Whytebeams Nursery Privacy Notice

Whytebeams Nursery, will comply with the Data Protection Act 1998 and the General Data Protection Regulation (GDPR). The purpose of our privacy policy is to inform you about how your data is being handled. Whytebeams Nursery is registered with the UK Information Commissioners Office (ICO) reference number Z7870795.

Whytebeams Nursery is the Data Controller for the purposes of the Data Protection Act.

Why we collect and use pupil data:

  • To effectively meet children’s personal, social and academic needs and to support their general wellbeing, ensuring we take appropriate care of each child.

  • To support children’s learning and development.

  • To monitor and report on children’s progress.

  • To ensure parent access to Tapestry.

  • To comply with our safeguarding duties.

  • To assess the quality of our services and to enable us to raise standards.

  • To comply with the law regarding data sharing.

  • To ensure that we receive early years funding.

  • To meet statutory requirements to collect and provide information that the local authority require.

  • To meet legal obligations under the EYFS Early Years Statutory Framework 2017 and Education Act 1996.

What information we collect

Whilst the majority of information you provide to us is mandatory and part of our contract with you, some of it is voluntary.

For each child we collect and store a file containing hardcopies of enrolment forms, background information and permission slips. Files are kept securely in a locked cupboard and passed on to the child’s next setting or school.

The categories of information that we collect and hold:

In order to comply with GDPR please note, information in italics is given voluntarily and may be withdrawn by emailing whytebeams@hotmail.co.uk

  • Personal information - collected via our enrolment form and completed by parents, such as: child’s name, date of birth, address, parent’s names and contact details, who has parental/legal responsibility, details of family members, parents and siblings and ages, dietary and health requirements, medical and allergy information, immunisations, doctor’s name, address and contact details, name and telephone numbers of friends or relatives who may be contacted in an emergency and of other persons authorised to collect the child and collection password set by parents.




  • Characteristics - such as ethnicity, language, nationality, general information about the child – first language and other languages spoken at home, if the child has a child protection plan in place and if the child has been referred to any professional service or is under the care of other professionals(eg. SALT, OT, Social Services) likes and dislikes, eating and sleeping and toilet habits, pets and comfort toys, special words used by the child and who has cared for them previously, and any other information parents see as relevant.

  • Permissions – detailing what we have your permission to do with regard to wipes, suncream, medication, accompanying your child in an emergency, photos, videos, keeping EYFS records and asking for your agreements to uphold our safeguarding duties.

  • EYFSP - Early Years Foundation Stage Profile, including Tracking Progress and Development form, 2 years check if applicable,Transfer Sheet.

  • Attendance information - such as sessions attended, number of absences and reasons for absence.

  • Other information - such as the child’s requested start date, requested sessions and date they are expected to start school. Other notes on parental meetings, parent’s comments and keyworker notes.

  • SEN – notes are kept if children have special educational needs.

  • NHS letters - in relation to a child’s specific medical need or condition.

  • Family photos - provided by parents.

Tapestry Record and Data

We use a software package called Tapestry which is an online learning journal of children’s progress. We send parents a link inviting them to join Tapestry and view and accept their terms and conditions. This enables parents to see their child’s learning journey and add their own notes and comments. Staff input and upload observations, notes, photos and videos via Tapestry. Observations are then categorised under the EYFS framework and published or uploaded. Tapestry generates further assessments which help staff track children’s progress. Please see Tapestry’s Privacy Policy for full details. www.tapestry.info/privacy

What personal information we enter onto Tapestry:

  • Child’s name, date of birth, parents’ names and email addresses, for the purpose of creating and sharing their child’s learning journal with them.

When childen leave Whytebeams parents can download their childs tapestry journal. Once the child leaves, we make the account inactive unless parents have another child with us. If the child moves to a setting which uses Tapestry the file may be transferred.




Other information we collect, store and may share

  • Incident and accident forms and behaviour logs

  • Records of medication given to children whilst in our care

  • Safeguarding logs and concerns

  • Attendance information kept in our register (such as sessions attended, number of absences and absence reasons)

  • Complaints

  • Staff records, contract, supervision agreements, supervision discussion notes, appraisals, references, DBS checks, grievance or disciplinary notes

Funding Forms, EYPP and DAF

The information on funding forms is collected for our Local Authority, Croydon Council, for the purpose of providing government funding and ascertaining eligibility. We collect the following information from parents via the ‘Croydon Free Entitlement Parental/Carer Agreement.’ These are stored securely in a locked filing cabinet.

  • Child’s name, date of birth, parents’ names, family address, number of funded weeks claimed per term, parents’ signatures.

  • For families receiving benefits: parents’ names, child’s date of birth, National Insurance numbers and or National Asylum Support Service Number (NASS).This may enable us to claim additional funding called EYPP (Early Years Pupil Premium.)

  • For children aged 3-4 in receipt of child Disability Living Allowance and claiming funding, the child’s DLA reference is requested so we may claim Disability Access Fund (DAF).

To claim funding we use collect and share the following personal data with our local authority at Croydon Council via their secure online portal. Croydon Council are the data controller for all early years funding information.

  • Child’s full name, date of birth, address, ethnicity, first language and gender.

Croydon Council shares some of the information we provide with the Department for Education (DfE). Croydon Council’s Privacy Policy can be viewed at


To find out more about the data collection by the DfE go to


To contact DfE: https://www.gov.uk/contact-dfe







Data is held securely. We are a ‘pack away’ setting and rent our promises from St John the Baptist Church. We have our own storage cupboards and lockable areas within the Church Hall. We keep paper records in our own locked cupboards and filing cabinets. Laptops and ipads are password and pin protected and laptops have antivirus software. Confidential documents and data are kept in a locked filing cabinet within a locked cupboard. Only the manager and deputy have access to this.

Retention Periods

We adhere to retention periods as laid out in our retention policy and according to the relevant authority. Data is destroyed securely once these periods have passed.

Sharing Data

We routinely share information with:


  • Settings or schools that the child will attend after leaving us

  • our local authority Croydon Council on a statutory basis

  • NHS professionals involved in the child’s care

Why we share information

We are required to share data with the Local Authority on a statutory basis. This data sharing underpins nursery funding and educational attainment policy and monitoring. We do not share information about our children or families with anyone without consent unless the law or our policies allow us to do so.

The lawful basis on which we use this information : as reflected in Article 6 of the General Data Protection Regulation May 2018 which states ‘Processing shall be lawful only if and to the extent that processing is necessary for compliance with a legal obligation to which the controller is subject.’

  • Pupil data is collected, stored and may be shared on a statutory basis as required by our local authority under the Education Act 1996. This is a ‘Legal Obligation’

  • Pupil data collected on a voluntary basis and the legal basis for this is ‘consent.’

  • For children with a specific medical condition we collect, keep and share data on the legal basis that it is part of our ‘contract.’

  • We use parents’ email addresses to send invoices and important communications to them by email. The legal basis for this is that it is part of our ‘contract.’




Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or to be given access to your child’s educational record, contact Kate Searle, Nursery Administrator at whytebeams@hotmail.co.uk

You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress

  • object to decisions being taken by automated means

  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and

  • claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

Further information




If you would like to discuss anything in this privacy notice, please contact:

Whytebeams Nursery, St John The Baptist Church Centre, 48 Dale Road, Purley, Surrey, CR8 2EF. Email : whytebeams@hotmail.co.uk