Privacy Notice

Bear’s House Nursery is committed to protecting the privacy and personal data of children and their parents or guardians. We take our responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 very seriously.

This privacy policy explains how we collect, use, store and share personal data.

This privacy policy applies to parents, guardians and children who use our childcare services.  Information about how we process staff and volunteer personal data is provided separately.

1. Who we are

Early Beginnings Nurseries Ltd (Bear’s House Nursery) is the data controller for the personal data we process.

If you have any questions about this policy or how we use personal data, please contact us in the first instance.

2. The personal data we collect

Children’s personal data

We may collect and process the following information about children in our care:

• Name, address, date of birth and gender (including birth certificate)
• Attendance records
• Medical and health information (including allergies, vaccination status and dietary requirements)
• Special Educational Needs and disability information
• Developmental and learning records
• Emergency contact details
• Photographs and videos (where parental consent has been given)
• Ethnicity, language, nationality and religion

Some of this information is classed as special category data and is handled with additional care and security.

Parents’ and guardians’ personal data

We may collect and process the following information about parents or guardians:

• Names
• Contact details (address, phone number and email address)
• Relationship to the child
• Date of birth, National Insurance number and Eligibility Codes (where required to apply for Early Years funding and entitlements on behalf of the family)
• Next of kin, details of other dependents or household members
• Emergency contact information
• Payment status and invoicing information (we do not store or have access to card or bank account)

3. How we collect personal data

We collect personal data:

• Directly from parents or guardians via booking/registration forms, funding declarations, consent forms and ongoing communication
• Through our nursery management system (Famly)
• From previous childcare settings or professionals, where appropriate and lawful
• Automatically through our website (limited technical data such as cookies, where applicable)
• From local authorities in relation to funding and entitlement checks

4. Why we collect and use personal data

We use personal data to:

• Provide safe and appropriate childcare
• Support children’s learning and development
• Monitor and record children’s progress
• Communicate with parents and guardians
• Meet safeguarding, welfare and health and safety requirements
• Apply for and administer Early Years funding and entitlements with the local authority, where requested by parents or guardians
• Manage invoices and payments to ensure nursery fees are paid
• Comply with legal and regulatory obligations, including EYFS and Ofsted requirements
• Improve the quality of our services

5. Lawful bases for processing

We process personal data under the following lawful bases:

• Contractual necessity – to provide childcare services
• Legal obligation – including safeguarding, EYFS, Ofsted and funding requirements
• Public task – where processing is required to support Early Years funding and entitlement checks
• Vital interests – to protect the health and safety of children
• Consent – for photographs, videos and marketing communications
• Legitimate interests – for nursery administration and service improvement

Where we process parent or guardian National Insurance numbers and dates of birth, this is done solely to meet legal and public task requirements associated with Early Years funding and entitlement checks.

We do not rely on children’s consent to process personal data.

6. Systems we Use (Famly, Stripe and Funding Loop)

Famly

Bear’s House Nursery uses a secure nursery management system called Famly to manage attendance records, learning observations, communications with parents, invoicing and administrative information.

Famly acts as a data processor on our behalf and processes personal data only in accordance with our instructions and UK GDPR.  Appropriate safeguards are in place to protect personal data.

Payments (Stripe):  Payments made through the Famly app are processed securely by Stripe, a third-party payment provider.  Bear’s House Nursery does not store or have access to card or bank details and only receives confirmation that a payment has been made.

Payments (TFC):  Parents can use Tax Free Childcare (TFC) by making payments through their HMRC childcare account.  Where this is linked via Famly, payments are processing securely and we only receive confirmation of payment.  Bear’s House Nursery does not have access to any information held with your HMRC account.

Funding (Funding Loop)

We use a system called Funding Loop to support the administration of Early Years funding claims.  This may involve securely sharing relevant child and parent information (such as eligibility details) with the local authority.  Funding Loop acts as a data processor on our behalf and processes data in accordance with UK GDPR.

7. Who we share personal data with

We may share personal data with:

• Local authorities
• Ofsted
• The Department for Education (DfE)
• Schools or settings children move on to
• Emergency services or health professionals where necessary
• Professional advisers such as accountants, insurers, debt collectors or solicitors
• Our IT and system providers, including Famly, Stripe and Funding Loop

We do not sell personal data to third parties.

8. Statutory data sharing

We are required by law to share certain information with the Department for Education (DfE), including through statutory data collections such as the Early Years Census.  Some of this information is held within the National Pupil Database (NPD).

Further information about DfE data collection and sharing is available on the UK government website.

9. International data transfers

Some of our service providers may store data outside the UK.  This may include data processed by providers such as Famly or Stripe.  Where this occurs, appropriate safeguards are in place to ensure personal data remains protected in line with UK GDPR.

10. Data retention

We retain personal data only for as long as necessary to meet our legal, contractual and safeguarding obligations.

In general:

• Child and parent records are retained until the child reaches 21 years of age, in line with safeguarding guidance
• Safeguarding, accident and medical records are retained in accordance with statutory requirements and best practice
• Financial records are retained for the period required by law
• Learning records are shared with parents when a child leaves the nursery and are then securely deleted from our systems

Personal data is reviewed regularly and securely destroyed when no longer required.

11. Photographs and videos

Photographs and videos of children are only taken and used with parental consent.

Consent can be withdrawn at any time. Images are stored securely and are not used for marketing purposes unless explicitly agreed.

12. Data security

We take appropriate technical and organisational measures to protect personal data, including:

• Secure digital systems
• Restricted access to sensitive information
• Password-protected systems
• Staff training on data protection and confidentiality

National Insurance numbers and other sensitive information are accessible only to authorised staff and are stored securely.

13. Children’s privacy

We recognise that children’s personal data requires special protection. We take children’s privacy extremely seriously and ensure that personal data is handled confidentially, securely and only by authorised staff.

14. Your rights

Under data protection law, parents and guardians (and children, where appropriate) have the right to:

• Access personal data
• Request correction of inaccurate data
• Request deletion of data (where legally possible)
• Restrict or object to processing
• Withdraw consent at any time (where consent is the lawful basis)
• Lodge a complaint with the Information Commissioner’s Office (ICO)

Requests should be made to the Nursery Manager.

15. Changes to this Privacy Notice

We reserve the right to update this privacy notice at any time and will provide you with a new privacy notice when we make any substantial updates.  We may also notify you in other ways from time to time about the processing of your personal information.

16. Complaints

If you have concerns about how we use personal data, please raise this with us in the first instance.

You also have the right to complain to the Information Commissioner’s Office:

https://ico.org.uk/concerns/

Last updated: 21 April 2026

‍