UK General Data Protection Regulation (GDPR) and Privacy Policy 2023

Pumpkin Patch aims to fulfill its obligations under GDPR to the fullest extent.  This policy sets out our commitment and is implemented in respect of the collecting, processing, using, storing and sharing of personal data.

Data Protection Controller: Gill Church

Pumpkin Patch is registered with the ICO (Information Commissioners Office)

We have an asset register in place to record the different types of information and documentation that we hold.  This is updated regularly.  We also have a spreadsheet showing how information is processed, stored and shared.

Procedure

Pumpkin Patch is aware that data protection legislation applies equally to children and staff.  We work to these principles:

• Data must be processed fairly, lawfully and in a transparent manner
• Data must only be obtained for specified and lawful purposes
• Data must be adequate, relevant and not excessive
• Data must be accurate and up to date
• Data must not be kept for longer than necessary
• Data must be kept securely

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at Pumpkin Patch 129 Albert Street, Fleet GU51 3RP fleet@pumpkinpatch.org.uk 01252 678623 if you wish to make a request.

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you and includes:

• personal information (such as name, address, date of birth)
• characteristics (such as ethnicity, language, nationality, country of birth, early years pupil premium eligibility)
• attendance information (such as sessions attended, number if absences and reasons)
• observations and assessment information and tracking of progress
• medical information
• information on special educational needs and disabilities
• referrals to other relevant services
• safeguarding information

We also collect, hold and share some information on the children’s parents/ guardians:

• personal information (names, address, contact numbers and emails)

We use this data to:

• support their learning and development, to enable staff to plan suitable activities to extend their knowledge and skills
• ensure that all children are safe within our childcare provision
• monitor and report on their progress
• provide appropriate behavioural and emotional support as required
• access the quality of our services as a childcare provider
• comply with the law regarding data sharing
• meet the requirements of the Early Years Foundation Stage
• make Early Years Funding claims

The lawful basis on which we use this information:

We collect and use children’s information under the following lawful bases:

• Contract: the processing is necessary for a contract we have with you the parents/guardian of the child to provide childcare and the contract that we have with the local authority to provide funded childcare to eligible families

• Legal obligation: the processing is necessary for us to comply with the law (submitting data for the Early Years census)

Collecting Children’s Information

While the majority of children’s information you provide to us is mandatory, some of its provided to us on a voluntary basis.  In order to comply with GDPR, we will inform you whether you are required to provide certain children’s information to us or if you have a choice in this.

Storing Children’s Data

We are required to hold children’s data for a reasonable period after children have left the provision (eg until after the next Ofsted inspection) as a requirement under the EYFS.  The Limitation Act 1980 recommends that we retain data until the child reaches the age of 21 – or until the child reaches the age of 24 for child protection records.

Your data will be held securely and will only be accessible by staff who are authorised to do so.

Disaster Recovery

• The organisation backs up data regularly
• Backups are kept off site.
• Firewalls and virus checkers are kept up to date and running, and users are trained in virus avoidance and detection.
• Computers are protected from physical harm, theft or damage

Secure disposal of waste

All confidential material is shredded and disposed of securely.

The following procedures apply to any third parties that we are contracted with.  We have contracts with the following organisations:

Famly

Hampshire County Council

We have documents from each contractor confirming their compliance with GDPR

We have agreed safe sharing of information

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at Pumpkin Patch 129 Albert Street, Fleet GU51 3RP fleet@pumpkinpatch.org.uk 01252 678623.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:           

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Please also see our Confidentiality Policy