Privacy Notice (last updated 04/03/26)

1. Introduction
HIPPITOTS LIMITED is committed to protecting the privacy and personal information of children, parents, carers, staff and visitors.
This privacy notice explains how we collect, use, store and protect personal information when you:

• Enquire about a nursery place
• Register a child with the nursery
• Visit or use our website
• Communicate with us
• Use any of our online services

As an early years provider, we process personal data in accordance with any and all relevant data protection laws including:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The Privacy and Electronic Communications Regulations (PECR)
• The Data Use and Access Act 2025

As a registered early years setting, we are also regulated by Ofsted and operate within the Early Years Foundation Stage (EYFS) statutory framework.

2. Data Controller
The organisation responsible for processing personal data is:
HIPPITOTS LIMITED
Tarka Centre, Commercial Road West, Coxhoe, Durham, DH6 4HJ
Email: enquiries@hippitots.com
Telephone: 0191 377 3759
Where required for safeguarding, funding or regulatory oversight, information may also be shared with relevant local authority services.

3. Personal Information We Collect

Children
When a child attends the nursery, we may collect:

•  Child’s name, date of birth and gender
• Home address
• Parent or carer contact details
• Emergency contacts
• Medical information, allergies and dietary requirements
• Developmental observations and assessments
• Attendance records
• Safeguarding or welfare information where necessary

This information supports the delivery of early years education and childcare.

Parents and Carers

We may collect:

• Name and contact details
• Relationship to the child
• Payment information
• Funding eligibility information
• Communication records

Staff, Volunteers and Applicants
If you work with or apply to work with the nursery we may collect:

• Contact details
• Employment history
• Qualifications
• References
• Disclosure and Barring Service (DBS) information
• Safeguarding training records

Website Users
When visiting our website we may collect limited technical information such as:

• IP address
• Device type and browser
• Pages visited
• Website usage information through cookies

4. Why We Use Personal Information

We process personal data in order to:

• Provide childcare and early education services
• Safeguard and promote the welfare of children
• Maintain records required by the EYFS framework
• Communicate with parents and carers
• Manage admissions and waiting lists
• Process nursery payments and funding claims
• Support children’s learning and development
• Meet legal, regulatory and safeguarding obligations
• Improve our website and services

5. Lawful Basis for Processing
Under UK GDPR, the nursery relies on the following lawful bases:

Legal Obligation (Article 6(1)(c))

To meet statutory obligations including safeguarding requirements under the EYFS framework and childcare regulations.

Contract (Article 6(1)(b))

To deliver childcare services agreed with parents or carers.

Legitimate Interests (Article 6(1)(f))

To manage the nursery effectively, maintain records and improve services.

Consent (Article 6(1)(a))

Where specific permission is required, such as:

• Photographs or videos of children
• Marketing communications
• Optional website cookies

6. Special Category Data
Some information processed by the nursery may be considered special category data, including:

• Health information
• Dietary requirements related to religion or health
• Safeguarding information

This information is processed under Article 9 UK GDPR where necessary for:

• Child safeguarding and welfare
• Provision of care and education
• Compliance with statutory obligations

7. Who We Share Information With
Personal information may be shared with trusted organisations where required, including:

• The Local Authority (for early education funding and safeguarding)
• Ofsted (for inspection and regulatory purposes)
• Health professionals where appropriate
• Safeguarding authorities where required
• Professional advisers or regulators
• IT and software providers supporting nursery systems

Information will only be shared where necessary and proportionate.

8. Safeguarding
Safeguarding children is a legal duty for early years providers.

Where there are concerns about a child’s safety or wellbeing, information may be shared with safeguarding partners or relevant authorities without consent where required by law.

9. Data Security
We take appropriate measures to protect personal information, including:

• Secure digital systems and password protection
• Access controls for staff
• Secure storage of paper records
• Staff training on confidentiality and data protection
• Regular review of security practices

10. Data Retention
Personal data is retained only for as long as necessary.

Typical retention periods include:

• Child records – retained in accordance with early years guidance
• Safeguarding records – retained in line with safeguarding requirements
• Financial records – retained for statutory accounting periods

Records are securely destroyed or deleted when no longer required. For more information please see our retention policy available on request.

11. Your Data Protection Rights

Under UK GDPR individuals have the right to:

• Access their personal data
• Request correction of inaccurate information
• Request erasure in certain circumstances
• Restrict or object to processing
• Request portability where applicable
• Right to make a complaint to the Data Controller

Requests can be made by contacting the nursery.

You also have the right to complain to the UK regulator:

Information Commissioner Office (https://ico.org.uk). For more information see https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/

12. Cookie Notice

What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They help websites function correctly and improve user experience.

Types of Cookies We Use

Essential Cookies – These cookies are required for the website to function.
Examples include:

• Security features
• Session management
• Form submission functionality

Analytics Cookies – These cookies help us understand how visitors use the website so we can improve it.

Information collected may include:

• Pages visited
• Time spent on the site
• Device and browser information

Where analytics cookies are used, they are anonymised where possible.

Functional Cookies – These cookies allow the website to remember user preferences such as accessibility settings or previously entered information.

Third-Party Cookies – If our website includes external services such as maps, videos or social media links, those providers may set cookies independently.

13. Managing Cookies
You can manage cookies through your browser settings and the cookie preference tool on this website.

Most browsers allow you to:

• Delete cookies
• Block cookies
• Receive alerts when cookies are used

Disabling cookies may affect how some parts of the website function.

14. Updates to This Notice
This privacy notice may be updated from time to time to reflect changes in law, technology or nursery practices.
The latest version will always be available on our website.

15. Contact
If you have questions about this privacy notice or how personal data is used, please contact:

HIPPITOTS LIMITED
Email: enquiries@hippitots.com
Telephone: 0191 377 3759