1. Who we are

Camelot Day Nursery Ltd (“Camelot”, “we”, “us” or “our”) is the data controller where we decide why and how personal information is used.

Our Data Protection Lead is Geoff Hawkins, Operations Director. For data-protection enquiries, requests or complaints, email operations@camelotdaynursery.com or write to: Geoff Hawkins, Data Protection Lead, Camelot Day Nursery Ltd, 3 St John’s Court, Chelmsford, Essex CM2 0JD.

Camelot is registered with the Information Commissioner’s Office (ICO) and maintains the applicable data-protection fee/registration.

2. Who this notice covers

This notice explains how we use personal information relating to children, parents and carers, prospective families, website visitors, people who contact us, visitors to our premises and other individuals who interact with Camelot. Separate staff and recruitment information may also be provided where appropriate.

3. Information we may collect

· Names, addresses, telephone numbers, email addresses, emergency contacts and family/relationship information.

· Information supplied through registration, enquiry and contact forms, telephone calls, email and other communications.

· Children’s attendance, routines, learning and development, observations and other information needed to provide childcare and early education.

· Health, allergy, medication, dietary, disability, SEND, communication and other support information.

· Safeguarding, welfare and child-protection information where necessary.

· Funding, eligibility, invoicing and payment-related information.

· Photographs, video or other images where used for authorised nursery purposes.

· Limited CCTV images, primarily from cameras overseeing entrances.

· Audio and information contained in a telephone call where a call is selectively recorded.

· Website information such as IP address, device/browser information, pages visited and information generated through cookies or similar technologies, depending on the choices you make.

· Any other information you choose to give us or that we lawfully receive from another organisation.

4. How we obtain information

We normally receive information directly from parents/carers, prospective families, staff, visitors and website users. We may also receive information from local authorities, health professionals, schools or other childcare providers, safeguarding partners, government bodies and other organisations where there is a lawful reason to do so.

Where data protection law requires us to provide privacy information after obtaining personal data from another source, we will do so within the applicable timeframe unless an exemption applies.

5. Why we use personal information and our lawful bases

We use personal information only where we have a lawful basis. The basis depends on the purpose and circumstances. Our main purposes include:

· Providing childcare and early education, administering places and communicating with families — contract, steps before a contract, legal obligation and/or legitimate interests as appropriate.

· Meeting EYFS, safeguarding, regulatory, funding, tax and other legal requirements — legal obligation.

· Protecting children and responding to safeguarding concerns — legal obligation, legitimate interests and, where appropriate, vital interests, together with an applicable condition for special-category data.

· Supporting health, SEND, disability, equality and inclusion — legal obligation and/or legitimate interests together with an applicable special-category condition.

· Managing fees, funding and business administration — contract, legal obligation and/or legitimate interests.

· Maintaining security through limited entrance CCTV — legitimate interests in safety, security, crime prevention and investigation, balanced against privacy rights.

· Selectively recording telephone calls where there is an identified operational, training, quality, complaints, safeguarding or evidential need — normally legitimate interests where recording is necessary and proportionate.

· Responding to website and other enquiries — steps before a contract and/or legitimate interests.

· Operating and securing our website and remembering privacy choices — legitimate interests and/or technologies exempt from consent where the law permits.

· Using non-essential cookies or similar technologies — consent where consent is required.

· Sending optional electronic marketing — consent or another basis permitted by the Privacy and Electronic Communications Regulations (PECR), as applicable.

We do not use consent as a blanket basis for core childcare, safeguarding or statutory processing. Where we rely on consent, you may withdraw it for future processing.

6. Special-category and criminal-offence information

Some information receives additional legal protection, including health, disability, ethnicity, religion and certain safeguarding information. Where we process special-category data, we identify both an Article 6 lawful basis and an applicable Article 9 UK GDPR condition. Where the Data Protection Act 2018 requires additional safeguards, we apply our Appropriate Policy Document.

Criminal-offence information, including relevant safer-recruitment/DBS information, is processed only where authorised by law and subject to appropriate safeguards.

7. Safeguarding and information sharing

Data protection law does not prevent necessary and proportionate information sharing to safeguard a child. We may share information without consent where the law permits or requires this and it is necessary to protect a child or another person. We follow the EYFS, Working Together to Safeguard Children, applicable statutory information-sharing guidance and local safeguarding procedures, and record significant sharing decisions.

8. Who we may share information with

Depending on the circumstances, we may share relevant information with local authorities, safeguarding partners, health professionals, schools and other childcare providers, police, Ofsted, HMRC, funding bodies, insurers, professional advisers and other bodies where there is a lawful reason.

We also use service providers to support our operations. Current core services include Dayshare, Namesco, Apple iCloud, Field and Co and Citation. Suppliers and services can change, so our internal Data Processing & Processor Register is maintained separately. Where a supplier processes personal data on our behalf, we require appropriate contractual and security safeguards.

9. Our website, cookies and similar technologies

Our website uses cookies and similar storage/access technologies. Some are necessary for the website to operate, remain secure or remember choices. Other technologies may support analytics or website features.

Camelot has configured its website to restrict non-essential cookies until the visitor makes a choice. Our cookie controls allow visitors to accept non-essential cookies, reject them or manage their preferences. Visitors can return to Cookie Preferences to change their choices.

Where a technology requires consent, it should not be used for that non-exempt purpose until consent has been given. Where current law provides an exception, such as for qualifying statistical purposes, we will apply the conditions of that exception, including any required information and means of objecting.

Third-party or embedded content, such as video or other external services, may involve the third party receiving technical information or using storage/access technologies. Where consent is required, the relevant non-essential technology should remain restricted until the visitor has made the appropriate choice.

Because website technologies and suppliers can change, we periodically review the site and our cookie/privacy settings. The Cookie Preferences control provides the most current choices available to visitors.

10. Website enquiries

If you contact us through the website, by email or by telephone, we use the information you provide to respond to your enquiry, discuss childcare services and take steps you request before entering into a contract. We do not keep unsuccessful or inactive enquiries indefinitely; retention follows our Record Retention Schedule.

11. CCTV

Camelot operates limited CCTV primarily overlooking entrances for safety and security. CCTV is not intended for routine monitoring of staff performance. Access is restricted to authorised people and footage is disclosed only where there is a lawful and proportionate reason, for example to police, insurers or regulators. Routine footage is retained only for the period necessary for the security purpose, subject to preservation where an incident, investigation or legal matter requires it.

12. Telephone call recording

Telephone calls are not assumed to be recorded routinely. Camelot may selectively record a call where there is an identified operational, training, quality, complaints, safeguarding or evidential benefit. Where a call is recorded, appropriate notice will be given. Access and retention are restricted and recording must be necessary and proportionate to the identified purpose.

13. How long we keep information

We keep personal information only for as long as there is a legal, safeguarding, insurance or justified operational reason. Detailed periods are maintained in Camelot’s Record Retention Schedule. Information may be kept longer where a safeguarding matter, complaint, legal claim, regulatory enquiry, police matter, insurance issue or other documented preservation requirement remains active.

14. Security and international processing

We use organisational and technical measures appropriate to the nature and sensitivity of the information, including authorised systems, access controls and secure storage. No internet or electronic system can be guaranteed completely secure, but we take reasonable steps to protect information against unauthorised access, loss, alteration or disclosure.

Some service providers may process information outside the UK. Where UK data-protection law restricts an international transfer, we require an applicable adequacy arrangement or other lawful transfer safeguard.

15. Your rights

Depending on the circumstances, data-protection law may give you rights to be informed; access your personal data; have inaccurate data corrected; request erasure or restriction; object to certain processing; receive certain data in a portable format; and receive protections relating to automated decision-making. These rights are not absolute and exemptions may apply, including where information concerns another person or safeguarding.

A subject access request does not need special wording or a particular form and may be made verbally or in writing. We may need to verify identity and, where someone acts for another person, their authority.

16. Children’s information and parental access

A parent or carer does not automatically have an unrestricted right under data-protection law to all personal information relating to a child. We consider the child’s rights, age and understanding, parental responsibility, the nature of the information, safeguarding considerations, confidentiality owed to others and any applicable legal restrictions before disclosing information.

17. Data-protection complaints

If you believe Camelot has not handled personal information properly, please contact Geoff Hawkins, Data Protection Lead, at operations@camelotdaynursery.com or at the postal address in section 1.

We will provide a clear route for the complaint, acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed as appropriate and communicate the outcome without unjustifiable or excessive delay.

You also have the right to complain to the Information Commissioner’s Office (ICO). Current contact details and the ICO’s online complaint service are available at the ICO website.

18. Changes to this notice

We review this notice regularly and whenever our services, systems or legal requirements materially change. Where required, we will bring significant new uses of personal information to the attention of affected individuals before starting the new processing.

Version: 1.0 | Published: September 2026 | Data Protection Lead: Geoff Hawkins