We collect personal information from you about yourself and your child. This includes data relating to:

• Addresses;
• Dates of Birth;
• National Insurance Numbers;
• Passport numbers;
• Birth Certificates Details;
• Driving Licence numbers;
• ID card information;
• Personal telephone numbers;
• Email addresses.

We may also collect special category data about your child from yourself; this would include ethnicity, special educational needs and medical/dietary information, safeguarding information relating to accidents and injuries, developmental information.

We collect information in these ways:

• Directly from you via your application form, booking form and parent consent forms.
• From your child as part of an on-going recording of their progress, this may include photos, recordings and observations, CCTV etc.
• From external agencies such as Children's Social Care, Local Authority, GP's, Health Professionals.

We use the personal data of you and your child:

• For management /child records;
• To support the learning and inform teaching of your child;
• To enable us to provide appropriate care;
• To enable us to monitor and report on your child’s development.

Please read our full list of all the reasons for using your personal information. This shows the legal basis that we use for processing your information. This is typically as part of a contractual arrangement with you to supply a pre-school service to your child and may also be a legal obligation or legitimate interest. We will seek your consent to use your own or your child's data outside this arrangement.

The Pre-School Centre is part of Lancaster University and will share personal data with other departments within the University on a need to know basis. This may include your financial information and contact details.

The University will share your personal data with a number of different organisations including:

• Lancashire County Council /or Local County Council;
• Nursery Management Software;
• Children’s Social Care;
• Local safeguarding board.

In emergency situations i.e. a life or death situation the University may share your personal data, including sensitive personal data with organisations/individuals such as a medical professional or the police service.

Information sharing:

• Is undertaken to provide early interventions and to achieve positive outcomes for the family/child;
• Information sharing with other professionals will take place where there is a clear and legitimate reason to do so. Where there is an identified need or a request is received to share information, consent from a person with parental responsibility for the child will be requested in the majority of cases;
• There are circumstances when consent would not be sought and where the child or family will not be informed that information has been shared.

Examples of these are if doing so would:

• place a person (the individual, family member or a third party) at increased risk of significant harm;
• prejudice the prevention, detection or prosecution of a serious crime; or
• lead to an unjustified delay in making enquiries about allegations of significant harm to a child, or serious harm to an adult.

The University will ensure that sharing of data is in line with data protection legislation. In many cases the University does not need to seek your consent to share this information, in particular when there is a legal or statutory obligation to provide the information.

Please see our full list of all the different organisations that the University may share your data with.

The University has robust Information Security policies in place to protect your information. All staff in the University have a responsibility to make sure that your data is handled securely.

For further information please refer to the University’s Information Security Policy.

• Accident records are retained in an electronic file store until the child reaches the age of 21 years and 3 months;
• Child protection records are retained until the child reaches the age of 24 years;
• SENCO records are retained for 7 years after the child has left the Centre;
• Application forms & Booking forms are retained in an electronic file store for up to 3 years after the child has left the Centre;
• Registers of attendance are retained for a period of 3 years;
• Electronic learning journals are retained for a period of up to 3 years after the child has left the Centre.

For further information please refer to the University’s retention schedule.

You have the following rights regarding your own and your child’s personal data:

• To have access to your personal data - for further information see the Subject Access page;
• To have inaccurate or incomplete personal data amended;
• To have your personal data deleted – this will only apply when there is no legitimate reason for the University to continue to use your personal data;
• To restrict the use of your personal data;
• To request personal information in a digital form so that you can provide to other organisations;
• To object to automated decision making and profiling;
• To withdraw consent when we have used consent as the basis for using your information.

The University has further information on data subject rights.

If you wish to exercise your rights you are advised to first read this information as there are some exceptions to using your rights.

For example: If significant concerns have been raised about a child and there is reason to suspect the child is being abused or neglected or is likely to be abused the Pre-School Centre is duty bound to consult Children’s Social Care.

In these cases you could not apply to restrict this use of your information.

Any requests to use your rights over your personal data should be made to Lancaster University's designated Data Protection Officer.

You are required to read this Privacy Notice when you first register your child at the Pre-School Centre.

It is important that you do this so you understand how we use your personal information and your rights.

Please assist the University in keeping your own and your child’s record up to date by notifying us of any changes e.g. phone number, address.

Lancaster University’s designated Data Protection Officer is:

Mike Abbotts, Information Governance Manager
Email: compliance@lancaster.ac.uk

Contact Mike if you have any concerns or complaints about this Notice or about the way your personal data is being used.

Lancaster University is the Data Controller for the personal data that it holds about you. The University’s contact details are:

Lancaster University
Bailrigg
Lancaster
LA1 4YW
United Kingdom

If you are not happy with the way the University has handled your concern or complaint then you may submit a complaint to the Information Commissioner’s Office.

This Notice has been developed to be compliant with the General Data Protection Regulations (GDPR). This Notice is regularly reviewed and sometimes updated. It is important that you check for updates to this Notice. If we make significant changes we will contact you to inform you of this.