Little Gems Childcare

Privacy Notice

This notice explains how Little Gems Childcare collects, uses, stores and shares personal information about children, parents/carers, prospective families and other people connected with the childcare service. It applies to information collected in person, through childcare records and contracts, by email or WhatsApp, and through website enquiries.

1. Who is responsible for your information?

Little Gems Childcare is an Ofsted-registered childminding service in England. The registered childminder is the data controller for the personal information described in this notice. This means I decide why and how personal information is used.

Little Gems Childcare is registered with the Information Commissioner's Office (ICO) where registration is required. Parents/carers can contact me using the contact details provided in their childcare contract or through the Little Gems Childcare website/contact arrangements.

2. Who this privacy notice covers

Children who attend or have attended Little Gems Childcare.
Parents, carers and people with parental responsibility.
Emergency contacts and authorised collection persons.
Prospective families who make an enquiry or visit the setting.
Other people whose information is provided because it is relevant to a child's care, safeguarding or family arrangements.

3. Personal information I may collect

I only aim to collect information that is relevant and reasonably necessary for providing safe, lawful and effective childcare. This may include:

Child's name, date of birth, home address, attendance and childcare arrangements.
Parent/carer names, addresses, telephone numbers, email addresses and emergency contact details.
Details of people with parental responsibility and people authorised to collect the child.
Contract, invoicing, payment and funding information, including information required for government-funded childcare and Tax-Free Childcare where applicable.
Attendance, collection and absence information.
Health, medical, allergy, dietary, medication, developmental and additional-needs information.
Information about cultural, religious or dietary requirements where relevant to the child's care.
Emergency medical consent and relevant GP/health-professional information where needed.
Developmental observations, progress information and records required or used to support the child's learning and development.
Accident, incident, injury, first-aid and pre-existing-mark records.
Safeguarding and child-protection information where necessary.
Photographs used for parent updates and appropriate developmental evidence.
Messages and correspondence, including email and WhatsApp communications.
Website/contact-form enquiry information, such as the child's date of birth, requested start date, days/hours required and the enquirer's contact details.
Any other information that a parent/carer provides and that is relevant to the child's safe care or the administration of the childcare arrangement.

4. Special category and particularly sensitive information

Some information I need to use is particularly sensitive. Under UK data protection law, certain information is classed as 'special category data'. In a childcare setting this may include health information, allergies, disabilities, medical needs, and information revealing racial or ethnic origin or religious beliefs where this is relevant to the child's care.

Where I process special category information, I identify both an appropriate lawful basis under UK GDPR and an additional legal condition for processing that sensitive information. Depending on the purpose, this may include protecting vital interests, health/social-care-related purposes, substantial public interest and safeguarding of children, or explicit consent where that is the appropriate basis.

5. Why I use personal information

To respond to childcare enquiries and arrange visits, places and settling-in.
To enter into and manage childcare contracts and provide the childcare service agreed with families.
To keep children safe and meet their health, medical, dietary, allergy, developmental and individual needs.
To communicate with parents/carers about their child's care, wellbeing, activities and development.
To plan appropriate learning experiences and meet relevant EYFS requirements.
To manage attendance, collection arrangements and emergencies.
To administer fees, invoices, deposits and government childcare funding where applicable.
To keep required accident, incident, medication, attendance, safeguarding and other childcare records.
To comply with safeguarding, Ofsted, local-authority, HMRC, DfE and other legal/regulatory requirements that apply to my service.
To establish, exercise or defend legal claims and respond to complaints, insurance matters or regulatory enquiries where necessary.
To operate and protect the Little Gems Childcare business and maintain appropriate records.

6. My lawful bases for using information

I do not rely on one single lawful basis for every use of information. The appropriate basis depends on why the information is being used. The main lawful bases that may apply are:

Contract – where information is necessary to take steps at a family's request before entering a childcare contract or to provide the contracted childcare service.
Legal obligation – where I must keep, use or share information to comply with legislation, the EYFS, Ofsted requirements, tax/accounting obligations or another legal duty.
Vital interests – where using or sharing information is necessary to protect someone's life in an emergency.
Legitimate interests – where using information is necessary for the reasonable operation, safety, administration or protection of the childcare service, provided those interests are not overridden by the rights and interests of the child or other individual.
Recognised legitimate interest or substantial-public-interest provisions – where current UK data protection law provides a specific basis for certain public-interest purposes, including relevant safeguarding or crime-prevention circumstances.
Consent – where consent is genuinely the appropriate lawful basis for an optional use. Where I rely on consent, it can normally be withdrawn for future use.

7. Children's information and best interests

Children have data-protection rights in their own right. Because the children I care for are young, privacy information will normally be communicated through their parent/carer, but I will also explain privacy and photographs to children in a simple, age-appropriate way where this is meaningful for their age and understanding. When using children's information, their safety, dignity and best interests are a primary consideration.

8. Photographs and images

As set out in my childcare contract and safeguarding procedures, I may take photographs of minded children for direct parent/carer photo updates and for appropriate developmental evidence. Routine photo updates may be sent directly to the child's parent/carer through their designated WhatsApp communication.

Images of minded children are not posted on Little Gems' website, social media, online advertising or other public platforms.
Photographs are only taken where there is an appropriate childcare purpose and in accordance with the permissions and arrangements agreed with the family.
Images are kept only for as long as they are needed for the relevant purpose and are deleted from my device when they are no longer required, subject to any legal, safeguarding or evidential reason requiring retention.
My phone/device is protected by security controls such as passcodes/biometric access and is not freely accessible to children or unauthorised people.
Where necessary and lawful, an image may be shown or provided to Ofsted, Children's Social Care, police, the Local Authority Designated Officer (LADO), a court, insurer, legal adviser or another authorised safeguarding/regulatory professional.

9. WhatsApp, email and electronic communication

I use electronic communication, including WhatsApp and email, as part of normal communication with families. This may include routine updates, photographs, attendance information, accident/incident updates and administrative messages.

Parents/carers should be aware that external communication and technology providers process information under their own privacy and security arrangements. I take reasonable steps to use these services appropriately and limit information to what is necessary. Families should also protect their own devices and accounts.

10. Website enquiries

When someone submits an enquiry through the Little Gems Childcare website or otherwise contacts me about a prospective place, I may collect the adult's name and contact details together with information such as the child's date of birth, proposed start date, required days/hours and the enquiry message.

This information is used to respond to the enquiry, assess availability and, where relevant, take steps towards a childcare arrangement. If an enquiry does not progress, I will not keep the information indefinitely and will delete it when it is no longer reasonably needed, subject to any legitimate business or legal reason to retain a limited record.

11. Who I may share information with

I do not sell children's or families' personal information. Information may be shared only where necessary, proportionate and lawful. Recipients may include:

Parents/carers and people with parental responsibility, subject to safeguarding, court orders and the rights of other individuals.
Ofsted and other relevant childcare regulators.
Hertfordshire County Council, including Children's Services, safeguarding/LADO services and childcare funding teams where applicable.
The Department for Education, HMRC or other government bodies where required for childcare funding, taxation or another legal purpose.
Police, courts and other law-enforcement or statutory agencies where legally required or necessary to protect a child or another person.
Health professionals, emergency services or other professionals involved in a child's care where appropriate.
A receiving school, nursery, childminder or other setting where information needs to transfer to support the child's transition, development or safeguarding and there is an appropriate lawful basis.
My accountant, insurer, legal adviser, IT/cloud/communications provider or other service provider where they need information to provide a legitimate business service and appropriate data-protection arrangements apply.

12. Safeguarding and sharing without consent

Safeguarding information is confidential but it is not secret. I will normally work openly with parents/carers, but I may use or share information without consent where this is necessary and lawful to safeguard a child, protect someone from serious harm, comply with a legal obligation, prevent or detect crime, or support a statutory investigation.

I will not delay appropriate safeguarding action simply because consent has not been obtained. Information sharing will be limited to what is relevant and necessary in the circumstances.

13. Government funding and statutory records

Where a family uses government-funded childcare or another childcare-support scheme, I may need to provide information to Hertfordshire County Council, the Department for Education, HMRC or another authorised body in order to verify eligibility, claim funding, administer payments, prevent fraud or meet audit requirements.

14. Where information comes from

Most information is provided directly by parents/carers or collected through my childcare service. I may also receive relevant information from another childcare setting, school, health professional, local authority, safeguarding agency, emergency service, court or other authorised source where there is a lawful reason for it to be shared.

15. How information is kept secure

Paper records are kept securely and are not available to unauthorised people.
Electronic devices and accounts used for childcare information are protected by appropriate security controls.
I limit access to personal information to people who genuinely need it.
I take particular care with health, safeguarding and other sensitive information.
Information is not kept simply because it might be useful one day; records are reviewed and securely deleted or destroyed when no longer required.
If I become aware of a personal-data breach, I will assess the risk, take steps to contain it and notify the ICO and/or affected individuals where the law requires this.

16. How long I keep information

Different childcare records have different legal, regulatory, safeguarding, insurance and tax retention requirements. I therefore do not apply one retention period to every record. I keep information only for as long as it is needed for the purpose for which it was collected and for any applicable statutory, Ofsted, local-authority, safeguarding, insurance, accounting or legal requirement.

When a child leaves Little Gems, records that no longer need to be retained are securely deleted or destroyed. Records that must be kept – for example because of safeguarding, accident/incident, financial, funding, insurance or regulatory requirements – are retained securely for the applicable period and then securely disposed of.

17. International transfers and third-party services

Some technology providers, including messaging, email, cloud or website providers, may process or store information outside the UK or use overseas sub-processors. Where this occurs, I will use services that provide appropriate safeguards for international transfers as required by UK data-protection law.

Parents/carers can ask me for further information about the main third-party services I currently use for their information.

18. Automated decision-making and profiling

Little Gems Childcare does not use children's or parents'/carers' personal information to make solely automated decisions that produce legal or similarly significant effects, and I do not use automated profiling to make childcare decisions.

19. Your data-protection rights

Depending on the circumstances and the lawful basis being used, individuals may have rights including:

The right to be informed about how personal information is used.
The right to request access to personal information.
The right to ask for inaccurate or incomplete information to be corrected.
The right to request deletion of information in circumstances where the right to erasure applies.
The right to ask for processing to be restricted in certain circumstances.
The right to object to certain processing.
The right to data portability in circumstances where that right applies.
Rights relating to automated decision-making.
The right to withdraw consent where consent is the lawful basis, without affecting processing that was lawful before withdrawal.

20. Requests for access or correction

Parents/carers or other individuals can contact me to ask about their personal information or exercise a data-protection right. I may need to confirm identity before releasing information. A request concerning a child's information will be considered in light of the child's own rights, age and understanding, parental responsibility, safeguarding considerations and the rights of other people.

21. Complaints about data protection

If you are concerned about how Little Gems Childcare has used personal information, please contact me first so that I have the opportunity to address the concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

ICO website: https://ico.org.uk/ | ICO helpline: 0303 123 1113

22. Changes to this privacy notice

I will review this notice periodically and when my services, systems, legal obligations or data-protection guidance change. Where a change materially affects how families' information is used, I will make the updated notice available and draw significant changes to parents'/carers' attention where appropriate.

23. Cookies

The Little Gems Childcare website does not use analytics, advertising, tracking or any other non-essential cookies. The only cookies that may be placed are strictly necessary, functional cookies needed for the website to operate correctly.

Because no non-essential cookies are used, the site does not display a cookie consent banner. If non-essential cookies are added in the future, a cookie notice and consent mechanism will be put in place first.

Key details

Data controller: Little Gems Childcare – registered childminder
ICO registration: Registered where required; registration details available on request
Applies to: Children, parents/carers, prospective families and relevant contacts
Review: At least annually and whenever data-protection law, guidance or practice changes