Paint Pots Montessori Schools Data Protection Policy Last updated May 2018
About Paint Pots
This document sets out the personal-data protection policy for Paint Pots (also trading as Paint Pots Montessori Schools LTD), Company No. 05446065, registered in the United Kingdom at this address: 342 Regents Park Road, London, England, N3 2LJ. Information about Paint Pots Montessori Schools is available at www.paint-pots.co.uk and on request (see contact details at the end of this page).
The personal data processed by Paint Pots Montessori School comprises information about children who are (or were or will be) enrolled at the settings, and those children’s parents and carers (and other authorised child services professionals) and staff who are teaching or have previously taught in the settings.
The personal data processed by Paint Pots Montessori Schools is derived from information that individuals provide about themselves. Parents also provide information about their children. All personal data is processed exclusively for the purposes of fulfilling Paint Pots Montessori School legal obligations to ensure that we operate and administer safe and secure child care and effective early-years education; communicate with the parents or carers of children enrolled in their settings; and meet the setting’s statutory record-keeping obligations under the Early Years Foundation Stage (EYFS) statutory framework (DFE-00169-2017).
Twice a year Paint Pots Montessori Schools review their Policies and Procedures; when these involve the processing of personal data, a Summary Data Audit is performed and, where needed, changes to our processes are implemented to ensure continuing data privacy and protection.
About This Document
Montessori Schools Commitments
Paint Pots Montessori Schools (also trading as Paint Pots Montessori Schools LTD) commits and agrees:
- To apply best practice in keeping personal data safe, secure and private
- To process personal data only for the intended purposes of the Nursery Schools & Creative Classes
- To retain personal data only for as long as it is needed for its intended purposes
- To only share personal data with third parties where legally required as stated in our Policies & Procedures
- Never to sell personal data, data summaries, or data derivatives, to anyone
- To enable the individual subjects of personal data to correct or delete their data.
- To use any Personal Data reasonably and responsibly for the benefit of the individual * To use information and images for child-care and educational purposes only. If Paint Pots has received parental consent, information and images may be used for promotional purposes on our website and prospectus.
- To protect and ensure the confidentiality of the information and images stored
- Our Teachers will never share, upload, post, distribute or publish any of the information or images outside of Paint Pots
- To record only what is true and accurate, and nothing that is harmful or exploitative
- Never to use the information or images or parts thereof in any way that is unlawful.
Paint Pots Montessori Schools may be compelled to surrender particular personal data to legal authorities without express consent if presented with a court subpoena or similar legal order, or as required or permitted by the laws, rules and regulations of any applicable jurisdiction. Also, in the event of a violation of its agreements, including but not limited to a violation of any restrictions on the use of data provided, Paint Pots Montessori Schools may be compelled to disclose particular personal data to affected parties and legal authorities in furtherance of potential or on-going legal proceedings.
What Personal Data we keep and why we keep it
Individuals Who Attend Paint Pots Montessori Nursery Schools All individuals who are the subject of personal data are defined within this document as STAFF, NURSERY SCHOOL CHILDREN, UNACCOMPANIED CREATIVE CLASSES CHILDREN, ACCOMPANIED CREATIVE CLASSES CHILDREN, PARENTS AND CARERS
The contact data we store: NURSERY SCHOOL CHILDREN & UNACCOMPANIED CREATIVE CLASSES CHILDREN includes emergency contact person’s details, doctor’s details. PARENTS AND CARERS contact number, address, email address. STAFF emergency contact person’s details, address, telephone, email address.
LAWFUL BASIS: contractual system administration, setting operations and communications, statutory and local authority requirements, child health and safety, reporting to: parents and carers, local authorities and their agents, OFSTED.
The personal data we store: NUSERY SCHOOL CHILDREN includes name, news, accidents, incidents, medication, allergies, dietary requirements, medical conditions, child’s home life, teacher actions, parent notes, consultations, attendance, reasons for absence, teacher/manager comments, religion, nationality, ethnicity, languages spoken, passport/birth certificate, date of birth, gender. Developmental progress – learning activities performed when and at what level, notes by teachers including critical insights, noted behaviours, development notes and comments, next steps and plans. Reporting and profiling – My Montessori Child Learning Album photos, dates and notes, parent-site observation archive, parent-site development snapshot, parent-site reports, parent-site work portfolio, ABC123 table, Montessori Profile, EYFS Profile, EYFS Profile [Parents], EYFS Progress Check at Age Two, EYFS Checklist, EYFS Child Status table, EYFS Child Percentages table, EYFS Child Progress table, Reports for next schools.
UNACCOMPANIED CREATIVE CLASSES CHILDREN includes name, news, accidents, incidents, medication, allergies, dietary requirements, medical conditions, child’s home life, teacher actions, parent notes, consultations, attendance, reasons for absence, teacher/manager comments, date of birth, gender.
ACCOMPANIED CREATIVE CLASSES includes name, accidents, date of birth, gender, medication, incidents, allergies, dietary requirements, medical conditions. Page | 4 Lucy Patterson (Data Protection Officer for Paint Pots Montessori Schools) email@example.com
PARENTS AND CARERS name, consultations, child safeguarding, consent forms, policy & procedure acceptances, terms & conditions acceptances, bank details for refunds and correspondence history.
STAFF name, policy acceptances, date of birth, signatures, CV, DBS, training certificates, references, appraisal, disciplinary & supervision documents, paternity documents, meeting minutes, bank details, NI numbers, tax code, pension, passport/work permit and correspondence history.
LAWFUL BASIS: Paint Pots Montessori Schools management, contractual system administration, setting operations and communications, setting security, statutory and local authority requirements, child health and safety, child development tracking and planning, reporting to: parents and carers, local authorities and their agents, OFSTED, and the child’s next school Photographs, Images & Film Photos and images of: NURSERY SCHOOL CHILDREN profile photo, individual activity photos, work portfolio photos, group activity photos, class activity photos, class activity videos, activity photos at home, home news photos, accident photos, incident photos, medication photos, intervention photos, document images UNACCOMPANIED & ACCOMPANIED CREATIVE CLASSES class activity photos (with consent) PARENTS AND CARERS profile photo, signature images STAFF profile photo, document images, signature images LAWFUL BASIS: contractual system administration, setting operations and communications, setting security, statutory and local authority requirements, child safeguarding, child health and safety, child development tracking and planning.
Who Can Access Personal Data
Paint Pots Montessori Schools STAFF are bound to keep all the above personal data strictly confidential by the terms of our Paint Pots Employee Agreements. Listed here are the types of Individuals whose data we store and which categories of personal data each individual is given access to: CHILDREN (with the help of setting staff or their parents or carers) can access their My Montessori Child Profile PARENTS AND CARERS can access: their child’s My Montessori Child profile (as determined by the setting’s managers); photos and images of other children in the same class who may appear in the background of their own children’s activity photo, group photos or during daily registration, as well as other children in the same class who may appear in class photos and class videos; personal details of setting staff and selected contact details of other parents and carers of children in the same class (as determined by those other parents and carers); the hard copy of the EYFS Learning Record. STAFF are allowed to access: names and contact details of children, parents and carers, child service professionals and setting staff; administrative details of children (unless restricted), and parents and carers; developmental progress of children; photos and images of children, parents and carers, and setting and reporting and profiling of children. Staff contact details (Address, Telephone, Email, Day & Month of birth, Emergency Contact)
Head Teachers, Deputy Head Teachers, Creative Classes Managers & Office Staff can access: My Montessori Child staff (personal device brand-model-descriptions, login dates and times); HR Documents (Policy Acceptances, CV, DBS, Training Certificates, References, Appraisal Documents, Maternity documents, hard copy Signatures)
Principal, Vice Principal, School Bursar & Office Manager can access: My Montessori Child staff (personal device brand-model-descriptions, login dates and times); HR Documents (Disciplinary & Supervision documents, Email Correspondence, Meeting Minutes, Bank Details, NI Numbers, Tax Code, Pension, Passport/Work Permit, Salary, Contract, Digital Signatures)
How Personal Data Is Stored & Protected
Paint Pots Montessori Schools utilises these and other information security ‘best practices’:
- All physical personal data stored in our schools is kept in a locked cupboard and our office is only accessible to authorised staff.
- All electronic personal data stored in our settings is kept on password protected devices that are full updated with the latest Software, Anti-Virus & Malware protection.
- All third party application used (such as My Montessori Child) are secure and encrypted.
- All personal data transmitted between our settings will be encrypted.
- A GDPR-compliant, hosting service (Merlin Multimedia) is used for server maintenance, back up, security patching, and disaster recovery.
- Contractual data privacy restrictions and GDPR-compliant data protection policies are applied to and enforced with vendors and third parties.
- All portable devices used outside of or transported between our settings are password protected and encrypted.
- There will be occasions where it is necessary to transfer paper records between settings. When physical documents are transferred between settings, they are sent contained within a folder, are not in transit for any longer than necessary and are not left in an unattended vehicle. When being transported via public transport the bag/case containing paper records is kept in hand at all times.
How Long Personal Data Is Stored
All CHILDREN learning records are kept for 7 years.
All CHILDREN serious accident reports are kept until the CHILD turns 21 years and 3 months. The daily accident/incident books are reviewed on completion and destroyed.
All CHILDREN safeguarding records are kept until the child turns 25 years old.
All other CHILDREN, PARENTS AND CARERS personal data are kept for 7 years.
All STAFF personal data is kept for 10 years
All STAFF health records if recorded, are kept for 40 years from the last date of entry.
International Transfers Of Personal Data
Users in the United Kingdom should be aware that all personal data Paint Pots Montessori Schools records, processes and stores is housed on servers in the United Kingdom and that no data is transferred by Paint Pots Montessori Schools to other countries for processing.
Opting Out Of Personal Data
Every piece of Personal Data held by Paint Pots Montessori Schools is volunteered. The majority of Personal Data that Paint Pots requests is a legal requirement as outlined by the Local Authority, OFSTED, the Department of Education or UK Law. We request some Personal Data for the execution of best practice in the interest of you and your child. Should you wish to opt out of any submission of Personal Data please contact our Data Protection Officer (details below) for a full list of optionally submitted Personal Data.
Viewing, Correcting Or Deleting Data
Any individual STAFF member or PARENT OR CARER, in respect of their personal data stored by Paint Pots Montessori Schools (or, in the case of parents and carers, in respect of personal data stored about their CHILDREN), is entitled to the following:
- To view any of their stored personal data (or, in the case of a parent or carer, any of the personal data stored about their child)
- To question the veracity of any of their personal data (or, in the case of a parent or carer, any of the personal data stored about their child) and to have false information corrected
- To require the permanent deletion of any of their personal data (or, in the case of a parent or carer, any of the personal data stored about their child) if not contrary to legal obligations a required by statutory and local authority requirements, OFSTED, child safeguarding, child health and safety. However, if certain data is deleted permanently, Paint Pots Montessori Schools will be unable to provide some or all of its services in relation to that individual (or, in the case of a parent or carer, in relation to their child). Individuals wishing to do any of the above should first put their request in writing to the managers of the setting. The setting’s managers will then instruct our Schools Registrar and a response and schedule of action will be provided to the requesting individual within 30 days of the setting’s instruction.
Where necessary we share personal data with third party companies. All of the below companies are GDPR compliant.
My Montessori Child – Nursery School CHILDREN Records
Merlin Multimedia – Web & Email Server Hosting / IT Support
Mail Chimp – Email Mailouts
Natwest – Bank Transfers to PARENTS & STAFF
Smart Pension – STAFF company pension
Sage – Payroll information of STAFF
Brooks Green – Company Accounting
Office 0365 – One drive electronic document transfer & Encrypted Email
Local Authorities – Nursery School CHILDREN & PARENTS personal data
OFSTED – Nursery School CHILDREN & PARENTS personal data
TMG – DBS Checks of STAFF
Peninsula – HR Advice in relation to STAFF
Graduating Schools – Nursery School CHILDREN Records
Data Officer Contact Details:
Lucy Patterson (Data Protection Officer for Paint Pots Montessori Schools) firstname.lastname@example.org