Parents Information

Data Protection Policy/GDPR

The data protection policy exists to protect all individuals at Eco Montessori, whether they be children, parents or employees, from misuse of their personal information. This includes information that is printed and held on site in files, on the computer or on encrypted websites with password access.

Data protection principles:

• Personal data must be processed lawfully
• Personal data may only be collected for specific purposes
• Information should be kept up to date and accurate
• Personal data must be adequate, relevant and not excessive
• Data must not be kept any longer than necessary

Types of Data collected at Eco Montessori Ltd are not limited to, but may include:

• Staff contact details and healthcare plans
• Child pictures as observations
• Child health records such as special educational needs reports or those from outside agencies

How we keep data safe (security):

• We ensure that those persons whose information we hold are fully aware as to why the data is kept
• We gain consent for holding any persons information whenever possible
• Appropriate security arrangements are made depending on the sensitivity of the information
• Staff are fully briefed on what data can and cannot be used for in their inductions. Training can be provided where necessary.
• Paper records are locked away at the end of each working day. The setting is not used for any other purpose or accessed outside of working hours with the exception of Staff Training and the permission of the Operations and Nursery Manager
• Work issued computers and laptops are all logged and password protected. Passwords are changed regularly to lessen the risk of a data breach

How we keep Children’s records safe:

• My Montessori Child is the system used at Hartley House Montessori Ltd for observing and planning for children in the setting.
• It is a fully secure and encrypted website. All data is transferred over the internet is encrypted on the user’s device and sent to secure servers as randomised code where it is decrypted and processes. It is therefore safe from hackers and cannot be intercepted.
• Staff members access the website using their own image and pin code which they are encouraged to keep private. They then log out after they have finished using the system.
• In the event of a staff member leaving the setting, they will be deleted and unable to regain access unless re-instated by the Manager.
• Devices using My Montessori child must be authorised before access. This authorisation is given when the device serial number has been entered into the My Montessori Child database and this serial number is associated with one given school. In addition, My Montessori Chid have designed the system to prevent a device from one school having any access to information from another.
• Parents are given a password which they are encouraged to keep private in order to access the online parent’s website and their child’s records. 
• In the unlikely event of the setting device or the registered device of a staff member being lost or stolen, the device can be instantly and remotely disabled to prevent anyone accessing the website through it.
• The setting device will contain no child images for longer than 12 hours. When we are on an outing and out of internet range, we may take pictures using the device which are then manually entered by staff into My Montessori Child before they are deleted from the device. Therefore any unauthorised persons cannot access children’s images or information.
• My Montessori Child monitors the usage of the system in order to ensure it performs effectively and to detect any security anomalies. They also record all activity on the system and the system owners keep these records for three months.

Eco Montessori regards the lawful and correct treatment of personal data of paramount importance. All individuals associated with our setting, children, parents, staff, students and volunteers, have a right to expect that their personal data is treated lawfully and respectfully. To ensure this we adhere to the principles of the General Data Protection Regulations (GDPR) 2018 and subsequent UK guidelines for the collection and processing of personal data.

The GDPR principles (Article 5) requires that personal data shall be:

1. Processed lawfully, fairly and in a transparent manner in relation to individuals;
2. Collected for specified explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

In addition Article 5 (2) requires that:

• The controller shall be responsible for, and be able to demonstrate, compliance with the principles. (Source: The Information Commissioner’s Office)

e-safety Policy

At Eco Montessori we ensure that there are effective procedures in place to protect,

young people and adults from the unacceptable use of Information Communication Technology (ICT)

equipment or exposure to inappropriate materials.

Procedures

Information Communication Technology (ICT) equipment

• Only ICT equipment belonging to the setting is used by staff and/or children.
• The staff are responsible for ensuring all ICT equipment is safe and fit for purpose.
• All computers have virus protection installed.
• There is a firewall in place to ensure internet access is limited to safe and appropriate sites.
• Children in the nursery, after school club and holiday club do not bring ICT devices with them to the setting. If a child is found to have an ICT device with them, this is removed and stored in the management office until the parent collects them at the end of the session.

Internet access

• Children do not normally have access to the internet and never have unsupervised access.
• The staff members will only access the internet with the children for the purposes of promoting their learning.
• All staff have responsibility for ensuring that children and young people are safeguarded.
• Children are taught the following stay safe principles in an age appropriate way prior to using the internet;

– only go online with a grown up

– be kind online

– keep information about me safe

– only press buttons on the internet to things I understand

– tell a grown up if something makes me unhappy on the internet

• Staff members will also seek to build children’s resilience in relation to issues they may face in the online world, and will address issues such as staying safe, having appropriate friendships, asking for help if unsure, not keeping secrets as part of social and emotional development in age appropriate ways.
• If a second hand computer is purchased or donated to the nursery, the designated officers will ensure that no inappropriate material is stored on it before children use it.
• All computers for use by children are located in an area clearly visible to staff members.
• Staff members report any suspicious or offensive material, including material which may incite racism, bullying or discrimination to the Internet Watch Foundation at www.iwf.org.uk.
• Suspicions that an adult is attempting to make inappropriate contact with a child on-line is reported to the Designated Safeguarding Lead and reported to the police
• If staff become aware that a child is the victim of cyber-bullying, they discuss this with their parents and refer them to sources of help, such as the NSPCC on 0808 800 5000 or

www.nspcc.org.uk, or Childline on 0800 1111 or www.childline.org.uk.

Email

• Children are not permitted to use email in the nursery. Parents and staff members are not permitted to use the nursery equipment to access personal emails unless requested by the manager of the setting and in the confinement of the nursery office i.e. to access the log in details for an online training course.
• Staff members do not access personal or work email whilst supervising children.
• Staff members share information securely at all times.

Social media

• Staff members are advised to manage their personal security settings to ensure that their information is only available to people they choose to share information with.
• Staff members are not permitted to accept service users, children and parents as friends due to it being a breach of expected professional conduct.
• Staff members are not permitted to put their place of work on any social media site.
• In the event that staff members name the organisation or workplace in any social media, they do so in a way that is not detrimental to the organisation or its service users.
• Staff members observe confidentiality and must refrain from discussing any issues relating to work
• Staff members should not share information they would not want children, parents or

colleagues to view.

• Staff members should report any concerns or breaches to the manager of the setting.
• Staff members avoid personal communication, including on social networking sites, with the children and parents with whom they act in a professional capacity. If a practitioner and family are friendly prior to the child coming into the setting, this information must be shared with the management team prior to a child attending and an agreement is reached in relation to agreed boundaries.
• Social media accounts for the organisation are managed and maintained by the setting manager and marketing manager. Photographs used for social media marketing follow permission provided by parents/guardians.

Use and/or distribution of inappropriate images

• Staff members are aware that it is an offence to distribute indecent images. In the event of a concern that a colleague or other person is behaving inappropriately, the Allegations Against a Member of Staff policy followed.
• Staff members are aware that grooming children and young people on line is an offence in its own right and concerns about a colleague’s or others’ behaviour are reported (as above).