Privacy and Data Retention Notice
We record, process and keep personal information about you and your child in accordance with Article 6 of the General Data Protection Regulation (GDPR, May 2018): ‘the rights of the data subjects’.
Records we hold about you and your child/ren
When you first register with us you fill in an online booking form which asks for information on your names; contact details- phone and e-mail; emergency contact details; and your children’s ages, dates of birth, medical or dietary requirements; where you found out about our sessions.
We also have a paper weekly register that records attendance, contact and emergency details; photographic consent and highlights medical and dietary needs.
If someone has an accident then this will be recorded in our accident forms. Data relating to safeguarding will be noted in a similar way.
What do we do with this data and with whom is it shared
The information we collect about you and your child/ren is treated confidentially. Only the Forest School Leader and assistants will have access to personal information, unless permission is granted by you for any other purpose. Information collected by us allows us to communicate with you; comply with our emergency procedures, ensure we meet individual’s needs; assess marketing needs and to keep up to date financial records. Our financial records including, when requested, the termly payment register may be shared with HMRC.
Safeguarding notes will be shared with the local authority as per safeguarding regulations.
If you give permission for photos of yourself and your child/ren to be taken these may be used for promotional leaflets; our website and our social media accounts, no names will be used with these.
The online booking form is a password protected system. This information is accessed by the Forest School Leader on a desktop computer and mobile phone and may be shared digitally with assistants who will have agreed to the confidentiality required in this document. Contact details of people making enquiries and the termly register are kept in my google account.
Our website, through which people can make enquiries, is processed by Wix, this collects statistics on visits.
Photos taken during the session may be shared on our Facebook page, Twitter & Instagram accounts. When visiting these sites they collect statistics, they are GDPR compliant and you should refer to their privacy statements.
Texts are received and sent on the mobile phone and your number may be saved in the address book.
The electronic devices used – desktop computer and mobile phone, are password protected.
Accident and Safeguarding forms will be kept in a folder at the leader’s home.
Ensuring data is accurate
You have a right to access personal data about you and your child/ren.
How long we keep your data
Your records will be deleted once the account has not been used for 18 months.
Accident forms for children will be kept for 21 years to comply with the Limitation Act 1980. For adults it will be 3 years. Safeguarding notes will be kept for a reasonable period of approx. 3 years.
Deletion of records
You have the right to ask for information about you and your child to be withdrawn. This is called the right to ‘erasure’ in GDPR. However, if we need to keep information because it is legally required eg by HMRC then exceptions to the ‘right to erasure’ apply. Please speak to the leader if you wish to withdraw information on you and your child.
Online deletion- files, including photos held in relation to children and their families on the computer, cloud services and mobile are deleted in accordance with the time scales referred to previously.
Paper deletion- files held in paper format are shredded and recycled in accordance with the time scales referred to previously.
How to make a complaint
If you wish to make a complaint about a data breach or if you think we are not processing your data appropriately then please contact the leader in the first instance or you can contact ICO:
With thanks to The Hedgehog Club in writing this policy.