‘Little SERC’ is a creche facility which has been set up by SERC (Data Controller). SERC is committed to protecting the personal data of all children and parents who avail of this facility.

To enable SERC to manage the creche and meet its statutory obligations regarding the care of children, it will be required to process personal data of both the children and persons with parental responsibility.

All data will be processed in compliance with the General Data Protection Regulations (GDPR) and the Data Protection Act (2018).

The Data Protection Officer for the College is Sian Harvey.

Purpose of Processing

Little SERC will process personal data to achieve the following benefits and outcomes:

Enable the full application, administration and care provision of children within this childcare setting
Ensure childrens health, emotional and physical needs are respected and met
Provide information to appropriate third party organisations where safeguarding concerns arise
The College will be compliant with its legal obligations in relation to both GDPR/data protection and legislation surrounding the care of children.
Customer trust by having processes and a point of contact if there are concerns about personal data

What information will we process?

The creche will collect and use personal information about children/person with parental responsibility and therefore ensure that the guidelines set down by the GDPR and Data Protection Act (2018) are followed. The data collected and handled in the creche will include information on the following areas:

Name, address, contact details of person(s) with parental responsibility (including child’s address if different)
Child’s date of birth
Emergency contacts
Medical history, allergies, social services history, cause for concerns
Medication details and consent to share in an emergency situation
Complaints and any other issues raised concerning the child or their care
Developmental records (Daily records) regarding play, behaviour, food and drink intake, toileting history and any daily concerns / observations
Daily risk assessments with potential to list staff details and care plans (eg pregnant staff or child with additional requirements)
Images
- CCTV
- Photographs based on parental consent

Where Little SERC is required to process Special Category data, we will only do so where a lawful basis exists in Article 9 of GDPR or where appropriate, Schedule 1 and 2 of the Data Protection Act (2018).

Further information is available in the SERC Appropriate Policy Document.

Lawful Basis

Little SERC will only process personal data for specified purposes and where a lawful basis exists. The lawful basis replied on for processing personal data in the creche are:

Article 6.1(a) Consent
The data subject has given consent to the processing of his or her personal data for one or more specific purposes e.g. photographs. The person with parental responsibility can provide/withdraw consent on behalf of the child.
Article 6.1(b) Contract
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract e.g. parents are entering into a contract with the creche for provision of child care.
Article 6.1(c) Legal Obligation
Processing is necessary for compliance with a legal obligation to which the controller is subject e.g. health and safety, child protection legislation

For Special Category Data, the lawful basis being relied upon will be:

Article 9.2(g) Substantial Public Interest
Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
Schedule 1, Part 2 (16) – Data Protection Act (2018)
Support for individuals with a particular disability or medical condition
Schedule 1, Part 2 (18) – Data Protection Act (2018)
Safeguarding of children and of individuals at risk.

How do we collect personal data

Little SERC will collect core personal data directly from the person with parental responsibility for the child. This information will be collected via an online registration form. There may be instances where information is obtained from third parties e.g. regulated organisations.

Data such as ‘daily records’ will be generated throughout the duration of the childs time at the creche.

Who will have access to my information, or who will you share it with?

Little SERC will only share information where there is a lawful basis to do so. Recipients of the data include:

Creche Manager/Duty Manager
Little SERC staff
Head of Health and Safety
Pastoral Care Team
HR (staff issues)
External bodies e.g. social services, law enforcement

Retention Period

Little SERC will only retain personal data for as long as necessary to fulfil the purpose we collected it for, for the purpose of satisfying any legal, accounting or reporting requirements. Little SERC will retain records in line with the Management of Records SOP and the FE Sector Retention and Disposal Schedule.

Data Subjects Rights

You have the right to:

To be informed about what we do with your information at point of data collection
Access your personal data that we process;
To rectify inaccuracies in personal data that we hold about you;
To be forgotten, that is your details to be removed from systems that we use to process your personal data
To restrict the processing of your personal data
To obtain a copy of your personal data in a commonly used electronic form
To object to certain processing of your personal data by us
To request that we stop sending you direct marketing communications
To withdraw consent – only where processing is based on consent

The person with parental responsibility may exercise the above mentioned Rights on behalf of their child.

For additional information on exercising your rights, please contact our Data Protection Officer (details below) or see our Data Protection Policy.

The Right to Lodge a Complaint

If you are not happy with how your information is being processed by the College, contact the DPO:

Data Protection Officer
SERC, Bangor Campus
Castle Park Road
Bangor
BT204TD

Email: informationrights@serc.ac.uk

If you are dissatisfied with the College response, you have a right to complain to the Information Commissioners Office (ICO).

The ICO contact details are:

Information Commissioner's Office
Wycliffe House
Water Lane
Cheshire
SK9 5AF

Tel: 0303 123 1113 or 01625 545 745

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Automated decision making

Little SERC will not use automated decision making to make decisions that will have significant impacts on data subjects.

Failure to provide personal information

If you fail to provide certain information when requested, we will not be able to fulfil our legal obligations or deliver the service you have requested.

Changes to this Privacy Notice

We reserve the right to update this privacy notice where there is a significant or unforeseen change to our processing activity. We will notify you of any updates to this notice.