GDPR Privacy Policy for Beehive Pre‑School Playgroup

1. Introduction

This privacy policy explains how Beehive Pre‑School Playgroup collects, uses, stores, and protects personal information about children and their families. We are committed to safeguarding your data and ensuring it is handled lawfully, fairly, and transparently in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

We collect information necessary to provide a safe, high‑quality early years setting. This may include the following:

  • Child information — name, date of birth, address, medical details, dietary needs, learning and development records, attendance, safeguarding information.
  • Parent/carer information — names, contact details, emergency contacts, parental responsibility details.
  • Funding and financial information — eligibility codes, invoices, payment records.
  • Photographs and videos — used for learning journals, displays, and (with consent) promotional materials.
  • Website or digital communication data — if you contact us online or use our website.

3. Why We Collect This Data

We use personal data for the following:

  • Providing early years education and care
  • Meeting statutory requirements (e.g., safeguarding, EYFS assessments, Ofsted inspections)
  • Communicating with parents and carers
  • Managing funding, billing, and financial records
  • Ensuring children’s health, safety, and wellbeing
  • Supporting children’s learning and development
  • Organising trips, events, and activities
  • Maintaining secure administrative and operational systems

We only collect what is necessary for these purposes.

4. Lawful Bases for Processing

We process personal data under the following lawful bases:

  • Legal obligation — complying with EYFS, safeguarding, and Ofsted requirements
  • Public task — delivering early years education
  • Contract — providing childcare services to your family
  • Vital interests — protecting a child in an emergency
  • Consent — for optional activities such as photos for marketing or additional services

Where consent is used, you may withdraw it at any time.

5. How We Store and Protect Your Data

We take data security seriously. Personal information is:

  • Stored securely in locked cabinets or password‑protected digital systems
  • Accessed only by authorised staff and trustees who need it to perform their role
  • Retained only for the minimum period required by law or guidance
  • Disposed of securely when no longer needed

We regularly review our data protection practices to ensure ongoing compliance.

6. Sharing Your Data

We only share personal information when necessary and appropriate. This may include sharing with:

  • Local authorities (e.g., for funding or safeguarding)
  • Ofsted
  • Health professionals (e.g., speech therapists, health visitors)
  • Emergency services
  • Software providers used for secure record‑keeping or communication
  • External activity providers (with parental consent)

We never sell personal data or use it for marketing without explicit permission.

7. Your Rights Under GDPR

Parents and carers have the right to:

  • Access the personal data we hold about you or your child
  • Request corrections to inaccurate information
  • Request deletion of data (where legally permitted)
  • Object to or restrict certain types of processing
  • Withdraw consent at any time
  • Receive information in a clear, transparent format

Requests can be made verbally or in writing, and we will respond within one month.

8. How Long We Keep Data

We follow statutory retention periods, including:

  • Child records — until the child reaches age 21 (or 24 if safeguarding concerns apply)
  • Accident and incident forms — as required by law
  • Financial records — 6 years
  • Photos — only while consent is valid or until the child leaves (unless otherwise agreed)

A full retention schedule is available on request.

9. Contact Details

If you have questions about this policy or wish to exercise your data rights, please contact:

Data Protection Lead: Liz Vogel
Email: beehive123@hotmail.co.uk
Address: Beehive Pre‑School Playgroup, Bray Road, York, YO10 4JG

If you are not satisfied with our response, you may contact the Information Commissioner’s Office (ICO) for further guidance.

10. Updates to This Policy

We may update this policy from time to time to reflect changes in legislation or our practices. The most recent version will always be available on our website, on your child’s Tapestry account or from the office.