Privacy Policy for Little Acorns Nursery

Last Updated: 25th July 2025

Little Acorns Pre-School (“we,” “us,” or “our”) is committed to protecting the privacy and personal data of our website visitors, parents, guardians, children, staff, and other stakeholders. This Privacy Policy outlines how we collect, use, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). As a not-for-profit, charity-led pre-school located at Beechway, Fulwood, Preston, Lancashire, PR2 8EU, and registered with the Charity Commission (Registered Charity Number: 1136626), we take our responsibilities seriously to ensure transparency and accountability in our data handling practices.

This policy applies to all personal data collected through our website (https://littleacornsnursery.uk), our online learning platform Tapestry, our WhatsApp communications, enquiry forms, telephone interactions, social media (e.g., Facebook), and other interactions related to our services. By engaging with Little Acorns Nursery, you consent to the practices described in this policy. If you have any questions, please contact us at littleacorns01@yahoo.co.uk or 01772 717881.

1. About Little Acorns Nursery

Little Acorns Pre-School is a term-time nursery operating 38 weeks per year, situated in the grounds of Kennington Primary School, Fulwood, Preston. Rated Outstanding by Ofsted in 2024, we provide high-quality early years education for children aged 2 to 4, with a focus on play-based learning, inclusivity, and strong partnerships with parents. As a charity-led organisation, we reinvest all funds into enhancing the experiences of the children and families we serve.

Our website, built on WordPress and maintained by WebSpinner UK, serves as a platform to provide information about our services, fees, curriculum, teaching methods, and events. We also use digital tools like Tapestry for progress tracking and WhatsApp for parent communications, all of which involve processing personal data in compliance with UK data protection laws.

2. Purpose of This Privacy Policy

This Privacy Policy explains:

  • The types of personal data we collect.
  • How we collect, use, and share your data.
  • Our use of cookies and similar technologies on our website.
  • Your rights under UK GDPR and how to exercise them.
  • Our measures to ensure data security and compliance.
  • How we handle data related to children, parents, staff, and visitors.
  • Our procedures for handling complaints and subject access requests.

This policy is designed to meet the requirements of UK GDPR, which tailors the EU GDPR to UK law, the Data Protection Act 2018, and PECR, particularly regarding cookie consent and electronic communications. It is structured to be accessible to parents, guardians, and other stakeholders while addressing the specific needs of a nursery setting.

3. Data Controller

Little Acorns Pre-School is the data controller for personal data processed in connection with our services. Our contact details are:

Data Controller Contact:

  • Name: Alison Shepherd
  • Address: Little Acorns Pre-School, Beechway, Fulwood, Preston, Lancashire, PR2 8EU
  • Phone: 01772 717881
  • Email: littleacorns01@yahoo.co.uk
  • ICO Registration Number: [Insert ICO Registration Number, if applicable]

As a data controller, we are responsible for determining how and why personal data is processed. We are registered with the Information Commissioner’s Office (ICO) and adhere to all relevant data protection regulations.

4. Personal Data We Collect

We collect and process various types of personal data to deliver our services, manage our operations, and comply with legal obligations. Below is a detailed breakdown of the data we collect, categorized by data subject.

4.1. Parents and Guardians

We collect the following personal data from parents or guardians enrolling children or engaging with our services:

  • Identity Data: Full name, title, relationship to the child, date of birth, National Insurance number (for funding applications).
  • Contact Data: Email address, phone number(s) (home, mobile, work), home address, billing address (if different), emergency contact details.
  • Family Data: Details of family members, parental responsibility, and any court orders pertaining to the child.
  • Financial Data: Bank account details or payment information for fees (via bank transfer, childcare vouchers or government schemes).
  • Communication Data: Records of communications via email, WhatsApp, telephone, social media (e.g., Facebook direct messages), or our enquiry form, including preferences for receiving updates.
  • Child-Related Data: Information about your child’s needs, progress, or special requirements provided during enrolment, meetings, or via Tapestry.
  • Eligibility Data: National Insurance number, Unique Taxpayer Reference (if self-employed), employment start date, details of government support/benefits (e.g., family credits), and child’s birth certificate number (for funding applications, e.g., up to 30 hours free childcare).

4.2. Children

As a nursery, we process limited personal data about children to provide education and care:

  • Identity Data: Child’s full name, date of birth, gender, address.
  • Developmental Data: Observations, assessments, and progress reports recorded via Tapestry or our weekly sharing book.
  • Health and Welfare Data: Medical conditions, allergies, dietary requirements, special educational needs (SEN), child protection plans (from social care), or health care plans (from health professionals).
  • Attendance Data: Records of attendance, session times, and participation in activities (e.g., Forest School, stay and play sessions).
  • Photographs/Videos: Images or videos taken during nursery activities (e.g., Forest School, celebrations), subject to parental consent for use in learning records, Tapestry, or promotional materials.

4.3. Website Visitors

For individuals visiting our WordPress website (https://littleacornsnursery.uk), we collect:

  • Usage Data: IP address, browser type, device type, pages visited, time spent on pages, and referral sources (via cookies and analytics tools like Google Analytics).
  • Enquiry Data: Name, email address, and message content submitted via our contact form.
  • Cookie Preferences: Consent status for cookies and tracking technologies.

4.4. Staff and Volunteers

For our qualified staff and committee volunteers, we collect:

  • Identity Data: Full name, date of birth, National Insurance number.
  • Contact Data: Email address, phone number, home address.
  • Professional Data: Qualifications, DBS (Disclosure and Barring Service) checks, employment history, references.
  • Performance Data: Appraisals, training records, and performance reviews.

4.5. Other Stakeholders

We may collect data from other individuals, such as:

  • Ofsted Inspectors or Local Authorities: Contact details and professional information for regulatory purposes or following complaints about our service.
  • Third-Party Providers: Contact and billing information for suppliers (e.g., WebSpinner UK for website maintenance, insurance underwriters).
  • Social Care or Police: Information shared for safeguarding purposes, if required.

5. How We Collect Personal Data

We collect personal data through the following methods:

  • Direct Interactions: When parents complete registration/enrolment forms, submit enquiries via our website, or communicate via email, WhatsApp, telephone, or in-person meetings.
  • Online Platforms: Through Tapestry for progress tracking and parent updates, or our WordPress contact form.
  • Website Analytics: Via cookies and tools like Google Analytics (if enabled) to track website usage.
  • Third Parties: From government portals (e.g., GOV.UK for funding eligibility), Ofsted, social care, health professionals, or Kennington Primary School (for shared premises coordination).
  • Events and Activities: During stay and play sessions, Forest School, or celebration events where photos/videos are taken (with consent).
  • Automated Technologies: Cookies and similar technologies collect usage data when you visit our website.
  • Telephone Contact: When you call our advertised numbers (01772 717881), we collect your name, address, email, and other necessary information to address your request.
  • Social Media Contact: When you send private/direct messages via our Facebook page, we collect your name, message content, and contact details provided.

6. Purposes and Legal Bases for Processing

We process personal data for specific purposes, each supported by a legal basis under UK GDPR. Below is a detailed table outlining our processing activities:

Purpose Data Processed Legal Basis
Enrolling children and managing attendance Parent/child identity, contact, health, and attendance data Contract (to provide childcare services)
Processing payments for fees Financial data, parent contact data Contract (to fulfill payment obligations)
Applying for government funding (15/30 hours) Eligibility data, child’s birth certificate number Legal obligation (to comply with funding requirements)
Tracking child development and sharing updates Developmental data, photos/videos (with consent) Consent (for photos/videos) or legitimate interests (to support education and parent engagement)
Communicating with parents (email, WhatsApp, Tapestry, phone) Communication data, parent contact data Consent (for non-essential communications) or contract (for service-related updates)
Website maintenance and analytics Usage data, cookie preferences Consent (for non-essential cookies) or legitimate interests (for essential cookies and site functionality)
Safeguarding and child welfare Health, SEN, child protection plans, and attendance data Legal obligation (to comply with safeguarding regulations)
Transferring records to schools Child’s learning and development records Legal obligation (to comply with Early Years Foundation Stage requirements)
Staff and volunteer management Staff identity, contact, professional, and financial data Contract (employment) and legal obligation (DBS checks)
Responding to enquiries Enquiry data, parent contact data Legitimate interests (to address queries and promote services)
Compliance with Ofsted and Charity Commission Child, parent, and staff data Legal obligation (to meet regulatory requirements)
Handling complaints Complainant identity, complaint details Legitimate interests (to resolve complaints and improve services)

6.1. Special Category Data

We process special category data (e.g., health, SEN, child protection plans) only where necessary for safeguarding, education, or care, with explicit consent or under a legal obligation (e.g., Early Years Foundation Stage or safeguarding requirements). We ensure additional safeguards, such as restricted access and encryption, for this data.

6.2. Consent

Where consent is the legal basis (e.g., for photos/videos, marketing communications, or non-essential cookies), we obtain explicit, informed consent and provide an easy way to withdraw it (e.g., via email, Tapestry settings, or the website cookie banner).

6.3. Automated Decision-Making

We do not make decisions about you or your child based solely on automated decision-making or profiling.

7. Cookies and Tracking Technologies

Our WordPress website uses cookies and similar technologies to enhance user experience, analyze performance, and deliver relevant content. As required by PECR, we provide clear information about cookies and obtain consent for non-essential cookies.

7.1. What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us remember your preferences, analyze site usage, and improve functionality.

7.2. Types of Cookies We Use

Category Purpose Examples Essential/Non-Essential
Strictly Necessary Cookies Enable core functionality (e.g., navigation, form submissions) WordPress session cookies, security cookies Essential (no consent required)
Performance Cookies Collect anonymized data on site usage (e.g., pages visited, time spent) Google Analytics (_ga, _gid) Non-essential (consent required)
Functional Cookies Remember user preferences (e.g., cookie consent settings) Cookie consent plugin cookies Non-essential (consent required)
Targeting Cookies Deliver personalized content or ads (if applicable) Facebook Pixel (if used for social media integration) Non-essential (consent required)

7.3. Cookie Consent

When you first visit our website, a cookie banner will prompt you to accept or reject non-essential cookies. You can manage your preferences at any time via the cookie settings link in our website footer. Essential cookies, required for site functionality, do not require consent but are listed for transparency.

7.4. How to Disable Cookies

You can disable cookies via your browser settings (e.g., Chrome, Firefox, Safari). However, disabling essential cookies may affect website functionality. For guidance, visit:

7.5. Third-Party Cookies

We use third-party services like Google Analytics to collect standard internet log information and visitor behavior patterns in an anonymized way, ensuring no attempt is made to identify individuals. Other services, such as social media plugins (e.g., Facebook), may set cookies, and these providers have their own privacy policies, compliant with UK GDPR and PECR.

8. Data Sharing and Third Parties

We share personal data only where necessary and with appropriate safeguards. We will not distribute your personal data to third parties for their own purposes without your explicit consent, except where required by law. Third parties we may share data with include:

  • Tapestry: For tracking and sharing child progress with parents.
  • GOV.UK: For processing free childcare funding applications (e.g., 15/30 hours eligibility checker).
  • Ofsted and Local Authorities: For regulatory compliance, inspections, or following complaints about our service.
  • WebSpinner UK: For website hosting and maintenance.
  • Payment Providers: For processing fees (e.g., bank transfers, childcare vouchers, chip and pin, or direct debit payments).
  • Kennington Primary School: For premises coordination and safeguarding.
  • Social Care or Police: For safeguarding purposes, to protect your child or others.
  • Insurance Underwriter: For claims or liability purposes (if applicable).
  • Schools: To transfer your child’s learning and development records when they leave our setting, as required by law.
  • Recognized Law Enforcement or Court Orders: To comply with legal requests from authorities or courts.

We ensure all third parties are UK GDPR-compliant and have data processing agreements in place where required. We do not sell or share personal data for marketing purposes without explicit consent.

9. International Data Transfers

Most of our data processing occurs within the UK, and personal data is stored on servers located in the North West of the United Kingdom. However, some third-party services (e.g., Tapestry, Google Analytics) may involve data transfers outside the UK. Where this occurs, we rely on:

  • UK GDPR Adequacy Decisions: For transfers to the EEA (e.g., Tapestry’s servers).
  • Standard Contractual Clauses (SCCs): For transfers to other countries (e.g., Google Analytics in the US), with additional safeguards like encryption and data minimization.

We ensure equivalent protection for all international data transfers in line with UK GDPR.

10. Data Security

We implement robust technical and organizational measures to protect personal data:

  • Encryption: Our website uses SSL/TLS encryption (TLS 1.2, ECDHE_RSA with P-256, AES_128_GCM) to secure data in transit. Tapestry and email communications are also encrypted.
  • Access Controls: Only authorized staff and volunteers access personal data, with role-based permissions.
  • Secure Storage: Physical records (e.g., enrolment forms, medication records, accident records) are stored in locked cabinets in our office. Digital data is stored on secure, password-protected systems.
  • Email Security: We monitor emails and attachments for viruses or malicious software to prevent unauthorized access or data breaches.
  • Regular Audits: We conduct periodic data protection audits to ensure compliance.
  • Staff Training: All staff receive training on UK GDPR, safeguarding, and data security.
  • Incident Response: We have a procedure for detecting, reporting, and investigating data breaches, with notifications to the ICO and affected individuals within 72 hours if required.

11. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or meet legal obligations. Specific retention periods include:

  • Child and Parent Data: Retained for up to 7 years after a child leaves the nursery, or until our next Ofsted inspection after their departure, in line with Ofsted and safeguarding requirements. Medication and accident records are kept longer per legal requirements.
  • Financial Data: Retained for 6 years to comply with HMRC regulations.
  • Enquiry Data: Retained for 12 months unless converted to an enrolment.
  • Staff Data: Retained for 6 years post-employment, per employment law.
  • Website Usage Data: Anonymized data retained for up to 26 months (Google Analytics default); identifiable data deleted after 12 months.
  • Photos/Videos: Retained only with consent and deleted upon withdrawal of consent or when the child leaves the nursery.
  • Social Media Messages (e.g., Facebook): Retained for no more than 3 months and then deleted, unless consent is given for longer retention.
  • Complaint Data: Retained for 2 years from closure in a secure environment, with access restricted to a “need to know” basis.

Data is securely deleted or anonymized when no longer needed, using methods like shredding for physical records and secure erasure for digital data.

12. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right to be Informed: To know how your data is processed (as outlined in this policy).
  • Right of Access: To request a copy of your personal data (Subject Access Request) in electronic form, including details of how it is processed. A £10 admin fee may apply, and we will respond within one month.
  • Right to Rectification: To correct inaccurate or incomplete data.
  • Right to Erasure: To request deletion of your data (where no legal basis for retention exists).
  • Right to Restrict Processing: To limit how we use your data in certain circumstances.
  • Right to Data Portability: To receive your data in a machine-readable format or have it transferred to another controller.
  • Right to Object: To object to processing based on legitimate interests or for direct marketing.
  • Rights Related to Automated Decision-Making: As stated, we do not use automated decision-making or profiling.

To exercise these rights, contact us at littleacorns01@yahoo.co.uk or write to Alison Shepherd at the address above. We will respond within one month, free of charge (except for Subject Access Requests, where a £10 fee may apply), unless the request is complex or excessive. We may need to verify your identity before processing requests. If you prefer, we can address certain requests informally (e.g., providing specific information over the phone).

13. Children’s Data and Parental Consent

As a nursery, we process limited personal data about children, primarily for educational and safeguarding purposes. We obtain parental consent for:

  • Processing health or SEN data.
  • Taking and using photos/videos in Tapestry, our website, social media, or promotional materials.
  • Sharing progress updates via Tapestry or WhatsApp.

Parents can withdraw consent at any time by contacting us in writing. We ensure children’s data is handled with extra care, with access restricted to authorized staff and robust safeguards in place.

14. Complaints

If you have concerns about our data handling practices, please contact us first at littleacorns01@yahoo.co.uk or write to Alison Shepherd. When we receive a complaint, we create a file containing the complainant’s identity and details of the complaint, used only to resolve the issue and assess service quality. We may need to disclose the complainant’s identity to the subject of the complaint (e.g., if disputing a record’s accuracy), but we will respect requests for anonymity where possible, though this may limit our ability to handle the complaint.

Complaint data is retained for 2 years from closure in a secure environment, with access restricted to a “need to know” basis. We may compile anonymized statistics on complaints to improve our services.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

15. Links to Third-Party Websites

Our website contains links to third-party sites, such as:

We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies before providing personal data.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The latest version will be available on our website at https://littleacornsnursery.uk/privacy-policy. Significant changes will be communicated via email, WhatsApp, or Tapestry to parents and stakeholders. The “Last Updated” date at the top of this policy indicates the latest revision.

17. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, please contact:

Little Acorns Pre-School

We are committed to addressing your queries promptly and ensuring compliance with all applicable data protection laws.