Retention Policy for GDPR
The General Data Protection Regulation is an EU law from May 2018. It requires us to share information with you about data retention after your child has left our setting.
Data we retain about you and your child falls into 3 main categories –
Safeguarding and welfare data linked to Ofsted and the Early Years Foundation Stage requirements and the Limitation Act.
Financial data retained for HMRC purposes.
Funding data retained for Local Authority purposes.
Moulton Nursery School & After School Club store data about you and your child in paper format and online.
Data relating to the Safeguarding and Welfare requirements of the EYFS
To comply with the Limitation Act 1980, we keep Accident, Injury and First Aid Records and Medication Administration Records using the legal basis of ‘legal obligation’ until your child is 21 years and 3 months old and insurance requirements.
Attached to Accident, Injury and First Aid Records and Medication Administration Records we also retain Parent – Provider Contracts and Attendance Registers using the legal basis of ‘vital interests’ to provide additional evidence of compliance with the Early Years Foundation Stage.
Moulton Nursery School & After School Club keeps further data related to Safeguarding and Welfare requirements of the Early Years Foundation Stage and Childcare Register for a ‘reasonable period of time’ (see EYFS requirement 3.71). ICO advice is that this should be retained between Ofsted inspections or within the Ofsted inspection cycle which might be between 3 and 8 years.
Information is kept in paper format and after the required retention period the documents will be shredded.
Data relating to the Learning and Development requirements of the EYFS
To comply with the EYFS, we keep documents relating to your child’s learning and development including photos of your child’s progress, activities and experiences.
We use the legal basis of ’legal obligation’ when recording your child’s learning, development and progress and ‘legitimate interest’ when taking photos of your child because we believe it is reasonable for us to process this data to provide you with a good quality service
We keep the information, including photos online & in paper format and will pass them on to you when your child leaves the setting or starts school, whichever comes first. Or delete/ shred them.
Moulton Nursery School use the online learning journey system class Dojo to share information with you about your child’s daily activities.
Financial record keeping
We keep documentation including your name and payment record for HMRC using the legal basis of ‘legal obligation’. We keep this information online & in paper format and are required to retain this information by HMRC for 6 years, after which time they are deleted.
Data relating to Local Authority funding forms
Moulton Nursery School keeps documentation including your name, address, national insurance number and tracking data for Local Authority Funding forms using the legal basis of ‘contractual necessity’. This data is held in paper format and I am required to retain these forms by the Local Authority, after which time they are shredded.
Moulton Nursery School & After School Club have been advised by the Information Commissioners Office that it is reasonable to keep a record of your mobile phone number on our mobile phone and your email address on our computer email provider for up to 1 financial year after your child leaves the setting, so I can contact you if necessary to clarify, for example, accounts information or details relating to your Tax Credits claim (if relevant). The data will be deleted after this period.
If Moulton Nursery School & After School Club close the setting, I The owner Louise Hood will keep documentation for as long as legally required by the purpose for which it was collected. There is no absolute duty to encrypt data stored online but I will keep it as securely as possible during the retention period (see Article 32 of GDPR for more information).
You have the right to ask for information held about you and your child to be withdrawn. This is called the ‘right to erasure’ in GDPR. However, if I need to keep information because it is legally required then exceptions to the ‘right to erasure’ apply. I will make a decision about each erasure request individually – please speak to me for more information.