Privacy Notice

Hopscotch Ltd is a provider of Nursery services based in the United Kingdom (UK). The company is duly registered at Companies House, with its head office at: 14 Bavant Road, Brighton BN1 6RD. Although our service is restricted to the UK, we have branches in: Brighton, Hove, Seaford, Peacehaven and Worthing. Hopscotch Ltd provides UK families, and social care services with a nursery service that is second to none in the United Kingdom.

By providing your personal data to us (via one of our websites, by email, in person or over the phone), you agree to the processing set out in this Privacy notice. When you provide your personal data to us, we become the Controllers of that data. This means we determine the purpose and means

of processing your personal data as we provide our services to you. This may include but is not limited to registering your child for one of our nursery places, responding to your enquiries, authenticating your identity, or assist you in the provision of our services.

We sometimes use third-party links on our website. Where a third-party link appears on our website, we are not responsible for how that third-party uses your personal data, if you have accessed that third- party link, via our website. If you have followed a third-party link, they will have their own Privacy Notice, which will inform you as to how they use your personal data. We advise you to refer to their Privacy Notice for further information about their use of personal data.

We collect and process your personal data when you contact us via our website, or social media platforms or visit us in person in the course of operating our business. The data we collect falls into various categories, some of which is basic, sensitive and confidential. We only collect as much data from you as is required by law or is necessary to provide our services to you. As we are a regulated service provider of nursery places we are required by law as set out in the Statutory Framework for Early Years Foundation Stage (EYFS) 2021 to obtain certain data about the children registered with us, their families and the staff we employ in the course of operating our business and providing our services.

The data we collect includes:

· Name and address of child,

· age, date of birth, gender

· Race, ethnicity

· Language spoken

· Start date end date

· Pre-existing injuries on the child.

· Care plans and progress reports of children

· Accidents

· Observations, planning and assessment records of Children

· Name of parent, address, job title, whether there is a care order in place or the involvement of social services with the family.

· Marital status

· National insurance number

· Conversations with parents and staff.

· Contact details, such as telephone number of parent, carer or next of kin, or emergency contact, postal and email address.

· Financial data such as payment related information or bank account details.

· Demographic data such as your postcode.

· Incident records, death injury, disease or dangerous occurrences

· Salary of staff, annual leave, pension and benefits

· Location of employment or workplace of staff

· Sensitive data such as any allergies, medical conditions affecting your child, safeguarding regimes in place.

· Special categories data such as religious opinion or religion, dietary laws or preferences.

· Identification, such as birth certificates of children, right to work in UK for staff, example passport, national insurance number, medical disclosures where required by law or criminal convictions.

· Recruitment related data relevant to working with Hopscotch and children such as your curriculum vitae, your education and employment history, details of professional memberships and other information relevant required by law and or regulations.

· Copy of passport or drivers Licence.

· Employment history with Hopscotch

· Data that you may provide to us in course of registering your child with us or for attending one of our events or meetings.

· Images, such as photographs, CCTV footage and other media.

· Cookies as to how often our website is visited and number of visitors.

· Information about use of our information systems by staff.

· Any other personal data relating to you, your child or your circumstances that you may provide.

As registered providers of Nursery services in the UK, we are required by law to collect certain personal data from those who register with us to use our services and about the staff whom we employ to work with us. We are also required by law to verify the identity of staff, and their right to work in

the UK and with children. As a responsible employer we are required to maintain records by law for certain periods of time and to meet the requirements of income tax and pension legislation. These represent some of the legal basis upon which we collect certain personal information.

It is also in our legitimate interest to collect your personal data to defend ourselves against legal claims or to recover funds owed to us as a business.

We keep a limited amount of sensitive personal data such as any allergies a child may have, or any safeguarding concerns in relation to a child or family. This is in the keeping with the requirement of necessity and in the vital interest of the data subject as children with allergies or certain medical conditions may require urgent medical and it would not be practicable to contact the parent or guardian prior to seeking out medical services for the child.

We also rely on your consent to the participation of your child in activities where photographs or videos are taken, or when CCTV may be in use for the protection of your child, our staff and service users.

We will only use your personal data where you have consented to its use or where we are permitted to do so by applicable law, without your consent. The Data Protection Act 2018 and UK GDPR requires us to only use your personal data in a manner that is lawful, fair and transparent. The purpose for which we use your personal data must also be limited to the provision of our services to you. We are also required to only use the minimum about of data required to provide the service which you require or which we desire to accomplish. The personal data we use about you must also be accurate and from time to time we shall require you to verify that the information we hold about you is accurate and up to date. This usually involves verifying your name, address, email address etc. The principle legal ground upon which we rely to justify the use of your personal data include:

· The entering into of a contract with you to provide nursery care services, or to enter into a contact with you as an employee

· As a registered provider of nursery services, we are under several legal obligations to obtain certain data from parents and staff. These legal obligations extend to the tax, pensions legislation and statutory limitations.

· Legitimate interests: where we need to protect our business interest such as when we need to recover debts or defend ourselves from legal claims, we consider that our interest in using your data outweighs any

prejudice to your data protection rights and your personal data will be used in such circumstances in our legitimate interest.

· Legal claims: to prosecute or make a claim against you, or a third party.

· Consent: where you have consented to our use of your information (you will have been presented with a consent form or facility. You may withdraw your consent at any time. This may be by contacting us to inform us that you no longer consent, (for example you may have previously consented to your child being included in group photographs and now wish to withdraw your consent) or through an unsubscribe or similar facility where you have signed up to receive a copy of our newsletter or associated services.

Hopscotch Ltd will only share personal data about you, your child or our staff, with those organisations with whom we have a legal requirement to share personal data. We may also she personal data with organisations who provide us with services as data processors. Where we use processors, they are engaged under a written Data Processor Agreement. The data processor and its staff are bound by confidentiality, data security obligations, we maintain the right to audit them to ensure compliance with the requirements of data protection legislation and restrict the use of sub- processors.

We share your personal data as required with the following organisations or service provider:

· Our professional advisors (e.g. legal, financial, business, risk management or other advisors), bankers and auditors, data protection officer.

· Our insurers and insurance brokers;

· Third party service providers, including training providers, who train our staff such as Tapestry, account managers Childplay, providers of software, Funding Loop, Pension providers, Her Majesty’s Customs and Excise.

· We may also process your personal data to comply with our regulatory, safeguarding or other obligations or with our regulators as applicable, which may include disclosing your personal data to government, regulatory or law enforcement agencies in connection with enquiries, proceedings or investigations.

As a provider of nursery services in the United Kingdom we do not as part of our processes transfer personal data outside the UK. Should the need arise to transfer the personal data of a client abroad, we shall do so in a manner which is lawful and transparent and with the consent of the requestor. We shall comply with the exceptions provided in the Data Protections Act 2018 and apply a level of security to the data which is applicable to the category and sensitivity of the of personal data.

Where we are required to transfer personal data within the European Economic Area (EEA) this will mean that your personal data may be transferred to, and/or stored at, outside the United Kingdom as the EEA is deemed “Adequate” by the UK for the transfer and storage of personal data. In any such circumstances we shall continue to apply the appropriate level of security, proportionate to the sensitivity of the data.

We will retain your personal data for as long as is necessary to meet our legal obligations or to fulfil the purpose for which this data was collected. We are required by law to retain certain data for specific periods of time.

We apply best practice in the retention of data. CCTV records are retained for a period of 30 days and recordings recycled, unless events have been captures which give rise to an investigation or the handing over of the CCTV footage to law enforcement. Data relating to children registered with us will usually be retained for up to 3 years after the child’s last interaction with us, unless we are required by law to retain that data for a longer period. Staff files are retained for 7 years. Legal document and other records will be kept for the duration of the business plus 7 years. Further information as to the length of storage of personal data in our possession can be obtain from our Data Retention Policy.

Hopscotch Ltd takes the security of your personal data seriously. We implement a range of commercially reasonable physical, technical and procedural measures to help protect personal data from unauthorised access, use, disclosure, alteration or destruction in accordance with data protection law requirements.

Information provided to us is stored securely online in the cloud. Access to this data required the use of strong passwords and authentication.

We also ensure that our suppliers are able to meet our security requirements. All suppliers are engaged under a written contract and are required to adhere to confidentiality.

Where data is to be shared, we employ encryption strategies, a secure link or other technical measures to the security of the data.

Subject to a few restrictions, you have the right to:

Request access to your personal information. This entitles you to receive a copy of the data we hold about you.

Request correction of the information we hold about you. We are required to ensure that the data we hold about you is accurate, should you observe that any of the data we hold about you is inaccurate, please contact as soon as practicable to enable us to correct the same.

Request erasure of your data. Although you may request the erasure of your personal data, we may not be able to perform your request as we may be required to retain the data as part of our legal obligation, or we may need to retain the data defend or prosecute legal claims.

Object to processing where we are relying on our legitimate interest to process your personal data, or using your personal data for marketing, you may object to its processing.

Request that the use of your personal data be restricted. You are allowed to restrict the processing of your personal data. This usually arises where you are concerned that the data we hold is inaccurate and you would like to have it corrected.

Request the transfer of your personal data to another service provider.

If you would like to exercise of your above data subject rights, you may write to us at our address, or send us an email at dpo@hopscotchmail.com.

If you contact us to exercise any of these rights, we are required to authenticate the details of the person who is making the request, this means that you are the subject of the data being requesting by obtaining a copy of your identity. We are required to respond to you with a month once the authentication process has been completed. This period may be extended by a further two months.

You may contact us to request further information about your data protection rights in this regard or to make a complaint by sending an email to our Data Protection Office (DPO) - dpo@hopscotchmail.com.

When you visit our website, we may send a cookie to your computer. This is a small data file stored on your computer to enable our website to function and give you the best customer experience, these are necessary and functionality cookies. We may also analyse website traffic to keep count of the number of visitors who access or website or to identify what visitors find most interesting so we can tailor our services accordingly. For details of the cookies employed by us, please see our Cookie Policy.

If you have any questions about this Privacy notice or how we process your personal data, please contact us by sending an email to: dpo@hopscotchmail.com or by writing to: Hopscotch Ltd, 14 Bavant Road, Brighton BN1 6RD.

If you have asked us look into a complaint or have made a data subject request and are no satisfied with the way in which we have handled your request, you may make a complaint to the Information Commission Office (ICO). This does not prejudice your statutory rights. We hope that should you dissatisfied with our services; you will give us an opportunity to address your concern before seeking redress elsewhere. You may contact the Information Commissioner at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, casework@ico.org.uk

We may update our Privacy Notice from time to time, when there have been changes in our legal obligation or processing methods. You will be deemed to have accepted the terms of this Privacy Notice on your visit to our website following alterations. Hopscotch recommends that you keep up to date with this Privacy Notice every time you visit our website.

This Privacy notice was created in May 2024