Nurseries service privacy notice

The data controller for your data

Brighton & Hove City Council is the data controller for purposes of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO).

Brighton & Hove City Council are committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection law.

Why we’re collecting your data

We are collecting your data for the purpose of providing early education and childcare. Our main aim is to improve outcomes for children and families in Brighton & Hove.

What is the lawful basis for collecting your data

We have a lawful basis for collecting this data as there is a legal obligation under the Early Years Foundation Stage and Ofsted requirements.

We have a lawful basis for collecting data where it is necessary to enable us to carry out our tasks, functions, duties or powers or to perform a task carried out in the public interest. This personal data is used for:

• supporting your child’s teaching and learning
• monitoring and reporting on their progress
• providing appropriate care
• tracking and monitoring the provision

Where special category data is being processed processing is necessary for reasons of substantial public interest. Under the Data Protection Act 2018 (schedule 1 part 2) this public interest is: Statutory etc and government purposes (paragraph 6), Support for individuals with a particular disability or medical condition (paragraph 16) and Safeguarding of children and of individuals at risk (paragraph 18)

We may also collect your data for the purpose of the National Evaluation of the Troubled Families programme on the legal basis of public interest. Families with a range of problems often struggle to get the right help and support at the right time. The council is working to ensure that families with multiple issues receive coordinated help and support when it is most needed and that this help and support is delivered using a whole family approach. This help and support is funded by the national Troubled Families programme and is known locally as “Stronger Families, Stronger Communities”.

The data we may collect

We may collect personal data or special category data. The type of information collected from you is as follows:

Personal data

• Contact details; including name, address, email address, telephone number, etc.
• Date of birth
• Proof of identity
• National identifiers such as; NI numbers
• Information about your family
• Social and personal circumstances

Special category data

We may also collect Special Category (sensitive data) of personal data that may include:

• Physical or mental health details
• Racial or ethnic origin
• Gender
• Religion

Who we’ll share your data with

Your data will be shared within Brighton & Hove City Council Department for Families, Children and Learning. This includes:

• Children’s Centres: In order to inform you of other services available for you and your family, or to provide relevant additional services if you require them.
• The Early Years & Childcare team: In order to provide statistical information relating to the take up of Early Years Free Entitlement Funding
• The Performance Team: In order to monitor the use of the provision and inform decisions for service development.
• Primary Schools: Prior to starting school we will share your child’s Early Years Foundation Stage progress and outcomes.

Your data may be shared with the council’s Troubled Families programme, who will share it with the Troubled Families Analysis team at the Ministry of Housing, Communities and Local Government (MHCLG). Learn more about the Troubled Families privacy notice.

Your data may be shared with Sussex Community NHS Foundation Trust who provide the 0-19 Healthy Child Programme, but it will not be shared with them without you being informed. This information is shared to enable all agencies who are supporting children and their families to work together to provide services to best meet the needs of families.

We will not give information to anyone outside of the provision without your consent unless the law permits (for example if there are serious safeguarding concerns).

How long we’ll keep data for and why

We will keep child progress files and nursery admissions records for 3 years after a child has left the Nursery.

We will keep pre-school special educational needs (SEN) - child development files for 25 years from date of birth of the child.

We will keep child protection case records for 25 years following the date of birth of the child.

We are required to keep data relating to child sexual abuse or alleged abuse indefinitely by the Independent Inquiry into Child Sexual Abuse (IICSA).

How your data will be stored

• Your information will be stored electronically and on paper records.
• We will only make your information available to those who need to know. Example of the security measures we used are:
  • Training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong
  • We use encryption meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code. The hidden information is said to then be ‘encrypted’.
• Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it.
• Regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches).

Transferring data outside the European Economic Area

We will not transfer your data outside the European Economic Area.

Your rights over your data

Depending on the lawful basis for processing your information you may have the following rights:

• A right to a copy of data held about you, an explanation for its processing and who it has been shared with – this right applies to data processed under any lawful basis
• A right to rectification (correction) of data which is demonstrably wrong – this right applies to data processed under any lawful basis
• A right to restrict processing – this right applies if it has been shown that there is no lawful basis for processing your data, but you wish it to be retained
• A right to object to processing – this right does not apply where the council is under a legal duty to process your data, but can be used where you dispute that there is a lawful basis to process your data until the council can demonstrate what basis exists
• A right to erasure – this applies where there is no longer a lawful basis to retain you data
• A right to portability of your data (having it moved to another organisation) – this right applies only where the lawful basis was either consent or performance of a contract but data will usually be transferred to another local authority if a child in care moves to a new location.
• A right to object to automated decision making – this right is applicable under all lawful bases for processing

How to get advice or make a complaint 

Data Protection Officer 

If you have a concern about how we collect or use your personal data you can contact the Council’s Data Protection Officer.  

How to make a complaint 

We aim to resolve all complaints about how we handle personal information. You also have the right to make a complaint about data protection to the Information Commissioner's Office.  

Contact them by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or phone 0303 1231 113. 

You can also make a complaint or find out more information on the Commissioner's Office website. 

If your complaint is not about data protection, find details on how to make a complaint about a council service.