Burford Preschool C.I.C.  Privacy Notice

Forresters Road
Burford
Tenbury Wells
WR15 8AT

01584 819495
Data protection officer – Jean Peters 

At Burford Preschool C.I.C. we are committed to ensuring that any personal data we hold about you and your child is protected in accordance with data protection laws and is used in line with your expectations.

We recognise that parents have a right to know that the information they share with us will be regarded as confidential, as well as to be informed about the circumstances when, and the reasons why, we obliged to share information. We record and share information about children and their families (data subjects) in line with the six principles of the General Data Protection Regulations (GDPR) (2018) which are further explained in our Privacy Notice that is given to parents at the point of registration.  The six principles state that personal data must be:

1.Processed fairly, lawfully and in a transparent manner in relation to the data subject.

2.Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.

3.Adequate, relevant and limited to what is necessary in relation to the purpose for which data is processed.

4.Accurate and where necessary, kept up to date.

5.Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed.

6.Processed in a way that ensures appropriate security of the personal data including protection against accidental loss, destruction or damage, using appropriate technical or organisational measures

We are obliged to share confidential information without authorisation from the person who provided it, or to whom it relates, if it is in the public interest. That is when:


  • it is to prevent a crime from being committed or to intervene where one may have been, or to prevent harm to a child or adult; or
  • not sharing it could be worse than the outcome of having shared it.


This privacy notice explains what personal data we collect, why we collect it, how we use it and how we protect it.

Personal details that we collect about your child include:


Child’s name, date of birth, address, health and medical needs, development needs, and any special educational needs, Ethnicity, attendance information (such as sessions attended, number of absences and absence reasons), exclusion / behavioural information, and any accident/incident data regarding your child. 

Where applicable we will obtain child protection plans from social care and health care plans from health professionals.

We will also ask for information about who has parental responsibility for your child and any court orders pertaining to your child.

Personal details that we collect about you include:

Your name, home and work address, phone numbers, email address, emergency contact details, and family details.

This information will be collected from you directly in your child’s registration form.

If you receive the two year old funding for your child or apply for the 15 - 30 hours funded childcare, we will also collect:

Your date of birth and National Insurance Number.

Why we collect personal data?

We collect personal data about you and your child to:

  • provide care and to support learning which is tailored to meet your child’s individual needs,
  • to monitor your child’s progress
  • to safeguard your child,
  • to verify your eligibility for funded childcare as applicable
  • to comply with the law regarding data sharing
  • to comply with the law regarding monitoring and reporting on any accidents/incidents to pupils arising out of or in connection with any school activity
  • to assess the quality of our Preschool services


Who this information is shared with:

  • Shropshire or Worcestershire Council
  • the Department for Education. This statutory data sharing underpins school funding and educational attainment policy and monitoring; (further information is available via https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data).
  • Executive Government Agencies of the DfE including;
  • Ofsted;
  • the Department of Health; Local Trusts include
  • Shropshire and Worcestershire Community Health NHS Trust;
  • Schools that your child attend after leaving us.
  • Health & Safety Executive (HSE)
  • Shropshire and Worcestershire Council may share information about individuals where this is likely to enable a beneficial intervention from the other public sector agencies.


Lawful Basis on which this Data is used

We collect and use personal information in order to meet our legal obligations as set out in GDPR and UK law, including those in relation to the following:

  • Article 6 and Article 9 of the GDPR 2018
  • Education Act 1996
  • The Education (Information About Individual Pupils) (England) Regulations 2013.


Protection of Data and Period of Storage

All personal data collected is stored in a lockable filing cabinet within the Preschool Setting.  This is only accessed by the Data Protection Officers and other members of the Preschool staff as necessary.  It is not accessed by Students or volunteers. 

We hold pupil data from class registers for a period of three years after their leaving date. Registration forms and any photographic evidence is destroyed as a soon as a child leaves the setting.   

However, data collected and stored concerning accidents/incidents arising out of or in connection with any preschool activity is kept until the pupil is aged 21 as the pupil affected by the incident has the legal right to make a claim relating to that incident 3 years after their 18th birthday.

Requesting Access to your Personal Data

Under GDPR parents/carers, pupils and staff have the right to request access to information about them that the Preschool holds. This is called a Subject Access Request.  To make a request for your personal information, or be given access to your child’s educational record contact Jean Peters.

Your also have the Rights to:

  • enable correction to data for accuracy.
  • request the deletion or removal of personal data where there is no compelling reason for it’s continued processing.
  • object to processing of personal data that is likely to cause, or is causing damage or distress
  • to obtain and reuse your personal data for your own purposes across different services.
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances have inaccurate personal data rectified, blocked, erased or destroyed; and
  • claim compensation for damages caused by breach of the Data Protection Regulations


If you have a concern about the way the Preschool is collecting or using your personal data, please raise the concern with the Preschool in the first instance. Alternatively, you can contact the commissioner’s officer at https://ico.org.uk/concerns