Privacy Statement
This Privacy Statement sets out how Aisling Daycare & Afterschools Ltd. uses and protects any information and personal data that we are provided with. We are committed to ensuring that all information pertaining to staff, children and parents of the nursery is gathered and stored securely and confidentially in accordance with the General Data Protection Regulation (GDPR), 2018.
Personal data is described as data relating to a living individual who is, or can be, identified either from the data or from the data along with other information that is in, or is likely to come into, the possession of the data controller.
We are committed to ensuring that we have appointed responsible people to ensure we comply with GDPR, that the relevant people have been trained in how to handle personal information, that we inform people about how we collect and use personal information, that we have processes in place so that we can respond to requests for the personal information held and that we have measures in place to keep the personal data we hold safe and secure.
All personal information that we gather in Aisling shall be: -
• Processed fairly, lawfully and in a transparent manner;
• Collected for specified, explicit and legitimate purposes;
• Adequate, relevant and limited to what is necessary;
• Accurate and kept up to date;
• Kept in a form which permits identification of data subjects for no longer than is necessary
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage
We have appointed a Data Controller and a Data Processor
• Data Controller (Bronagh McAllister)
- determines the purposes for which the data is processed and how it is processed
- legally responsible for what happens to the data
• Data Processor (Georgina Griffin & Deirdre Morgan)
- processes the data on behalf of, or under the instruction of the Data Controller
Why we process personal information
We collect and process children, parents and staff personal information for the following purposes:
- to provide the highest standard of care for children
- to establish home-school links and build partnerships with children and their families
- to encourage, promote and supervise age appropriate activities
- to maintain our own records
- to maintain our own accounts
- to support and manage our staff
The Right of Access
Individuals can request to view the information we hold at any time, by applying in writing to the Data Controller.
• Once we receive such a request, we will verify the identity of the person making the request;
• The information is available free of charge, however, we reserve the right to charge a ‘reasonable fee’, when a request is clearly unfounded or excessive, particularly if it is repetitive or if there are requests for further copies of the same information. The fee will be based on the administrative cost of providing the information;
• The information will be provided without delay and at least within one month of receipt of the request;
• We may extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform the individual within one month of the request and explain why the extension is necessary;
• Where contact with the child is governed by a legal arrangement (Court Order), we are required to comply with the legal directives in relation to providing information held on our system;
• In the event of an information request received from an individual’s legal representative all subsequent correspondence will be conducted through both parties’ legal teams;
• In the event that we refuse or are unable to respond to a request, we will explain why to the individual and inform them of their right to complain to the Information Commissioners Office (ICO) without delay and at the latest within one month;
The Right of Rectification
Parents and staff have the right to ask for incorrect or inaccurate personal information to be completed or corrected by writing to The Data Controller.
The Right to Erasure
The Right to Erasure does not provide an absolute ‘right to be forgotten’, however, individuals have a right to have their personal data erased and to prevent processing in specific circumstances:
• The data is no longer necessary
• The individual withdraws consent
• The individual objects and there is no legitimate interest for processing
• The data was unlawfully processed
• The data has to be erased to comply with a legal obligation
We can refuse to comply with a request to erasure where the personal data is processed for the following reasons:
• To exercise the right of freedom of expression and information – the freedom to hold opinions and to receive/share information/ideas without interference by public authority
• To comply with a legal obligation, for the public interest or exercise of official authority
• For public health purposes
• Archiving purposes in the public interest
• Scientific/historical research or statistical purposes
• The exercise or defence of legal claims
MyNurseryPal
This is an extensive policy which outlines the procedures in place that safeguard children while in our care.
We have engaged the services of a local company, MyNurseryPal (MNP) to provide a platform for us to digitally record personal information in relation to the children in our care and to share the information with the child’s primary carer. There are two levels of staff access to the information held on the system:
• Carer Level - can access the child’s name, date of birth, parents and collectors contact information as well as photograph permissions, medical and allergy information. They use the system to update the child’s daily record with such information as food eaten, sleeps, toileting and activities to create an online daily report;
• Admin Level – can access all the above as well as the parent’s email and home address and their password to the system. Management and office staff have been assigned as administrators on MyNurseryPal;
When the child is settling into Aisling, their primary carer will be issued with a unique log in code and password which they can use to access their child’s digital report and photograph gallery. The log in details will not be shared with anyone without the express written permission of the primary carer.
Personal data is described as data relating to a living individual who is, or can be, identified either from the data or from the data along with other information that is in, or is likely to come into, the possession of the data controller.
We are committed to ensuring that we have appointed responsible people to ensure we comply with GDPR, that the relevant people have been trained in how to handle personal information, that we inform people about how we collect and use personal information, that we have processes in place so that we can respond to requests for the personal information held and that we have measures in place to keep the personal data we hold safe and secure.
All personal information that we gather in Aisling shall be: -
• Processed fairly, lawfully and in a transparent manner;
• Collected for specified, explicit and legitimate purposes;
• Adequate, relevant and limited to what is necessary;
• Accurate and kept up to date;
• Kept in a form which permits identification of data subjects for no longer than is necessary
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage
We have appointed a Data Controller and a Data Processor
• Data Controller (Bronagh McAllister)
- determines the purposes for which the data is processed and how it is processed
- legally responsible for what happens to the data
• Data Processor (Georgina Griffin & Deirdre Morgan)
- processes the data on behalf of, or under the instruction of the Data Controller
Why we process personal information
We collect and process children, parents and staff personal information for the following purposes:
- to provide the highest standard of care for children
- to establish home-school links and build partnerships with children and their families
- to encourage, promote and supervise age appropriate activities
- to maintain our own records
- to maintain our own accounts
- to support and manage our staff
The Right of Access
Individuals can request to view the information we hold at any time, by applying in writing to the Data Controller.
• Once we receive such a request, we will verify the identity of the person making the request;
• The information is available free of charge, however, we reserve the right to charge a ‘reasonable fee’, when a request is clearly unfounded or excessive, particularly if it is repetitive or if there are requests for further copies of the same information. The fee will be based on the administrative cost of providing the information;
• The information will be provided without delay and at least within one month of receipt of the request;
• We may extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform the individual within one month of the request and explain why the extension is necessary;
• Where contact with the child is governed by a legal arrangement (Court Order), we are required to comply with the legal directives in relation to providing information held on our system;
• In the event of an information request received from an individual’s legal representative all subsequent correspondence will be conducted through both parties’ legal teams;
• In the event that we refuse or are unable to respond to a request, we will explain why to the individual and inform them of their right to complain to the Information Commissioners Office (ICO) without delay and at the latest within one month;
The Right of Rectification
Parents and staff have the right to ask for incorrect or inaccurate personal information to be completed or corrected by writing to The Data Controller.
The Right to Erasure
The Right to Erasure does not provide an absolute ‘right to be forgotten’, however, individuals have a right to have their personal data erased and to prevent processing in specific circumstances:
• The data is no longer necessary
• The individual withdraws consent
• The individual objects and there is no legitimate interest for processing
• The data was unlawfully processed
• The data has to be erased to comply with a legal obligation
We can refuse to comply with a request to erasure where the personal data is processed for the following reasons:
• To exercise the right of freedom of expression and information – the freedom to hold opinions and to receive/share information/ideas without interference by public authority
• To comply with a legal obligation, for the public interest or exercise of official authority
• For public health purposes
• Archiving purposes in the public interest
• Scientific/historical research or statistical purposes
• The exercise or defence of legal claims
MyNurseryPal
This is an extensive policy which outlines the procedures in place that safeguard children while in our care.
We have engaged the services of a local company, MyNurseryPal (MNP) to provide a platform for us to digitally record personal information in relation to the children in our care and to share the information with the child’s primary carer. There are two levels of staff access to the information held on the system:
• Carer Level - can access the child’s name, date of birth, parents and collectors contact information as well as photograph permissions, medical and allergy information. They use the system to update the child’s daily record with such information as food eaten, sleeps, toileting and activities to create an online daily report;
• Admin Level – can access all the above as well as the parent’s email and home address and their password to the system. Management and office staff have been assigned as administrators on MyNurseryPal;
When the child is settling into Aisling, their primary carer will be issued with a unique log in code and password which they can use to access their child’s digital report and photograph gallery. The log in details will not be shared with anyone without the express written permission of the primary carer.