We use information about your family to care for your child, support learning, administer the place and meet our legal duties. This notice explains what we collect, why we use it, who receives it, how long we keep it and your rights. It is privacy information, not a request for blanket consent.
1 Who is responsible
Tickleford Preschool Limited is the controller for the preschool records described here. Our setting address is Tickleford Drive, Weston, Southampton SO19 9QP. Andy Hiscock is our privacy lead. Contact him at andy@ticklefordpreschool.co.uk, telephone 07557 677715, in person or by post at the setting. Privacy lead describes the contact role and does not imply a statutory data protection officer appointment.
Southampton City Council, the Department for Education and other agencies are responsible for their own uses of information they lawfully receive. Their notices explain those uses. Tickleford’s notice accompanies Southampton’s funding privacy notice; it does not replace it. Both are shared through Nursery in a Box (NiB) before registration. Paper and accessible copies are available on request.
2 Information we use and where it comes from
We use identity and contact details, dates of birth, parental responsibility and relevant court orders, emergency contacts and authorised collectors; registrations, bookings, attendance, funding declarations and eligibility information; learning observations, photographs, communications, permissions, complaints and incidents. Where needed for care, we use health, allergy, medication, disability, SEND and care-plan information, safeguarding records and relevant professional advice.
Funding information may include an entitlement code, parent National Insurance number and relevant benefit or disability evidence. We record identity documents seen and keep copies only where justified. We do not need your tax account password. We hold invoice, payment reference, balance and refund information. Payments are by bank transfer, Tax-Free Childcare or childcare vouchers; we do not currently accept card payments.
Information comes from parents, children, authorised carers, staff observations, other settings, schools, the council, health and social care professionals and other lawful sources. CCTV, telephone recordings and related transcripts are described below. If you provide another adult’s details, please make this notice available to them; we also meet our own information duties.
We explain which information is legally required or necessary for safe care and funding, and the consequences if it is not provided. Optional publicity choices are separate. Refusing publicity does not affect your child’s place. Ethnicity or religion is collected only for an identified purpose, such as an applicable required return or a separately explained optional choice.
Why we use information
3 Purposes and lawful bases
The applicable basis depends on the particular use. A parent’s contract is not automatically the basis for every use of a child’s information. Where we rely on legitimate interests, we consider necessity, less intrusive alternatives and the rights of children and adults.
| Purpose | Basis and interest or duty |
|---|---|
| Parent bookings and payments | Contract, Article 6(1)(b), for necessary administration of the adult’s agreed childcare purchases. Legal obligation, Article 6(1)(c), for required tax and accounting records. |
| Childcare and learning records | Legal obligation, Article 6(1)(c), for required EYFS, safety and record-keeping duties. Legitimate interests, Article 6(1)(f), for additional necessary care administration and family communication not required by a specific duty. |
| Funding and required returns | Legal obligation for statutory returns. Legitimate interests in administering eligible free provision for necessary scheme checks and claims not imposed by legislation. Southampton’s required code-check authority is obtained separately. |
| Safeguarding and emergencies | Legal obligation where a duty requires processing; recognised legitimate interests, Article 6(1)(ea), for necessary safeguarding within the statutory conditions; or vital interests, Article 6(1)(d), in a life-protecting emergency. |
| Complaints and legal matters | Legal obligation for required complaint handling; otherwise legitimate interests in investigating fairly, resolving disputes, insurance and establishing or defending legal rights. |
| CCTV and telephone recording | Legitimate interests in the specific safeguarding, security, incident investigation, accurate communication and training purposes described below, only where the necessity and balancing tests are met. |
| AI assistance | The basis for the underlying care, learning or administration purpose, where AI use is necessary and compatible. AI is a method of processing, not a separate legal basis or an exemption from confidentiality. |
| Optional publicity | Separate consent, Article 6(1)(a), for the relevant purpose and channel. It can be refused or withdrawn without affecting the place. |
4 Health and other sensitive information
For routine health and SEND information used in your child’s care, we obtain separate, explicit consent through NiB. Health, disability and other special-category information needs an additional Article 9 condition. For a statutory function carried out in substantial public interest, Article 9(2)(g) and Data Protection Act 2018 Schedule 1 paragraph 6 may apply where their tests and safeguards are met. Necessary safeguarding without consent may use Article 9(2)(g) with paragraph 18 where consent cannot be given, cannot reasonably be obtained or seeking it would prejudice protection. These are not blanket permissions for every health record or AI use.
Where explicit consent is the applicable condition for routine care or optional sensitive information, we explain the particular use and obtain a separate explicit choice. Legal claims may use Article 9(2)(f); a life-protecting emergency may use Article 9(2)(c) where its incapacity conditions apply. Criminal allegation or offence data has separate Article 10 and UK-law requirements.
Who receives information and where it is held
5 Staff and other recipients
Staff can access records for all children at Tickleford, but their role restricts the information and functions available. Management access is also limited to authorised responsibilities. Cover staff from Shirley or Foundry Lane receive only what they need for their cover role and safe care. The settings are separate legal providers; shared ownership does not give all employees unrestricted access.
We share relevant information lawfully with Southampton’s funding and education teams, DfE through required returns, Ofsted, health and social care professionals, safeguarding partners, police, courts and receiving schools or settings. Insurers, legal advisers, accountants and payment services may receive information needed for their functions. Some are independent controllers. Suppliers acting as processors must protect information under the applicable processing agreement.
We explain ordinary transition and support sharing to parents. Necessary lawful safeguarding sharing may take place without consent; we record the reason and explain it unless doing so would be unsafe or unlawful. Information about several children is handled with regard to each child’s rights. Other families do not have general access to your child’s records.
6 Our systems and suppliers
NiB holds registration, attendance, bookings, funding and billing information, parent messages, permissions, learning observations and photographs. All staff use its AI observation features, with human approval as explained below. NiB’s published privacy information identifies NIB Group Ltd as the platform provider and a processor for nursery data. It identifies OpenAI among suppliers used for AI Guardian features. NiB AI features can involve external cloud processing.
Microsoft 365, including Outlook, OneDrive, SharePoint and Teams, supports preschool email and electronic documents. Dialpad handles telephone recordings, transcripts and AI summaries. ChatGPT Business is used for drafting after identifying details are removed. Identifiable local AI processing stays on preschool-controlled equipment, as described below. Parent and child records are electronic; we do not maintain paper files. Staff do not use WhatsApp, personal email or personal cloud storage for identifiable preschool records.
7 International processing and protection
Cloud services can involve hosting, support or subprocessors outside the UK, including the United States. NiB publishes UK hosting information but also identifies international processing for some suppliers. Dialpad publishes international-processing terms. Microsoft provides a data-protection addendum. We therefore do not promise that all records remain in the UK or that every supplier is only a processor for every purpose.
Restricted transfers require a lawful safeguard, such as applicable UK adequacy regulations or approved contractual terms with any required assessment and additional measures. NiB publishes use of the IDTA or UK Addendum where applicable; Dialpad publishes contractual transfer arrangements. Ask Andy for the relevant recipient, location and safeguard information and how to obtain a copy, with confidential material protected.
Cameras and telephone recordings
8 CCTV video and sound
CCTV records video and sound during preschool operating hours. It covers all areas except bathrooms and the storeroom. Nappy changing and other intimate care take place outside video and audio coverage. The stated purposes are safeguarding, investigating incidents, security and staff monitoring. Sound helps establish what was said during an incident. Signs and written information tell parents, visitors and staff that both video and sound are recorded.
Access to view, listen to or export CCTV is restricted to Andy Hiscock, the Senior Lead and the Lead Practitioner. Recordings are normally kept for up to 30 days before overwrite. Relevant extracts may be kept longer where necessary for an incident, investigation or legal matter, with restricted access and documented review. Recordings may be shared with authorised agencies where lawful, including for safeguarding or legal proceedings.
We have completed a CCTV privacy assessment covering audio recording, staff monitoring and consideration of less intrusive alternatives. CCTV is not a substitute for staff supervision. Employee monitoring is also explained through staff privacy information.
9 Dialpad recordings transcripts and summaries
Dialpad records incoming and outgoing preschool calls and produces written transcripts and AI-generated summaries. We use them to confirm conversations and agreements, investigate complaints or incidents and support staff training. They can contain parent, child, staff or professional information, including sensitive information discussed during a call.
Callers are informed at the start that recording takes place and why, with access to fuller privacy information. This applies to both incoming and outgoing calls; a staff explanation is needed where an automated announcement does not inform the person called. Notification is not automatically consent.
Andy Hiscock and the Senior Lead alone have access to listen to or download recordings. They check transcripts and AI summaries against the recording before relying on them for complaints, safeguarding or other decisions. AI text may contain errors and does not replace the recording or professional judgement.
Recordings, transcripts and summaries are normally kept for up to two years and then automatically deleted. Necessary material may be preserved for an ongoing complaint, incident, safeguarding matter or legal claim, with restricted access and a documented review. Routine retention and deletion, including exports and backups, must match the adopted schedule and supplier settings.
AI assistance images and retention
10 Reports and observations assisted by AI
AI helps draft reports and observations; it does not replace professional assessment or responsibility. In NiB, a staff member checks and approves each AI-assisted observation before saving it to the child’s record or sharing it with parents. Staff access remains subject to their role.
Andy uses ChatGPT Business to assist with drafting after removing identifying details. This includes considering whether the narrative could identify a child or family, rather than removing names alone. We do not describe data as anonymous simply because a name has been removed. This direct use is separate from the processing carried out through NiB’s AI suppliers.
Local AI can use identifiable parent and child information for reports and observations. It runs on preschool-controlled equipment without sending prompts, records or generated text to an external AI service. Only Andy can access it and the records it processes. He checks and approves output before it becomes a child’s record or is shared. Prompts, history and copied information are retained and deleted according to Tickleford’s retention schedule. Working copies are considered separately from approved care or safeguarding records.
These tools support human decisions. We do not use them to make decisions with legal or similarly significant effects about children or families solely by automated means. Sensitive information, supplier access and any further use for model training require the same lawful-basis and confidentiality checks as other processing.
11 Photographs and optional choices
Learning photographs are held in NiB. Separate permissions for website, social-media and publicity use are recorded through NiB by purpose and channel. You can refuse without affecting the place, and withdraw through NiB or by contacting Andy. We stop future consent-based publicity use and explain any limits on retrieving material already distributed. Accepting childcare terms or receiving this notice is not publicity consent.
Parents can download the learning journal and photographs for two months after the child leaves. Ending parent access is not the same as deleting every preschool record; retention follows the applicable record category and purpose.
12 How long we keep information
We retain information in accordance with Tickleford Preschool’s retention schedule. Retention depends on the record category and purpose, including registrations, attendance and care, funding, accounts, safeguarding, learning records, complaints and AI working copies.
The period or criterion depends on the care or funding purpose, legal and tax duties, relevant limitation periods, insurer requirements and any necessary investigation or legal hold. Records are reviewed and securely deleted, destroyed or irreversibly anonymised when no longer required. CCTV and Dialpad periods are stated above. Ask Andy for the period and starting point applying to a particular record. Withdrawal of consent does not automatically erase records held for a distinct lawful duty or claim.
Your rights and raising concerns
13 Your information rights
You can request access to your information and correction of inaccuracies and, where the conditions apply, erasure, restriction, objection or portability. You can withdraw consent and object to direct marketing. Available rights depend on the purpose and legal basis. Contact Andy by email, telephone, post or in person; no compulsory form is required. Keep contact, health and collection details accurate and tell us if something changes.
The child has their own information rights. We consider parental authority, the child’s understanding and interests, relevant orders, confidentiality and other people’s rights. Proportionate identity checks or lawful redactions may be needed. We explain any restriction or refusal and how to challenge it.
We respond without undue delay, normally within one calendar month, subject to lawful identification, clarification and extension rules. We explain any permitted extension. Requests are normally free. A data request and a complaint are distinct and can run alongside one another. We do not promise deletion of records needed for a separate lawful obligation or claim.
14 Complaints about information
Contact Andy Hiscock at andy@ticklefordpreschool.co.uk or 07557 677715, or write to the setting. We help record concerns and provide paper or accessible information on request. Andy is both manager and director. Complaints about his involvement use the same contact; the procedure explains his role and the absence of a separate independent internal appeal. You may also contact the ICO about data protection.
We acknowledge complaints within five working days and in any event meet the applicable statutory 30-day acknowledgement period. We investigate appropriately, keep you informed and explain the outcome without undue delay. The 30 days is not a general deadline for resolving a complaint. Written complaints about meeting EYFS requirements have a separate 28-calendar-day outcome requirement.
You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113. The ICO normally recommends first giving the organisation an opportunity to respond. Internal procedures do not remove your right to approach the ICO.
15 Related notices and updates
Tickleford’s parent notice and Southampton’s funding notice are shared through NiB before registration. Paper and accessible copies are available from the manager. DfE explains its uses at gov.uk/government/publications/privacy-information-early-years-foundation-stage-to-key-stage-3. The website and enquiry notice at ticklefordpreschool.co.uk/privacy covers website processing separately. Employee and recruitment information and relevant supplementary CCTV information are also separate.
We review this notice when our processing changes and communicate material changes before new uses begin, except where a lawful exception applies. We retain previous versions and the actual issue record. Receiving this notice records information being provided; it does not provide consent to optional uses.