Privacy and Data Protection Policy

Last updated: 1 November 2026

This Privacy and Data Protection Policy explains how Childminding 4 U collects, uses, stores and protects personal information when providing childcare and related services, operating this website, and communicating with parents, carers, employees and other individuals. We are committed to handling personal information lawfully, fairly, transparently and securely in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable requirements.

1. Who is responsible for your information?

Childminding 4 U is responsible for deciding how and why personal information is used for the purposes described in this policy. If you have a question about this policy or wish to exercise a data protection right, contact us using the details in section 12.

2. What information may we collect?

The information we collect will depend on your relationship with us and the service involved. It may include:

Children: name, date of birth, address, attendance, emergency contacts, collection permissions, developmental and learning information, care requirements, dietary needs, allergies, medical information, accident and incident records, safeguarding information, photographs or videos where appropriate and authorised.
Parents and carers: names, contact details, addresses, relationship to the child, emergency arrangements, permissions, payment and invoice information, and relevant communications.
Health and additional needs: information about medical conditions, medication, allergies, disabilities, SEND, support plans and other information needed to safeguard a child and provide appropriate care. This may be special category personal data under UK GDPR.
Employees and applicants: contact details, employment history, qualifications, training, references, right-to-work information, DBS and suitability information, payroll details, and relevant health or safeguarding information where lawfully required.
Website visitors: information submitted through contact forms or email, and technical information such as device, browser, IP address and cookie information where collected by the website or its services.

Please only provide information that is relevant and accurate, and tell us when it changes. We will explain where information is required by law, necessary to provide childcare or needed to protect a child.

3. How do we collect information?

Directly from parents, carers, employees, applicants and website visitors, including through registration forms, contracts, emails, telephone calls and online forms.
From the child or their representatives, where appropriate to their age, understanding and circumstances.
From health professionals, schools, local authorities, social workers, regulators or other agencies where information is lawfully shared and relevant to a child’s care, education or safeguarding.
From employment, identity, qualification, reference and suitability checks where appropriate and lawful.
Automatically through the website, hosting provider, security tools and cookie technologies, subject to the choices and information explained in our Cookie Policy.

4. Why do we use personal information?

We use information only where we have a lawful reason and a clear purpose. Depending on the circumstances, purposes may include:

Managing enquiries, registrations, childcare arrangements, contracts, fees and payments.
Providing safe, suitable and individualised care, including meeting a child’s health, welfare, dietary, medical, developmental and additional needs.
Contacting parents, carers and emergency contacts, and managing attendance, collection arrangements and incidents.
Meeting safeguarding, welfare, health and safety, first aid, record-keeping and regulatory duties, including applicable Ofsted and Early Years Foundation Stage requirements.
Responding to concerns, complaints, accidents, incidents, requests from authorities and legal claims.
Recruiting, checking suitability, employing, training, supporting and paying staff.
Operating, securing, maintaining and improving our website and responding to website enquiries.
Establishing, exercising or defending legal claims and complying with lawful requests or obligations.

5. Our lawful bases for processing

UK GDPR requires us to identify a lawful basis for each processing purpose. Depending on the activity, we may rely on one or more of the following:

Contract: where processing is necessary to enter into or perform an agreement, such as arranging and providing childcare or managing employment.
Legal obligation: where we need to comply with a legal or regulatory requirement, including applicable childcare, safeguarding, employment, tax and health and safety duties.
Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by an individual’s rights and freedoms. We consider the impact and expectations of the people concerned before relying on this basis.
Vital interests: where processing is necessary to protect someone’s life or other vital interests, for example in an emergency.
Consent: where we choose to rely on consent, for example for certain optional uses of photographs or marketing. Consent will be specific, informed and freely given, and can be withdrawn.

Where we process special category information, such as health information, we also identify and rely on an applicable additional condition under Article 9 UK GDPR and, where required, a condition under the Data Protection Act 2018. The appropriate basis and condition depend on the particular purpose and circumstances. We do not assume that consent is the lawful basis for every use of health or safeguarding information.

6. Children’s information, photographs and safeguarding

Children’s information is handled with particular care. We collect and use information that is reasonably necessary to provide safe care, meet individual needs, maintain required records and protect children from harm. Access is restricted to people who need the information for their role.

Photographs or videos will only be used for clearly explained purposes and with appropriate permissions or another lawful basis. We will respect any restrictions agreed with parents or carers and will not assume that permission for one purpose allows use for another, such as public website or social media publication.

Confidentiality does not prevent us from sharing information when we reasonably believe this is necessary to safeguard a child, prevent serious harm, respond to an emergency or meet a legal duty. Information may be shared with children’s social care, the police, health professionals, Ofsted or other relevant agencies where lawful and appropriate. We will not promise absolute confidentiality where a safeguarding concern may need to be acted upon.

7. Who might we share information with?

We do not sell personal information. We may share relevant information, on a need-to-know basis and where lawful, with:

Parents, carers and people with appropriate parental responsibility or legal authority, taking account of the child’s welfare, confidentiality and any applicable restrictions.
Ofsted and other regulators or statutory bodies.
Local authorities, children’s social care, safeguarding partners and the police.
GPs, hospitals, health visitors, therapists, schools and other professionals involved in a child’s care or support.
Employees and authorised assistants who need the information to perform their duties.
Professional advisers, insurers, payroll providers, accountants and legal representatives where necessary.
Website, hosting, email, form, security and IT service providers who process information on our behalf or provide services to the website.

Where a service provider processes information for us, we take appropriate steps to ensure that information is protected and used only for authorised purposes. Some providers may process data outside the UK. Where this occurs, we will ensure that an appropriate UK GDPR transfer mechanism and safeguards are in place where required.

8. How do we protect and store information?

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction. These may include access controls, passwords, secure storage, confidentiality expectations, staff awareness and limiting access to people who need the information.

No method of electronic transmission or storage is completely secure. If you believe information held by us has been lost, accessed or disclosed improperly, please contact us promptly using the details below.

9. How long do we keep information?

We keep personal information only for as long as it is needed for the purpose for which it was collected, including to meet legal, regulatory, safeguarding, accounting and insurance requirements, and to deal with complaints or legal claims. Retention periods vary according to the type of record and the applicable requirements. When information is no longer required, it will be securely deleted, destroyed or anonymised.

We do not apply one retention period to every record. Our retention arrangements should be reviewed against current Ofsted and Early Years Foundation Stage requirements, safeguarding guidance, employment and tax obligations, and any relevant limitation periods. Information may need to be retained for longer where a safeguarding matter, investigation or legal claim requires it.

10. Your data protection rights

Depending on the circumstances and subject to legal exemptions, individuals have rights under data protection law to:

Be informed about how their personal information is used.
Request access to their personal information (a subject access request).
Ask for inaccurate or incomplete information to be corrected.
Ask for information to be erased in certain circumstances.
Ask for processing to be restricted in certain circumstances.
Object to processing where we rely on legitimate interests or another applicable basis.
Request transfer of information they have provided, where the right to data portability applies.
Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before consent was withdrawn.
Complain to the Information Commissioner’s Office (ICO).

These rights are not absolute and may be limited by legal requirements, safeguarding considerations or the rights of other people. For example, a request for a child’s records will be considered carefully in light of the child’s best interests, their understanding and wishes where relevant, parental responsibility, legal authority and the confidentiality rights of others.

To make a request, contact us using the details in section 12. We may need to verify identity or authority before responding. We will respond within the time limits set by data protection law and explain if an exemption or extension applies.

11. Website, cookies and external links

When you visit our website, technical information may be processed by our website platform, hosting provider and security or performance services. Cookies and similar technologies are explained separately in our Cookie Policy. Where required, non-essential cookies will only be used with your consent.

Our website may contain links to other websites. We are not responsible for the privacy practices or content of external websites. You should read their privacy information before providing them with personal information.

12. Contact us and complaints

If you have a question about this policy, want to make a data protection request or have a concern about how your information is handled, please contact Childminding 4 U:

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. Information and complaint guidance are available at ico.org.uk.

13. Changes to this policy

We may update this policy when our services, information practices or legal requirements change. The current version will be published on this page and the date at the top will be updated.

This policy should be read alongside our Cookie Policy and any relevant privacy information provided in registration, employment or other service documents.