Privacy Notice

PRIVACY NOTICE – Children and Parents

Redwood Preschool is committed to ensuring that any personal data we hold about you and your child is protected in accordance with data protection laws and in line with your expectations. This privacy notice explains what personal data we collect, why we collect it, how we use it and how we protect it.

We collect and use pupil information under:

  • Education Act 1996
  • Data protection Act 1998
  • EU General Data Protection (GDPR) Article 6 and Article 9 from 25 May 2018. Article 6 says that to be lawful, data processing must comply with one of the

    1. Consent has been given to process personal data for a specific purpose
    2. It is necessary for a contract with an individual
    3. There is a legal obligation
    4. It is necessary for vital interests (eg to save a life)
    5. It is necessary for legitimate interests
    6. It is necessary for a public task which is in the public interest or has a clear basis in law.

Article 9 deals with Special Category Data (racial/ethnic origin,political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life, sexual orientation) . Lawful processing of Special Category Data must comply with one Article 6 condition and one of the following:

  1. Consent has been given to process the data for a specific purpose
  2. It is necessary for vital interests
  3. There is an obligation under employment, collective agreement, social security or social protection law
  4. It is processed by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim
  5. It is already made public by the data subject.
  6. It is used for the establishment, exercise or defence of legal claims
  7. It is necessary for reasons of substantial public interest
  8. It is necessary for health reasons – the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis and the provision of health or social care
  9. It is necessary in the interests of public health
  10. It is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

What personal data do we collect and process?

Personal details we collect about your child include their name, date of birth, address, sibling’s names and ages, health and medical needs (GP and Health Visitor), developmental needs, special educational needs and disabilities, ethnicity, religion, language and dietary requirements. We ask for all these details on your child’s enrolment form.

We will also ask for information about who has parental responsibility and about any court orders relating to your child where relevant.

Personal details we collect about you (one or both parents) include your name and address, all telephone numbers on which you can be contacted, your email address, your job title and hours of work, your ethnicity and your religion. We ask for all these details on your child’s enrolment form.

We also ask for the names and contact details of at least two emergency contacts and will assume that you have permission to give these to us.

Where applicable we will obtain child protection plans from social care and health care plans from health professionals.

While your child is with us we collect information about their attendance and punctuality in our registers; about their achievements and attainment in our Records of Achievement; about accidents they may have in our accident records; and about accidents and injuries that occur outside the setting on our welfare forms.

If you apply for a Free Early Education Entitlement (FEEE) funded 2 year old place or for 30 hours FEEE we will also collect your National Insurance Number and date of birth or Unique Taxpayer Reference (UTR) to use when we check your eligibility. We ask all parents to volunteer information about what benefits and family credits that they are in receipt of on our Early Years Pupil Premium (EYPP) voluntary registration form so that we can check whether your child is entitled to EYPP Funding.

Why do we collect and process personal data?

We collect personal data about you and your child to provide care and learning that is tailored to meet your child’s individual needs. This enables us to fulfil the contractual arrangement you enter into with us when you enrol your child at Redwood Preschool. It enables us to contact you in the case of an emergency; support your child’s wellbeing and development; assess your child’s progress and plan to support their development; manage any special educational, health or medical needs that your child may have; maintain contact with you about your child’s progress; and keep you updated with information about our service.

We also collect personal information to:

  • Verify your eligibility for free childcare as applicable
  • Provide information via statutory returns to the Department for Education (DfE)
  • Provide child level headcount data to the London Borough of Waltham Forest for funding payments
  • Cooperate with the London Borough of Waltham Forest and external partners to improve the wellbeing of children under the Children Act 2004
  • Share information with the London Borough of Waltham Forest and external partners to support the duty to safeguard and promote the welfare of children under the Children Act 1989

Who do we share personal data with?

Much of the personal information that we collect about you and your child is held within the preschool. It is shared only with the staff who work here to fulfil our contractual obligation to provide childcare and education. If we have concerns about your child’s development and learning, these will always be shared with you first and we will seek written permission to share information with other professionals, for example,Speech and Language Therapists, Educational Psychologists, the Area SENCO.

We do not share information about our pupils with anyone without consent unless the law or our policies allow us to do so. We routinely share information relating to your child with:

  • Other early years providers and schools/academy chains/federations/Multi Academy Trusts (MATs) that children transfer to when they leave Redwood Preschool
  • The government’s funding eligibility checker
  • The London Borough of Waltham Forest
  • The Department for Education
  • Ofsted – during an inspection or following a complaint about our service

Further information about the statutory requirements for data collection are included at the end of this privacy notice.

We will also share your data:

  • If we are legally required to do so, for example, by law, by a court or by the Charity Commission or Companies House
  • To enforce or apply the terms and conditions of your contract with us
  • To protect your child and other children, for example by sharing information with social care or the police
  • If it is necessary to protect our own or other’s rights, property and safety

We will never share your data with any other organisations to use for their own purposes.

We do not make any decisions about your child based on automated decision making.

How do we protect personal data?

We prevent unauthorised access to personal data and prevent it from being lost, accidentally destroyed, misused or disclosed by:

  • storing all paper-based records in locked filing cabinets, cupboards or offices which are not in the areas of the preschool which are accessible to the public.
  • Processing and storing electronic records on password protected computers which can be accessed only by authorised personnel (and on a ‘need to know’ basis.)
  • The use of password protected memory sticks. We have strict guidelines as to their use and do spot checks.
  • Clear policies relating to record keeping and data sharing.

For how long do we retain personal data?

We keep your child’s personal information for up to 3 years after your child no longer attends the preschool, or until the next Ofsted inspection after your child leaves. The registers, medication record books and children’s accident records will be kept for at least this time (as is the legal requirement) but may be retained until the child reaches 21 years and 3 months of age (as is recommended), subject to safe storage being available. Records of any reportable death, injury, disease or dangerous occurrence will be kept for 3 years (RIDDOR).

Your rights with respect to personal data

Under data protection legislation, you have a right to request access to information that we hold about you and your child. You also have a right to:

  • Object to the processing of personal data that is likely to cause, or is causing, damage or distress
  • Prevent processing for the purpose of direct marketing
  • Object to decisions being taken by automated means
  • In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed and
  • Claim compensation for damages caused by a breach of the data protection regulations.

To be given access to your child’s educational record (the Record of Achievement), please talk to your child’s keyworker. This document is kept in the preschool while your child is attending but will be given to you when they leave. For access to other personal information that we hold, please contact our Data Protection Controller (the Office Manager).

If you have a concern about the way in which we are collecting or using personal data, you should raise your concern with the Office Manager or the Preschool Coordinator in the first instance. If you continue to have concerns about the way data is handled and remain dissatisfied after raising your concern with us, you have a right to contact the Information Commissioner’s Office (ICO). This can be done online at or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Changes to this notice

We will keep this notice under review. You will be notified of any changes where appropriate.

If you have any questions about anything in this Privacy Notice, please contact the Office Manager in the main office.

Redwood Preschool
Date of issue: May 2018

Further information about statutory data collection requirements
(Information provided by Waltham Forest Local Authority, January 2018)

The individual level data collection from PVI settings is a statutory requirement of providers and local authorities through regulations under Section 99 of the Childcare Act 2006 and The Education (Provision of Information About Young Children) (England) Regulations 2009.

To find out more about the data collection requirements placed on us by the Department for Education go to

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the pupil information we share with the department, for the purpose of data collections, go to

To find out more about the NPD, go to

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested: and
  • the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:

To contact DfE: