• email address which will be used to send you a confirmation email and, if you gave consent, Kindred Nurseries newsletters and updates
• contact telephone numbers which will be used to call you to book your   nursery visit
• child’s name & age

How do we collect this information?

Data will be collected via our website enquiry form, telephone or email when you register an interest with our nursery.

Why we collect and use this information?

• To send you confirmation of a visit booked by email
• To share Kindred Nurseries emails (newsletters, news and promotions) where we have obtained your consent
• To call you and book in a nursery visit and understand your current needs
• To provide you with information about our availability and possible start dates, as well as a tailored understanding of what our services will provide.

 

4. Enrolled Parent/Carer/Child Information Collected

On registering and securing a place at one of our nurseries, the categories of child information that we collect, hold and share include:

• Personal information and contacts (such as name, date of birth and address)
• Characteristics (such as ethnicity, language, nationality, country of birth)
• Attendance information (such as sessions attended, absences and absence reasons)
• Assessment information (such as development records, progress reports and observations)
• Medical information (such as immunisation records, allergy information or dietaries)
• Relevant documentation for child protection and safeguarding concerns
• Special educational needs (including the needs and ranking)
• Details of any accidents / incidents / existing injuries
• Funding information and details, including birth certificates

On registering and securing a place at one of our nurseries, the categories of parent or carer information we collect and hold include:

• Personal information (such as name, address and contact details, relation to child)
• Proof of identity for adults
• Card details for Famly Pay (if this payment option is selected)
• CCTV (where applicable)

How do we collect this information?

• Our registration form
• Our parent app, Kindred Satchel
• CCTV system (where applicable)
• Our enquiries system, Pipedrive

Why we collect and use this information?

We use child data:

• to support child learning
• to monitor and report on child progress
• to provide appropriate care
• to assess the quality of our services
• to satisfy Kindred’s regulatory and legal obligations

We use parent or carer data:

• to support a child’s care
• to help identify parents when collecting children
• for the purposes of maintaining open communication
• to assess the quality of our services
• to satisfy Kindred’s regulatory and legal obligations

Collecting child information

Whilst the majority of child information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the GDPR, we will inform you whether you are required to provide certain child information to us or if you have a choice in this. Data will be collected via your registration form and our parent app, Kindred Satchel, as well as through a selection of introduction forms when your child begins the nursery.

Collecting parent or carer information

When registering your child, the majority of the information you provide about yourselves will be mandatory, although we may also ask for some voluntary information to help us care for your child. Data will be collected via your child’s registration form and our parent app, Kindred Satchel, as well as through a selection of introduction forms when your child begins the nursery.

5. Special categories of data

Special categories of data are data relating to your:

• health
• sex life
• sexual orientation
• race
• ethnic origin
• political opinion
• religion
• trade union membership
• genetic and biometric data.

We must process special categories of data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when the following applies:

• you have given explicit consent to the processing
• we must process the data in order to carry out our legal obligations

We will use your special category data

• For the purposes of identifying and meeting a child’s additional needs
• For the purposes of tracking immunization records, allergies, ongoing health issues, and accidents and injuries
• For the purposes of equal opportunities monitoring
• For the purposes of following dietary and religious beliefs

 

6. Legal Basis for Processing your data

The legal basis for processing your data is based on the type of data that is being collected and the purpose for which it is required. We will only store, process or transfer your data where we have an valid reason to do so (known as a lawful basis).

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

1. Your consent. where you have given free and clear consent for us to process your personal data during the course of your application
2. We have a contractual obligation where the processing is necessary for an employment contract or to take steps to enter into an employment contract
3. We have a legal obligation where the processing is necessary for us to comply with the law or legal requirement.
4. We have a vital interest where the processing is necessary in order to protect the vital interests of the data subject or of another natural person
5. We need it to perform a public task where the processing is necessary for the performance of a task carried out in the public interest
6. We have a legitimate interest where the processing is necessary for our legitimate interests, unless there is a good reason to protect your personal data which overrides those legitimate interests.

 

6. Who will your personal information be shared with?

All data is shared between your individual Nursery and Kindred Education Limited, we may also  share your personal data with the parties set out below:

• Other companies in our group who provide services to us.
• Service providers who provide I.T. and system administration services.
• Professional advisers including lawyers, bankers, auditors and insurers
• Government bodies and Country Councils that require us to report processing activities.
• Third parties to whom we sell, transfer, or merge parts of our business or our assets.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the GDPR and other Laws. We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions and we will always have a legitimate reason for doing so.

6. Who will your personal information be shared with? CONT.

If we are obliged to disclose personal data by law, or if the disclosure is necessary for purposes of national security, taxation and criminal investigation or to safeguard your child, we will do so. In some circumstances, you may not be notified first.

Your data is hosted on several different systems (See: “Authorised Third Parties”). All these providers have relevant safeguards in place to protect your data in the same way that we do.

 

7. Authorised third parties

We use a number of authorised third parties to provide our services. They are not permitted to use information we share with them for any other purpose.

We use third parties to assist us in processing your personal information, and we require these third parties to comply with our Privacy Notice and any other appropriate confidentiality and security measures. Any processors who process data outside the UK have been reviewed to make sure that they have the appropriate safeguards in place for the security of the data, such as;

• Ensuring that we only transfer personal data to countries where it has been determined that they provide an equivalent adequate level of protection as the UK.
• Putting suitable clauses in our contracts to ensure that organisations take appropriate steps to comply with UK data protection laws or the equivalent.

Bluegreen Design
Secure hosting of Kindred Education Limited website is essential to both us and our families. That is why we entrust Blue Green Design, a long-established company, to protect all of our website data.

Famly and Famly Pay (our Kindred Satchel Parent App)
Your personal data will be input into the Famly childcare system, which helps us manage your enquiry, care for your child and manage our nurseries. Your data is held in a secure data centre in Germany, Frankfurt on an AES-256 encrypted database. It can only be accessed by authorised personnel. Please find their Privacy Policies here:  https://www.famly.co/terms/privacy-policy

The Funding Loop
The Funding Loop provides a platform to capture and process of all information required to process a funding claim for those children accessing government funding. Their data is securely stored on datacentres in the United States, where the international transfer is safeguarded by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. Please find their Privacy Policy here:  https://parents.fundingloop.co.uk/#/terms/viewPrivacyPolicy

PipeDrive
Your personal data will be input into our CRM system which helps us manage your enquiry and communications. Pipedrive may store your data in their secure data centres in the United States, where the international transfer is safeguarded by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. Please find their Privacy Policy here:  https://www.pipedrive.com/en/privacy

 

8. CCTV/Surveillance (where applicable)

We have installed CCTV systems in some of our premises, for the purposes of user, visitors and staff safety and crime prevention and detection. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection. In all locations, signs are displayed notifying you that CCTV is in operation. Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. You have the right to see CCTV images of yourself and be provided with a copy of the images. We will only disclose images and audio to other authorised bodies who intend to use it for the purposes stated above. Images and audio will not be released to the media for entertainment purposes or placed on the internet for public viewing. We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner’s Office.

 

9. Data Security

Throughout our business we have put in place significant security measures to prevent your personal data from being breached. This includes your data being lost, used, altered, disclosed, or accessed without authorisation.

We also allow access to your personal data only to those employees and partners who have a business need to know such data. They will only process your personal data on our instructions and they must keep it confidential.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to.

We take security measures to protect your information including:

• Limiting access to our buildings to those that we have determined are entitled to be there)
• Implementing access controls to our information technology
• We use appropriate procedures and technical security measures (including strict encryption, anonymisation and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices and stores
• Never asking you for your passwords

 

10. Data Retention

Prospective Parent/Carer/Child

Kindred Education Limited will hold your data on file for up to 36 months. At the end of that period your data is deleted or destroyed.

Enrolled Parent/Carer/Child

Personal data gathered during the application process will be transferred to your child’s personal file (either manual or electronic or both) and retained during his or her time at the nursery. After your child leaves the nursery, your personal data will be retained for 6 years with the exception of child registration forms which are kept until the closure of the nursery setting plus 50 years. 

We only retain personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Where the same record has to be kept for more than one purpose and there is a different retention period for each of those purposes, the record is kept for the longer period.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.