51. Privacy Policy

Policy and Procedure No. 51

 

Millfield Pre-School customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

•       Contact details
•       What information we collect, use, and why
•       Lawful bases and data protection rights
•       Where we get personal information from
•       How long we keep information
•       Who we share information with
•       How to complain

Contact details-

Post:
Millfield Pre School
South Rise
NORTH WALSHAM
Norfolk
NR28 0EE

Telephone:
07300460410

Email:
office.millfield.preschool@gmail.com

What information we collect, use, and why:

We collect or use the following information for student education and welfare:

•       Names and contact details for students/children
•       Names and contact details for parents, guardians, carers
•       Gender
•       Date of birth
•       Next of kin and emergency contact information
•       Dietary requirements (including vegetarian, vegan, gluten free and religious requirements)
•       Payment details and financial information including transactions
•       Special Educational Needs and Disabilities (SEND) or additional support information (includes reasonable adjustments        and special educational needs and disabilities)
•       Welfare information (includes family and home life circumstances and history)
•       Photographs
•       Attendance and reason for absence data
•       Account access information
•       Progress reports
•       Information relating to compliments and complaints
•       Exclusion, suspension and behavioural information
•       Right to work information

We also collect or use the following special category information for student education and welfare. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

We collect or use the following information for disciplinary investigations or to prevent, detect, investigate or prosecute crimes:

•       Names and contact details for students/children
•       Names and contact details for carers
•       Gender
•       Welfare information (includes family and home life circumstances and history)
•       Special Educational Needs and Disabilities (SEND) information (includes reasonable adjustments and special educational needs and disabilities)
•       Attendance and reason for absence data
•       Witness statements and contact details
•       Records and reports
•       Video recordings of public areas (including entrances and outside spaces to which some or all members of the public have access)

We also collect or use the following special category information for disciplinary investigations or to prevent, detect, investigate or prosecute crimes. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

We collect or use the following personal information for dealing with queries, complaints or claims:

•       Names and contact details
•       Addresses
•       Video recordings of public areas
•       Witness statements and contact details
•       Information relating to health and safety (including incident investigation details and reports and accident book records)
•       Correspondence
•       Special Educational Needs and Disabilities (SEND) or additional support information (includes reasonable adjustments        and special educational needs and disabilities)
•       Attendance and reason for absence data

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

We collect or use the following information for information updates or marketing purposes:

•       Marketing preferences
•       Photographs
•       Website and app user journey information
•       Records of consent, where appropriate

We also collect or use the following special category information for information updates or marketing purposes. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

We collect or use the following information for recruitment purposes:

•       Contact details (eg name, address, telephone number or personal email address)
•       Date of birth
•       National Insurance number
•       Copies of passports or other photo ID
•       Employment history (eg job application, employment references or secondary employment)
•       Education history (eg qualifications)
•       Right to work information
•       Details of any criminal convictions (eg DBS, Access NI or Disclosure Scotland checks)

We also collect or use the following special category information for recruitment purposes. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

We collect or use the following information to comply with legal requirements:

•       Identification documents
•       Health and safety information
•       Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
•       Safeguarding information
•       Any other personal information required to comply with legal obligations

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

•       Racial or ethnic origin
•       Religious or philosophical beliefs
•       Health information

Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

•     Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
•       Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
•       Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
•     Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
•       Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
•       Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

•       Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information for student education and welfare are:

•       Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
•       Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
•       Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
•       Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
•       Millfield Pre-School has a legitimate interest in collecting and using personal information where this is necessary to provide appropriate education, care and support for children and to promote their health, safety, welfare and development. Personal information may be used to understand each child’s individual needs, interests, abilities and circumstances, to support their learning and development, to maintain appropriate records, and to communicate with parents, carers and relevant professionals where necessary. Information may also be used to identify and respond appropriately to concerns relating to a child’s wellbeing, safety or safeguarding. This processing is necessary to enable the pre-school to provide children with appropriate care and educational support and to meet its responsibilities towards children, families and relevant regulatory requirements. The benefits include ensuring that children receive suitable support, that their individual needs are recognised, and that concerns about their welfare or safety can be identified and acted upon appropriately. Millfield Pre-School will only collect and use information that is relevant and necessary for these purposes and will not use personal information in ways that are excessive or unfair. We will take appropriate measures to protect personal information and limit access to those who need it for their role. The pre-school considers that the benefits of using information in this way, particularly in supporting children’s education, welfare and safeguarding, outweigh the potential impact on individuals, provided that the information is handled securely, proportionately and in accordance with data protection requirements.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

•       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for disciplinary investigations or to prevent, detect, investigate or prosecute crimes are:

•       Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
•       Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
•       Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
•       Millfield Pre-School has a legitimate interest in collecting and using personal information where this is necessary to investigate suspected misconduct, disciplinary matters, safeguarding concerns, unauthorised access, theft, fraud, damage to property or other suspected unlawful activity, and to prevent, detect, investigate or report crime. Personal information may include information relating to staff, volunteers, children, parents, carers, visitors, contractors or other individuals where it is relevant to an investigation or incident. This may include information contained in written records, incident reports, CCTV footage, correspondence, statements or other relevant records. Processing this information is necessary to enable the pre-school to investigate concerns fairly and appropriately, establish the facts, protect children, staff and visitors, safeguard pre-school property and premises, and take appropriate action where misconduct or unlawful activity is suspected. Where necessary, relevant information may be shared with appropriate authorities, such as the police, safeguarding agencies, Ofsted or other regulatory bodies. The benefits of this processing include protecting children and adults from harm, maintaining a safe environment, preventing and detecting crime, ensuring concerns are dealt with fairly, and enabling the pre-school to meet its legal and safeguarding responsibilities. Millfield Pre-School will only collect and use information that is relevant, necessary and proportionate to the particular matter being investigated. Information will not be used for unrelated purposes and access will be restricted to individuals who have a legitimate need to access it. Appropriate safeguards will be used to protect personal information and the rights and privacy of individuals. The pre-school considers that the benefits of this processing, particularly in protecting children, staff and visitors and maintaining a safe environment, outweigh the potential impact on individuals where the information is handled fairly, securely and proportionately.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

•       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

•       Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
•       Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
•       Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
•       Millfield Pre-School has a legitimate interest in collecting and using personal information where this is necessary to respond to and manage queries, complaints, concerns or claims made by or about the pre-school. Personal information may be used to identify the individuals involved, understand the circumstances of the matter, investigate concerns, communicate with those involved, keep appropriate records and take any necessary action. This may include information provided by parents, carers, staff, volunteers, visitors, contractors or other individuals. Processing this information is necessary to enable the pre-school to respond appropriately and fairly to queries and complaints, investigate concerns, resolve issues, learn from concerns raised and, where necessary, defend or pursue a claim or take appropriate action. Information may be shared with relevant third parties where this is necessary and lawful, such as professional advisers, insurers, Ofsted, safeguarding agencies or other appropriate authorities. The benefits of this processing include ensuring that concerns are taken seriously and dealt with appropriately, providing individuals with a clear and fair response, helping the pre-school identify and address problems, and protecting the interests of children, families, staff and the pre-school. Millfield Pre-School will only collect and use personal information that is relevant and necessary to deal with the particular query, complaint or claim. Information will be handled fairly and securely, access will be limited to those who need it, and it will not be used for unrelated purposes. The pre-school considers that the benefits of processing this information, particularly in enabling concerns to be addressed fairly and protecting the rights and interests of those involved, outweigh the potential impact on individuals when the information is processed proportionately and in accordance with data protection requirements.

 

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

•       Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
•       Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
•       Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
•       Millfield Pre-School has a legitimate interest in collecting and using personal information where this is necessary to keep parents, carers, staff, volunteers and other relevant individuals informed about matters relating to the pre-school and its activities. Personal information, such as contact details, may be used to communicate important information and updates about the pre-school, including changes to arrangements, closures, events, activities, fundraising activities, reminders, operational updates and other information relevant to individuals\’ involvement with the setting. This processing is necessary to ensure that parents, carers and other relevant individuals receive timely and appropriate information and are able to remain informed about the pre-school. Effective communication supports the smooth running of the setting, helps families to engage with events and activities, and enables the pre-school to raise funds to support the provision of resources, equipment, activities and improvements for the benefit of the children. The benefits of this processing include keeping families informed, supporting effective communication between the pre-school and those involved with it, ensuring important information is received, enabling families to participate in events and activities, and providing opportunities for families to support fundraising activities that benefit the pre-school and the children attending. Millfield Pre-School will only use personal information where it is relevant and necessary for the particular communication. Information will not be used excessively or in a way that would be unexpected or unfair to individuals. Where communications constitute direct marketing, the pre-school will comply with applicable data protection and electronic marketing requirements and respect individuals\’ rights to object or opt out where applicable. The pre-school considers that the benefits of using personal information in this way, particularly in maintaining effective communication with families and supporting activities and fundraising that benefit the children and the setting, outweigh the potential impact on individuals, provided that communications are proportionate, appropriate and personal information is handled securely and in accordance with data protection requirements.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for recruitment purposes are:

Our lawful bases for collecting or using personal information to comply with legal requirements are:

•       Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
•       Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
•       Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
•       Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
•       Millfield Pre-School has a legitimate interest in collecting and using personal information where this is necessary to comply with legal, regulatory and statutory requirements that apply to the operation and management of the pre-school. Personal information may be used to maintain records and provide information where required by law or by relevant regulatory or statutory bodies, including in relation to children\’s education and welfare, safeguarding, health and safety, staffing and employment, financial and accounting requirements, data protection and other responsibilities associated with operating an early years setting. This processing is necessary to enable Millfield Pre-School to meet its legal and regulatory responsibilities, demonstrate compliance where required, maintain accurate and appropriate records, and provide information to relevant authorities or organisations where there is a lawful requirement or obligation to do so. The benefits of this processing include helping to protect children, staff and visitors, ensuring that the pre-school operates safely and lawfully, supporting effective safeguarding and welfare arrangements, maintaining appropriate records, and enabling the pre-school to meet the standards and requirements expected of an early years provider. Millfield Pre-School will only collect and use personal information that is relevant and necessary to meet the particular legal or regulatory requirement. Information will not be collected or retained unnecessarily, and access will be restricted to those who have a legitimate need to access it. Where information is shared with external organisations or authorities, this will only be done where there is a lawful basis for doing so. The pre-school considers that the benefits of processing personal information for these purposes, particularly in ensuring compliance with legal and regulatory requirements and protecting the welfare and interests of children and others, outweigh the potential impact on individuals, provided that information is processed fairly, securely, proportionately and in accordance with data protection requirements.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

•       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Where we get personal information from

•       Directly from you
•       Parents or carers
•       Local authorities or local councils
•       Social services
•       CCTV footage or other recordings
•       Previous employers
•       Suppliers and service providers

How long we keep information

retention_periods_for_records_aug_13.pdf 

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with-

Data processors:

Taylor Minns

This data processor does the following activities for us: Accountancy and financial services provider. Taylor Minns processes relevant financial and personal information provided by Millfield Pre-School in order to review the Treasurer\’s financial records and prepare the pre-school\’s annual financial report and accounts.

Early Years Alliance

This data processor does the following activities for us: Early years support and professional services organisation providing payroll and payslip services and access to legal advice through its Law Call service. They may process relevant personal information provided by Millfield Pre-School where necessary to provide these services, including staff information for payroll and information relating to specific employment, safeguarding, operational or legal matters when legal advice is requested.

Tapestry
Tapestry processes personal information relating to children, including learning and development records, observations, assessments and photographs, as well as relevant parent/carer information, to provide Millfield Pre-School with its online learning and record-keeping service. 

Google

Email, cloud storage and technology service provider. Google processes personal information contained within Millfield Pre-School’s emails and associated cloud services for the purposes of communication, administration and secure storage of information.

Others we share personal information with

•       Parents and carers
•       Local authorities
•       Social services
•       Fostering agencies
•       Specialist teachers such as peripatetic workers or speech and language therapists
•       School governing bodies (such as Board of governors or Parent/teacher associations (PTA))
•       Organisations we need to share information with for safeguarding reasons
•       Emergency services
•       Legal bodies or authorities
•       Relevant regulatory authorities
•       External auditors or inspectors
•       Organisations we’re legally obliged to share personal information with
•       Publicly on our website, social media or other marketing and information media
•       Suppliers and service providers

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Post: 

Millfield Pre-School
South Rise
North Walsham
NR28 0EE

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Signed:   Clara Hall- Chairperson

Signed:   Tegan Kidman- Lead Practitioner/Manager. 

Reviewed:  18th August 2026.

Review:  18th August 2027.