Who we are.
Smithfield House Children's Nursery, 14 West Smithfield, London EC1A 9HY, is the data controller for the personal information described in this policy. That means we decide how and why your information is used, and we're responsible for keeping it safe.
If you have any questions about this policy or about how we handle your information, contact us on 020 7236 1000 (Monday to Friday, 8am to 6pm) or at office@smithfieldnursery.co.uk.
The information we collect.
When you enquire or book a visit. If you contact us through the enquiry forms on this website, by phone, or by email, we collect your name, email address, phone number, your child's age, your preferred visit time, and anything you tell us in your message. Enquiry form submissions are sent to us by email; they are not stored in this website's database.
When your child joins the nursery. To provide your child's place we collect and hold registration information, including:
- Your contact details, and those of emergency contacts and adults authorised to collect your child
- Your child's name, date of birth, address, and (where relevant) ethnicity, religion and languages spoken at home
- Health information — medical conditions, allergies, dietary requirements, medication, GP details, and any special educational needs or disabilities
- Development records — observations, assessments, photographs and learning journey entries kept as part of the Early Years Foundation Stage framework
- Attendance records, accident and incident records, and safeguarding records where applicable
For fees and funding. We collect billing details, and — where you claim government-funded hours or Tax-Free Childcare — your National Insurance number and eligibility codes, which we're required to verify with the local authority.
CCTV. Our building is monitored by CCTV for the safety and security of children, staff, and visitors. Recordings are kept securely, viewed only when there is a genuine need, and deleted after a short retention period.
When you use this website. With your consent, our website uses analytics cookies to help us understand how it's used. See our Cookie Policy for full details, including how to opt out.
Why we use it — and our legal grounds.
UK data protection law (the UK GDPR and the Data Protection Act 2018) requires us to have a lawful basis for everything we do with your information. Ours are:
- Contract — to provide your child's nursery place: registration, daily care records, learning journeys, invoicing, and communication with you
- Legal obligation — to meet the requirements of the Early Years Foundation Stage framework, our registration with Ofsted, safeguarding legislation and statutory guidance, and funding rules set by the local authority and HMRC
- Legitimate interests — to respond to enquiries, keep our building and the people in it secure (including CCTV), and run and improve our service
- Consent — for anything optional, such as using photographs of your child beyond their own learning records, marketing communications, and non-essential cookies on this website. You can withdraw consent at any time
Some of the information we hold — such as health, dietary, and special educational needs information — is "special category" data, which has extra legal protection. We process it because it's necessary to care for your child safely, to meet our safeguarding and welfare duties under the EYFS, and, where relevant, for reasons of substantial public interest under the Data Protection Act 2018 (safeguarding of children).
Children's information.
Most of the personal information we hold is about children under five. We treat it with particular care. It comes to us from you, and from our own observations of your child's time with us. We use it for one purpose: to care for your child well and meet our legal duties as a registered early years provider.
Photographs of individual children are only shared with that child's own family. Group photographs are only shared with the consent of all the families involved.
One important exception: if we believe a child is at risk of harm, we have a legal duty to share information with the local authority, the police, or other safeguarding agencies — and in those circumstances we may do so without consent. Our safeguarding procedures are described on our Safeguarding page and in our Policies & Procedures.
Who we share information with.
We never sell personal information. We share it only where we need to, with:
- Famly — the secure parent app we use for daily updates, learning journeys, messaging, session bookings, and invoicing. Famly processes this information on our behalf under contract
- The local authority — for funded-hours claims, eligibility checks, and, where required, safeguarding and early-help work
- HMRC and the Department for Education — via the local authority, to verify funded-childcare eligibility
- Ofsted — as our regulator, during inspections or investigations
- Health professionals and safeguarding agencies — where your child's welfare requires it or the law obliges us
- Service providers — the companies that host this website and deliver our email, who act only on our instructions under contract
Where your information is stored.
We aim to keep personal information within the UK or the European Economic Area. Where a provider we use (such as Google, for website analytics) processes information outside the UK, the transfer is protected by UK adequacy regulations or by the UK's approved international data transfer safeguards.
How long we keep it.
We keep personal information only as long as we need it — and no longer. How long that is depends on the record:
- Enquiry details that don't lead to a place are deleted once no longer needed
- Children's records are kept for the periods required by the EYFS framework and statutory guidance after a child leaves us
- Accident, incident, and safeguarding records are kept for longer statutory periods, because the law requires it
- CCTV recordings are kept for a short period and then deleted, unless needed for a specific incident
Our full retention schedule is available on request — contact the nursery office.
Keeping it secure.
Paper records are stored securely at the nursery with access limited to the staff who need them. Digital records are held in access-controlled systems, protected by passwords and encryption in transit. Our staff receive training in data protection and confidentiality as part of their safeguarding responsibilities.
Your rights.
Under UK data protection law you have the right to:
- Access — ask for a copy of the information we hold about you or your child
- Rectification — have inaccurate information corrected
- Erasure — ask us to delete information, where the law allows (some records we must keep for statutory periods)
- Restriction — ask us to limit how we use your information
- Portability — receive information you gave us in a reusable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — at any time, where consent is our basis (for example photographs or cookies), without affecting anything done before you withdrew it
To exercise any of these rights, contact us on 020 7236 1000 or at office@smithfieldnursery.co.uk. We'll respond within one month.
If you're not happy.
If you have a concern about how we've handled your information, please raise it with us first — we'd genuinely rather hear it and put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, helpline 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy.
We review this policy regularly and update it when our practices or the law change. The date at the top of the page tells you when it was last updated. Significant changes will be communicated to current families directly.
