This policy was last updated in September 2018.
Nipperbout is registered with the Information Commissioner’s Office.
Nipperbout is a Data Controller which means we determine the purposes and means of processing your personal information.
Parents and employees are welcome to view our policies and procedures upon request. A copy is held on site at every setting. Event Managers are on hand to explain any of our operating procedures if required or parents can contact the company Directors for further information.
Nipperbout collects and processes personal information in order to comply with our legal obligations (for example to OFSTED and child protection). We seek consent from individuals before processing their personal information and maintain transparency about how this information is used, retained and shared.
Nipperbout has clear procedures for identifying, recording, reporting and managing any personal data-breaches. We understand our duty to report certain breaches to the ICO and to the individuals involved.
Your rights (these are applicable to both adults and children)
Right to be informed
Individuals have the right to be informed about the collection and use of their personal information. We must inform you as to our reasons for collecting your personal information, how long we store it for and who we will share it with.
For further information about your right to be informed please visit ico.org.uk/your-data-matters
Right of access
Individuals have the right to access their personal information.
You may request copies of information we hold about you either verbally or in writing. We must respond to you without undue delay and in any event within one month.
For further information about your right to see copies of data held about you please visit ico.org.uk/your-data-matters
Right to rectification
Individuals have the right to ensure that inaccurate personal information held about them is rectified or completed if it is incomplete.
You can make a request for this to be done verbally or in writing. We must respond to you in one calendar month.
If you request inaccurate information to be rectified and/or incomplete information to be completed, Nipperbout must take reasonable steps to inform others we have disclosed this information to, expect where this would be impossible or involve disproportionate effort.
For further information about your right to correct your data please visit ico.org.uk/your-data-matters
Right to erasure
Individuals have the right to have their personal information erased. This is also known as ‘the right to be forgotten’.
You can make a request for us to delete your information verbally or in writing. We must respond to you in one month of your request.
Your right is not absolute and only applies in certain circumstances. Please be aware Nipperbout is bound by Ofsted Regulations which may override this right in some instances.
For further information about your right to have your data deleted please visit ico.org.uk/your-data-matters
Right to restrict processing
Individuals have the right to restrict or suppress the use of their personal information. This right is not absolute and only applies in certain circumstance.
You may make a request to restrict the processing of your information verbally or in writing. We must respond to you in one calendar month.
For further information about your right to limit how organisations use your data please visit https://ico.org.uk/your-data-matters
Right to data portability
Individuals have the right to obtain and reuse their personal information for their own purposes across different services. This allows you to move, copy or transfer personal information easily from one IT environment to another, safely and securely, without affecting its usability.
This right only applies to information you have provided to us and which is held electronically. It does not apply to paper files.
We will provided personal information in a structured, commonly used and machine readable format.
We will respond to requests for data portability within one month.
For further information about your right to data portability please visit ico.org.uk/your-data-matters
Right to object or withdraw consent
Individuals have the right to object to the processing of their personal information including an absolute right to stop their data being used for direct marketing.
Individuals have the right to withdraw consent at any time. For example, if you have given consent for Nipperbout to send you marketing material, you can choose to stop receiving this at any time.
You may make an objection and/or withdraw consent verbally or in writing. We must respond to you in one calendar month.
For further information about your right to object to the use of your data please visit ico.org.uk/your-data-matters
Rights related to automated decision-making including profiling
Automated decision-making refers to decisions made without human involvement, i.e solely by automated mean.
Profiling is the automated processing of personal information to evaluate certain things about an individual. This may be part of an automated decision-making process.
Your rights relating to automated decision-making are covered by Article 22 of the GDPR and we must inform you if any way we process your information falls under Article 22. At present, Nipperbout does not use automated decision making or profiling.
For further information about your rights relating to decisions being made about you without human involvement please visit ico.org.uk/your-data-matters
Right to complain
Individuals have the right to lodge a complaint with the supervising authority.
You may make a complaint to Nipperbout using the same contact details listed under Contacting us
A note of the rights of individuals under the age of 18 years
All data subjects, including those under 18 years old, share the above listed rights. Young People may exercise these rights on their own behalf as long as they are competent to do so.
The GDPR recognises that children aged 16 years and over are capable of giving consent and under this age consent of the parent is required, however the Data Protection Act 2018 reduces the age of consent to 12 years in Scotland and 13 years in England, Wales and Northern Ireland. It is presumed that children ages 12 or 13 years, respectively, are of sufficient age and maturity to exercise their data protection rights, unless otherwise is shown.
Where a company deems a person under the age of 18 years competent to provide consent on their own, it is reasonable to assume the person is also competent to exercise their own data protection rights.
Nipperbout requires parents/carers (over the age of 18 years) to be responsible for giving consent and providing personal information on behalf of children (under the age of 18 years) who use our services and settings.
Nipperbout respects the data protection rights of individuals under the age of 18 years and will treat requests and objections or complaints made by children or young people, with the same importance as those made by an adult.
How we collect your personal information
Nipperbout may collect information about you in the following ways:
- Personal information you voluntarily provide to us, for example information you input onto our Online Registration System form or by phone/email.
- Personal information Nipperbout observes or is verbally given by you or your child whilst attending our setting, for example in relation to the EYFS, child protection, medical needs, emotional wellbeing, baby needs etc.
- Non-personal information collected automatically by the website
Nipperbout records and stores personal information about you when you contact us by phone, post, e-mail or our using online contact form and when you subscribe to our newsletter. We may also do so after you message us on social media or through other channels.
Why we collect your personal information (how it’s used & legal basis for processing)
Nipperbout is regulated by Ofsted therefore we have developed this policy and our procedures in line with Ofsted regulations and best practice guidance. Ofsted regulations dictate what information we collect and how long it should be stored.
We collect personal information about you to:
- reply to you in person when you’ve asked us to, or when it seems appropriate
- if you’ve agreed, to email you about our services we think may be of interest to you
- to allocate a place for your child/ren at a Nipperbout setting
- to assign an appropriately skilled/qualified Purple Person (Nipperbout staff member) to care for your child
- to care for and accommodate the needs of your child/ren, including putting additional measures in place where necessary (for example ordering a dairy free meal or sourcing particular equipment)
- to engage additional services, facilities or skilled personnel to care for or accommodate the needs of your child (for example an NHS nurse or to arrange a break-out room)
- to complete reports, such as accident, incident or child protection reports when required
- to keep a record of any intimate care Nipperbout Purple People have given to your child, for example nappy changes, toilet assistance or first aid in order to safeguard your child and our employees
- to contact you and/or the third-party contacts you provide during an event in an emergency or if you child is not collected
- to contact you during or after an event, in relation to the event your child attended, for example if your child is unwell or if you/your child has left a personal possession a tour setting
- to contact your child’s school, at your request, to assist with obtaining ‘authorised absence’ for your child, to support with homework and/or to gain a base line for children within the Early Years Foundation Stage.
What personal information we collect
Nipperbout collects, shares and stores your personal information in line with Ofsted Regulations and Child Protection laws. Additional data, not dictated by Ofsted, may be collected, shared and stored in order to help Nipperbout provide the best possible care for your child, for example, if your child is feeling upset due to a recent bereavement, when they arrive at our setting this will be recorded on their Communication Booklet and shared with their Key Worker. By giving us this information you agree that we may store it on our systems. We collect the following information:
From our websites
Our contact form on our website asks for your name and e-mail address. You may choose to provide us with you telephone number and/or other details about you / your event / your child in your message.
Our website will note your computers IP address.
From the Online Registration System website
Account login – your full name, email, personal password
Your device – our website automatically detects what device you are using so you can view our site in the best possible layout.
From the Online Registration System form (on the above website)
About you – Title, full name, email address, telephone numbers, statement of legal responsibility for each child registered, relationship to each child.
Your child – Full name, date of birth, gender, address, home telephone, medical information, dietary information, details of special educational needs, details of additional needs (including baby needs)
Third parties – Emergency contact name, number and relationship to child, name and number of the child’s legally responsible adult (if different to registrant), doctors name, number and surgery address, child’s school, number and email address.
The above information is stored on your account. Each time you register for a new event you will be asked to choose which child/ren you wish to register for this event. This means only personal information belonging to the child/ren you have chosen will be visible for this event.
Consents and permissions – We will ask you to complete consents and permissions each time you register for an event. These consents and permission are only stored in relation to the event, not your account.
Admission criteria – The admission criteria for an event is set by the event organiser (not by Nipperbout). This criteria will vary for each event but may include requests such as your union membership number and details about who you will be attending the event with. You will always be asked to confirm that you have read the Nipperbout terms and conditions and whether you have legal responsibility for the child/ren you are registering. This information is shared with the event organiser (see ‘how we share your information’ for more details). Please contact your event organiser for information about how they set & use the admission criteria.
Consents – You will be required to indicate yes, no or not applicable for a variety of statements. Each request details exactly what we are asking you to give consent for, for example the ability for Purple People to administer first aid to your child/ren if required.
From the Child Registration Card (printed document)
The printed Child Registration Card contains all information provided by you on the Online Registration System form. A copy of the Consents (not the Admission Criteria) is also included on the print out.
If you have not [fully] completed the Online Registration System form, you will be asked to complete all sections of the Child Registration Card when you arrive at the Nipperbout setting. There is also space for you to provide additional information you think will help Purple People care for your child.
There is a space to provide the name of any other people whom you give permission to collect your child on your behalf (a first name only, is acceptable).
Nipperbout requires a password to be recorded on the card and will ask for this password to be given verbally when you or anyone else comes to collect your child.
There is a Record of Attendance on the card which you will be required to sign each time you drop off or collect your child. This includes the date, time and your signature. Any other person dropping off or collecting your child on your behalf will also be required to provide their signature on this record.
Please note as the Record of Attendance is on the back of the Child Registration Card, any adults given permission by you to sign your child/ren in or out of Nipperbout’s care will have access to the information on the Child Registration Card and may also be shown your child/ren’s Communicate Booklet.
From the Communication Booklet (printed document)
Your child’s Communication Booklet contains the following personal information retrieved from information provided by you on the Online Registration System form
- full name
- the event they are attending
- your telephone number (mobile at event)
- baby needs (where applicable)
- medical needs
- special education needs
- additional needs
- dietary requirements
- any other usual full information you have provided
If you have not [fully] completed the Online Registration System form, you will be asked to complete all sections of the Communication Booklet when you arrive at the Nipperbout setting.
Once at the event you will be given the opportunity to add further information about your child that may be useful for their Key Worker to know (e.g: favourite toys, recent bereavement, homework to be completed).
If your child is in the Early Years Foundation Stage (EYFS) you will be asked to provide information about their skills and abilities to help their Key Worker plan for and record their learning and development during their stay with Nipperbout.
If your child is a baby or toddler their Key Worker will record information about their feeds, sleeps and toileting during their time with us.
For all ages of children, Key Workers will use the Communication Booklet to note down information about the activities your child enjoyed and/or their emotional wellbeing during the day.
Children are encouraged to use the communication booklet to write their own notes/thoughts/feelings too.
From our Job Application forms
Nipperbout operates a robust recruitment procedure in line with Safer Recruitment guidelines, ACAS, child protection laws, Ofsted regulations and The Employment Practices Code published by the Information Commissioner.
Nipperbout has a four-stage recruitment process. Stages one, two and three require applicants to provide minimal personal information which is used for contacting candidates (i.e full name, e-mail and contact numbers). In line with recruitment guidance, the application form given at stage two asks candidates to detail the last 5 years of their employment history and to explain any gaps in employment.
The contact details, application form and interview notes of unsuccessful candidates who do not reach stage four of our recruitment process will be kept for 6 months and then destroyed.
- Personal information relating to candidates who reach stage four but a) are unsuccessful, b) choose to withdraw or c) never start work, will be kept for 12 months
- Personal information relating to employees (i.e a person who works for Nipperbout for one or more days) will be kept for 6 years following their leaving date.
How we store your personal information
Nipperbout retains and stores your personal information in line with
- GDPR regulations
- Ofsted regulations
- The Statute of Limitations Act (1991)
- RIDDOR (1995)
- COSHH (1999)
- Chartered Institute of Personnel and Development recommendations
- Companies Act (2006)
Records are stored for the following amount of time:
Child Registration Card – 6 years after the year in which the event was held
Accident/Incident reports (children) – Until the child’s 21st birthday
Accident / incident report (adult) – 3 years from the date of report
Accident/medical report (as specified by COSHH) – 40 years from the date of report
Safeguarding (Child Protection) reports – Until the child’s 24th birthday
Intimate care reports (e.g. nappy change) – 6 years after the year in which the event was held
HR records (employees) – end of tax year, 6 years after employment ceases
HR records (recruitment) – 6 months (usually where applicant withdraws) to one year (usually where applicant is unsuccessful)
Accounting records – end of tax year, 3 years from the date on which the record was made
Printed documents are stored at the Nipperbout office in a secure location, in line with GDPR regulations
Printed documents containing personal information that we do not need to store are destroyed at the Nipperbout office.
Electronic copies of reports/lists Nipperbout has generated using your/your child’s personal data (e.g. Key Needs list) are stored as a password protected file on the Nipperbout server for 3 years after the date of the event and then destroyed.
Information input on the Online Registration System will remain on your account until you delete or amend it.
Nipperbout will delete your Online Registration System account and its associated information if:
- your account has been inactive for 25 months (i.e. you have not registered for an event in that time).
- once your child turns 18 years old. Please note, if your account contains more than one child, we will only delete the child record, not the account itself.
Nipperbout has the following security measure in place:
- Encrypted user passwords
- Secure password requirement – users are required to create a password which is a minimum of 8 characters long and includes at least one capital letter, special character and number.
- Https protocol
- Firewall protection on our servers and networks
- Local server-side encryption (this means the information on the server is encrypted)
Nipperbout’s internal servers and the host server for the Online Registration System are consistently backed up.
How you can access, correct or delete your personal information
Accessing, correcting and deleting information on the Online Registration System
You will create a username and password when you set up an account on the Nipperbout Online Registration System. This enables you to access your information at any time of the day and correct or delete information. Nipperbout encourages parents to check and update the information they have stored about their child/ren each time they register for a new event.
If you wish to have your account removed from the Nipperbout Online Registration System, please contact us on 01296 712 658 or email@example.com to make the request. Nipperbout will endeavour to reply to you within 14 working days. Please note, this request will only cover information stored on the Nipperbout Online Registration System. Nipperbout is bound by Ofsted regulations in regard to the storage of our printed documents e.g the Child Registration Card, accident reports etc.
Accessing, correcting and deleting information we have printed
If you would like to access printed records we hold for you while onsite at a Nipperbout setting, please speak to a Purple Person at the registration desk.
If you wish to access printed records we have stored at the Nipperbout office please contact us on +44 (0)1296 712 658 or firstname.lastname@example.org to make the request. Nipperbout will reply to you within one calendar month.
If you would like to correct or delete personal information on our printed documentation you can do so at the registration desk of the Nipperbout setting you are attending. Please note, to make a permanent correction to this information you will need to revisit the Online Registration System and amend these details online.
Accessing, correcting and deleting information if you are under 18 years old
Individuals under the age of 18 years are entitled to the same rights as adults in regard to the collection, processing and storage of their personal information. This means that you can also make a request to Nipperbout to access, correct or delete personal information relating to you which may have been provided to us by your parent or carer.
If you are attending a Nipperbout setting, you can request to access and amend printed records (such as your Child Registration Card) by speaking to a Purple Person. Please note, the Purple Person may need to refer the request to the Nipperbout Event Manager or Company Directors.
If you are not at a Nipperbout setting, you can make a request by telephone (+44 (0)1296 712 658), email (email@example.com) or post (Six Lords, MK17 0RB). Nipperbout will respond to requests within one calendar month.
Please aware that Nipperbout may not be able to action a request to amend or delete personal information if it conflicts with our obligations to Ofsted or laws and regulations. See ‘How we store your personal information’ for details on how long we must retain our records.
Where Nipperbout has been unable to amend or delete your personal information, as requested, we will work with you to find an alternative, achievable solution. For example, by limiting the number of people who have access to your personal information or by changing the way this information is presented.
Marketing and Newsletter
If you have agreed to receive marketing messages from us or subscribed to the Parent or Staff Newsletter, you may opt out at a later date by clicking the ‘Unsubscribe’ link in the message or by e-mailing us.
Do we use Data Processors?
Nipperbout is a Data Controller. A Data Processor is responsible for processing personal information on behalf of a Data Controller.
Nipperbout does not engage third parties as a Data Processor. All your personal information is collected, processed and stored by Nipperbout.
Non-personal information collected automatically
We use third party services to help us run our website, improve the way we communicate through it and to provide tools to visitors to share our website’s content on social media. These providers collect and store non-personally identifiable information about your visit and your behaviour using cookies and similar technologies.
Our websites automatically log your visit to our site and may collect standard non-personal information including browser type (eg Google Chrome), browser version, browser size, computer operation system, computer operating system version.