Privacy Notice

Little Blossom Tree Nursery

This Privacy Notice explains how Little Blossom Tree Nursery, operated by Little Blossom Tree Limited, collects, uses, stores and shares personal information. It applies to children, parents and carers, prospective families, website visitors and people who contact us. We aim to handle information lawfully, fairly, transparently and with appropriate respect for children’s privacy.

1. Who is responsible for your information?

Little Blossom Tree Nursery is operated by Little Blossom Tree Limited, which is the data controller responsible for deciding how and why personal information described in this notice is processed, unless otherwise stated.

You can contact us about privacy matters, access requests, corrections, or concerns using the following details:

When contacting us about a child’s information, we may need to verify your identity and your authority to act on the child’s behalf before disclosing records.

2. Who this notice applies to

This notice applies to children attending or applying to attend the nursery; parents, carers and other family contacts; prospective families; people authorised to collect children; website visitors; and people who make enquiries, raise concerns or otherwise communicate with us.

Employees, volunteers and job applicants may receive separate privacy information covering employment and recruitment records. Where another organisation independently decides how it uses information, such as a local authority or healthcare provider, its own privacy notice may also apply.

3. Information we collect

The information we need varies according to the services we provide and our legal responsibilities. It may include:

  • Identity and family information: names, dates of birth, addresses, family relationships, parental responsibility, emergency contacts and authorised collection arrangements.
  • Admissions and contractual records: enquiries, applications, registration forms, agreed sessions, attendance, changes to bookings, invoices, payments and correspondence.
  • Funding and eligibility records: information needed to administer applicable early education entitlements and confirm eligibility with relevant authorities.
  • Health, wellbeing and care: allergies, dietary needs, medication instructions and administration records, accidents, injuries, care plans, immunisation information where relevant, and information needed to respond safely to emergencies.
  • Special educational needs and disabilities: observations, support plans, assessments, professional advice and reasonable adjustments needed to support children.
  • Learning and development: observations, assessments, progress summaries, examples of children’s work, and photographs or videos used appropriately in nursery records.
  • Safeguarding: concerns, disclosures, incident reports, referrals and communications with professionals where necessary to protect a child.
  • Communication records: emails, contact form submissions, messages, feedback, complaints and records of our responses.
  • Website and technical data: information collected through website operation, such as device and browser details, technical logs and cookies, depending on the website features in use.

Some records contain special category data, such as health information, or information about disabilities, religion or other protected characteristics where relevant. We handle this with additional care and apply an appropriate legal condition before processing it. Safeguarding records may contain particularly sensitive information and are subject to restricted access.

4. How we collect personal information

We usually collect information directly from parents and carers through registration forms, enquiries, conversations, consent forms, correspondence and day-to-day nursery activities. We also create records as we provide care, document learning, record attendance and respond to incidents.

Where lawful and relevant, we may receive information from local authorities, health professionals, other early years settings, schools, education and safeguarding services, or individuals with parental responsibility. We take reasonable steps to ensure that information is relevant, accurate and kept up to date.

5. Why we use personal information

We process information only for specified, legitimate purposes connected with operating the nursery and protecting the children in our care. These purposes include:

  • Answering enquiries, arranging visits, assessing applications and managing admissions.
  • Preparing and administering childcare agreements, booked sessions and nursery communications.
  • Providing suitable childcare, education, pastoral support and day-to-day care.
  • Understanding children’s individual routines, dietary requirements, medical needs and development.
  • Keeping attendance, accident, medication, safeguarding and other required records.
  • Responding to emergencies and contacting parents, carers or emergency contacts.
  • Planning learning experiences, monitoring progress and supporting transitions.
  • Providing appropriate support for children with special educational needs or disabilities and working with relevant professionals.
  • Managing invoices, payments, accounting and early education funding arrangements.
  • Investigating complaints, responding to requests and improving our services.
  • Meeting legal, regulatory, inspection, safeguarding, health and safety and other applicable duties.
  • Maintaining the security, integrity and operation of our premises, records and website.

We do not use personal information for purposes incompatible with those for which it was collected unless the law permits or requires us to do so.

6. Lawful bases for processing

Under UK GDPR, we must have a lawful basis for each use of personal information. Depending on the activity, this may be:

  • Contract: processing needed to provide childcare services or take steps requested before a childcare agreement is entered into.
  • Legal obligation: processing needed to comply with applicable laws and duties, including early years, safeguarding, health and safety, tax and accounting requirements.
  • Legitimate interests: processing reasonably necessary to run and protect the nursery, manage enquiries or maintain secure operations, after considering individuals’ rights and interests.
  • Consent: processing for which we ask for a genuine, specific choice, such as certain optional promotional uses of a child’s image.
  • Vital interests: processing necessary to protect a person’s life in an emergency.

Where information is special category data, we also identify an additional condition under Article 9 of UK GDPR and, where relevant, a condition under the Data Protection Act 2018. These may include explicit consent where appropriate, or conditions relating to substantial public interest, health or social care, or other legally permitted purposes. We apply any additional safeguards required by law.

Consent is not the basis for every nursery record. For example, certain safeguarding or statutory records may need to be retained or shared even if a parent objects. Where processing does rely on consent, it can be withdrawn by contacting us, without affecting earlier lawful processing.

7. Children’s records, photographs and videos

We create learning and development records to understand children’s progress, plan activities and share relevant information with families. These records may include observations, assessments, examples of work and images where appropriate.

We distinguish between recording activities for legitimate nursery purposes and using identifiable images for optional publicity. Where permission is required for publicity, including publication on our website or social media, we will request it separately and explain the proposed use. Declining optional publicity does not prevent a child from accessing childcare services.

We take care when sharing information about children and consider confidentiality, safeguarding, the rights of other children and the purpose of each disclosure. Families should not publish images of other children without appropriate permission.

8. Safeguarding and sharing information

Protecting children is a core responsibility. We may need to record and share information when there is a safeguarding concern, a risk of harm, or a legal duty to act. Where appropriate and lawful, this may take place without consent, including where seeking consent could place a child at risk or interfere with safeguarding action.

Depending on the circumstances, we may share relevant information with:

  • Local authorities and early education funding teams.
  • Ofsted and other authorised regulators or inspectors.
  • Health visitors, medical professionals, education providers and SEND support services.
  • Children’s social care, safeguarding partners, the police and emergency services.
  • Professional advisers and insurers where necessary and lawful.
  • IT, website, payment, administration and secure record-storage suppliers who provide services to us.

We share only information that is relevant to the purpose, subject to applicable legal requirements. We do not sell personal information about children or families. Where a supplier acts as our data processor, we seek appropriate contractual protections and security measures.

9. Website, forms and cookies

When someone visits our website or submits an enquiry or visit-booking form, information may be processed to display the site, respond to the request, protect the service and maintain technical functionality. Information submitted through a form is used for the purpose indicated by that form and related follow-up communications.

Cookies and similar technologies may be used for essential website functions and, where enabled, analytics or optional features. Non-essential cookies require appropriate consent where applicable. Our separate Cookie Policy explains the relevant categories and how visitors can manage their choices.

If our website links to external services, those services may have their own privacy notices. We encourage visitors to read them before submitting information.

10. International transfers

Some technology providers may process information outside the United Kingdom. Where personal information is transferred internationally, we assess the applicable data protection requirements and use a lawful transfer route, such as an adequacy regulation or appropriate contractual safeguards, together with supplementary protections where required.

You may contact us if you would like further information about safeguards relevant to your personal information.

11. Security and confidentiality

We use proportionate organisational and technical measures designed to prevent unauthorised access, loss, misuse, alteration or disclosure. These include limiting access to staff and service providers with a legitimate need, maintaining confidentiality expectations, using appropriate system security and taking care when storing or sharing sensitive records.

We review and respond to suspected personal data breaches in accordance with our legal obligations, including notification to the Information Commissioner’s Office and affected individuals where the applicable thresholds are met. No system can be guaranteed completely secure, but we work to reduce risks appropriately.

12. How long we retain records

We keep records for no longer than necessary for the purposes for which they were collected, taking account of childcare and safeguarding duties, applicable statutory requirements, potential legal claims, insurance needs, and tax or accounting obligations.

Different categories of records may have different retention periods. For example, routine enquiries may not need to be kept for as long as safeguarding, accident, financial or statutory childcare records. Retention decisions are made by reference to the nature of the information and relevant legal and professional requirements, rather than a single period for all records.

When information is no longer required, we take appropriate steps to delete, anonymise or securely dispose of it. In some cases, we may be required to retain information despite a request for deletion.

13. Your rights and how to exercise them

Subject to the conditions and exemptions in data protection law, you may have the right to:

  • Be informed about how personal information is used.
  • Request access to personal information held about you.
  • Ask us to correct inaccurate or incomplete information.
  • Request deletion in circumstances where the right to erasure applies.
  • Ask us to restrict certain processing.
  • Object to processing carried out on particular lawful bases.
  • Receive certain information in a portable format where the right applies.
  • Withdraw consent for processing based on consent.
  • Raise concerns about decisions made solely by automated means where relevant.

Children have their own data protection rights. A parent or carer may make a request on a child’s behalf where it is appropriate to do so, taking account of the child’s age, understanding, best interests and confidentiality.

To exercise a right, email info@littleblossomtree.co.uk or contact us using the details above. We may ask for information reasonably necessary to verify identity and authority. We normally respond within one calendar month, subject to lawful extensions for complex or multiple requests. There is generally no fee, although the law allows charges or refusal in limited circumstances.

14. Questions, complaints and changes to this notice

If you have a question or concern about how we handle personal information, please contact Little Blossom Tree Nursery using the contact details in section 1. We will consider your concern and explain our response.

You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. You can find information about your rights and how to complain at ico.org.uk.

We may revise this Privacy Notice when our services, technology, legal duties or information-handling practices change. The current version will be made available on our website. Where a change materially affects how personal information is used, we will provide additional information or seek consent where required by law.