Privacy Notice

Data controller

Incy Wincys Limited

Address

Amen House, Bedale, North Yorkshire, DL8 1XA

ICO registration

Z8333108

Email

enquries@incywincys.com

Telephone

01677 425550

1. About this Privacy Notice

Incy Wincys Limited takes the privacy and security of personal information seriously.

As a children's day nursery, we need to collect and use personal information about children, parents and carers, prospective families and other people connected with the children in our care. Some of this information is sensitive and requires particular protection.

This Privacy Notice explains what personal information we collect, why we use it, how we protect it, who we may share it with and the rights individuals have in relation to it.

It applies to prospective, current and former children and their parents or carers, people making enquiries about our nursery, emergency contacts, authorised collectors and visitors to our premises or website. Separate privacy arrangements may apply to employees, workers, volunteers and job applicants.

2. Who We Are

Incy Wincys Limited is the data controller responsible for the personal information described in this notice.

  • Registered nursery: Incy Wincys Limited, Amen House, Bedale, North Yorkshire, DL8 1XA
  • Ofsted registration number: EY357260
  • Information Commissioner's Office registration reference: Z8333108
  • Email: enquries@incywincys.com
  • Telephone: 01677 425550

Questions about this notice or the way we use personal information should be directed to the Nursery Manager using the contact details above.

3. Data Protection Law

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, changes introduced by the Data (Use and Access) Act 2025.

We also have obligations arising from legislation and statutory requirements relevant to early education and childcare, including the Early Years Foundation Stage statutory framework, safeguarding requirements, health and safety requirements and early years funding arrangements.

4. The Principles We Follow

When processing personal information, we aim to ensure that it is:

  • used lawfully, fairly and transparently;
  • collected for specified and legitimate purposes;
  • adequate, relevant and limited to what we need;
  • accurate and kept up to date where necessary;
  • retained for no longer than necessary;
  • kept appropriately secure; and
  • handled in a way that respects individuals' rights.

Children's personal information merits particular protection, and we take this into account when deciding how children's information is collected, used, shared and retained.

5. Information We May Collect About Children

Depending on the circumstances, we may collect and process:

  • name, address, date of birth and sex;
  • parent, carer and family details;
  • contact and emergency contact information;
  • attendance records and contracted sessions;
  • arrival and collection information;
  • photographs and video images;
  • observations, learning and development records;
  • information required for the Early Years Foundation Stage;
  • information concerning additional or special educational needs;
  • health and medical information;
  • allergies, intolerances and dietary requirements;
  • medication and treatment information;
  • accident, illness and incident records;
  • information concerning disabilities or additional support requirements;
  • ethnicity, religion or other information where it is necessary and lawful for us to collect it;
  • safeguarding and child protection information;
  • information about professionals or agencies working with the child;
  • early years funding and eligibility information; and
  • CCTV images where a child is recorded by our CCTV system.

Some of this information is special category personal data and receives additional protection under data protection law.

6. Information We May Collect About Parents and Carers

We may process:

  • names and contact details;
  • home addresses;
  • relationship to the child;
  • parental responsibility and relevant family circumstances;
  • emergency contact information;
  • information about people authorised to collect a child;
  • information required in connection with funded childcare;
  • correspondence and communications with us;
  • contracts, consents and permissions;
  • invoices, payment information and payment history;
  • bank information where required for payments or refunds;
  • records relating to complaints, incidents or disputes;
  • photographs, video or CCTV images where applicable; and
  • other information provided to us where relevant to a child's care, education, welfare or safeguarding.

7. Enquiries and Prospective Families

If you contact us to enquire about a nursery place, request information or arrange a visit, we may collect your name and contact details, your child's name and age or expected date of birth, the sessions you require, and other information you choose to give us.

We use this information to respond to your enquiry, discuss our services, arrange nursery visits and, where requested, progress an application for a nursery place. Making an enquiry does not mean that your information will automatically be used for unrelated marketing.

8. How We Collect Personal Information

We may obtain information:

  • directly from parents and carers;
  • from enquiry, application, registration and consent forms;
  • during conversations, meetings and correspondence with families;
  • through our website and electronic systems;
  • from local authorities in connection with funded childcare;
  • from previous or subsequent childcare or education settings where appropriate;
  • from health professionals;
  • from social care, safeguarding or other statutory agencies;
  • from other professionals involved with a child or family where lawful and appropriate; and
  • through CCTV and other records created during the operation of the nursery.

9. Why We Use Personal Information

We use personal information where necessary to:

  • respond to enquiries about nursery places;
  • administer applications and waiting lists;
  • provide childcare and early education;
  • fulfil our agreement with parents and carers;
  • maintain appropriate contact and emergency information;
  • support children's learning, development and wellbeing;
  • identify and support children's individual needs;
  • administer medication and manage medical conditions, allergies and dietary requirements;
  • maintain appropriate staffing, attendance and collection records;
  • safeguard and promote the welfare of children;
  • comply with the Early Years Foundation Stage and Ofsted requirements;
  • administer funded childcare entitlements;
  • communicate with parents and carers;
  • issue invoices and administer payments;
  • manage complaints, accidents, incidents and insurance matters;
  • maintain the safety and security of children, staff and our premises;
  • establish, exercise or defend legal claims;
  • comply with legal and regulatory responsibilities; and
  • operate, secure and improve our website and services.

10. Our Lawful Bases for Processing

We do not rely upon consent for every use of personal information. Depending on the circumstances, our lawful basis may include:

Contract. Processing may be necessary to provide nursery services or take steps requested before entering into an agreement with us.

Legal obligation. We may be required to process information to comply with legislation, safeguarding responsibilities, the Early Years Foundation Stage, Ofsted requirements, funding requirements, tax or other legal obligations.

Legitimate interests. Processing may be necessary for the legitimate operation, administration, security or improvement of the nursery or our services, provided those interests are not overridden by an individual's rights and interests.

Vital interests. Information may need to be processed to protect somebody's life.

Consent. We will seek consent where it is the appropriate lawful basis for a particular activity. Consent may be withdrawn, although withdrawal will not affect processing that was lawful before consent was withdrawn.

Where we process special category information, including information about health, ethnicity, religion or other particularly sensitive matters, we will also ensure that an appropriate additional condition under data protection law applies.

Safeguarding information may need to be collected or shared without consent where necessary to protect a child or another person, or to comply with our legal obligations.

11. Children's Photographs and Video

Photographs and video may be used for purposes connected with children's learning and development, nursery records, communication with parents and other legitimate nursery activities.

Where consent is appropriate, including for particular promotional or publicity uses, we will obtain the necessary permission. We will not assume that consent to one use of an image permits a different, unrelated use.

12. CCTV

We operate CCTV in specified areas of our nursery premises for purposes including safeguarding, health and safety, security, the prevention and investigation of incidents, and establishing relevant facts where an accident, injury, allegation or other concern arises.

CCTV may record children, parents, carers, authorised collectors, staff and visitors while they are on the premises. CCTV is not used in toilets, changing areas or locations where individuals would reasonably expect a high degree of privacy.

Recordings are securely stored, access is restricted and recordings are retained only for an appropriate period unless they need to be kept longer in connection with an incident, safeguarding concern, investigation, legal claim or other lawful purpose. Further information is available in our CCTV Policy.

13. Who We May Share Information With

Where necessary and lawful, we may share personal information with:

  • North Yorkshire Council and other relevant local authorities;
  • Ofsted;
  • the Department for Education or other government bodies;
  • health professionals;
  • social care and safeguarding organisations;
  • schools and other early years or education providers;
  • emergency services;
  • professional advisers, insurers and auditors;
  • organisations involved in administering or verifying funded childcare;
  • IT, communications, nursery management and other service providers acting on our behalf; and
  • courts, regulators, law enforcement agencies or other organisations where disclosure is required or permitted by law.

We do not sell children's or families' personal information. We only share information where there is an appropriate reason and seek to limit it to what is required for the relevant purpose.

14. Third-Party Systems and Service Providers

We use carefully selected third-party systems and service providers to help operate and administer the nursery. These may include systems used for children's learning and development records, parent communications, funding administration, invoicing, accounting, electronic records, IT services, website hosting and other operational purposes.

Where a supplier processes personal information on our behalf, we take appropriate steps to require it to protect that information and process it in accordance with applicable data protection law and our instructions. This includes nursery systems such as Tapestry and Funding Loop where those services are used as part of our nursery administration.

15. International Transfers

Some technology or service providers may process or store personal information outside the United Kingdom. Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with UK data protection law and that appropriate safeguards are in place where required.

16. How Long We Retain Personal Information

We do not keep personal information indefinitely simply because it has been collected.

Different nursery records need to be retained for different periods. These periods may be determined by Early Years requirements, safeguarding responsibilities, local authority funding requirements, tax and accounting rules, insurance requirements, limitation periods and other legal or regulatory obligations.

When information is no longer required, it will be securely deleted or destroyed in accordance with our retention arrangements, unless there is an appropriate reason for continued retention.

17. Keeping Information Secure

We take appropriate organisational and technical measures to protect personal information from accidental loss, unauthorised access, alteration or disclosure.

Access to sensitive personal information is restricted to staff and service providers who require it for legitimate purposes, subject to appropriate confidentiality and security arrangements. Because of the sensitive nature of information relating to young children, we take particular care over access to children's records, health information, safeguarding records, images and CCTV recordings.

18. Our Website

When you contact us through our website, by email or by telephone, we use the information you provide to respond to your enquiry and, where requested, to take steps towards an application for a nursery place.

Our website and hosting services may create limited technical and security records needed to deliver, protect and maintain the website. We do not use website enquiry information for unrelated purposes, and we do not sell it.

19. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

  • be informed about how personal information is used;
  • request access to personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase information in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to certain processing;
  • receive certain information in a portable format where the right to data portability applies;
  • withdraw consent where processing is based upon consent; and
  • raise a concern or complaint about our use of personal information.

These rights are not absolute and exemptions may apply, particularly where information must continue to be retained for safeguarding, legal or regulatory purposes.

Parents or carers may, in appropriate circumstances, exercise rights in relation to information concerning a young child. In responding, we will take account of the child's interests and rights and any relevant legal requirements.

20. Complaints and the Information Commissioner's Office

If you have concerns about the way we use personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK regulator for data protection. Information about data protection rights and how to contact the ICO is available from the ICO website.

21. Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of websites operated by other organisations and recommend reviewing their privacy information before providing personal information to them.

22. Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our nursery, systems, legislation or regulatory guidance. The latest version will be published on our website, and the date at the beginning of the notice will show when it was last updated. Where a change is particularly significant for existing families, we may also bring it to their attention separately.

23. Contact Us

If you have questions about this Privacy Notice, wish to exercise a data protection right or have concerns about how personal information is being handled, please contact:

The Nursery Manager
Incy Wincys Limited
Amen House
Bedale
North Yorkshire
DL8 1XA
Email: enquries@incywincys.com
Telephone: 01677 425550