.mpolicy-signature .mpolicy-signature-name{color:#E74C25;font-weight:700}
GDPR Privacy Notice for Parents and Carers
ME Montessori Nursery and Pre-School
Bedgrove Community Centre, Bedgrove Park, Ambleside, Aylesbury, HP21 9TT
| Version | 1.0 |
| Date | May 2026 |
| Review Date | May 2027 |
| Policy Owner | Francesco Antonazzo FCIPD |
| Statutory Reference | UK General Data Protection Regulation (UK GDPR); Data Protection Act 2018; EYFS Statutory Framework (September 2025 revision) |
1. Introduction
ME Montessori Nursery and Pre-School takes the privacy of your family seriously. This notice explains what personal information we collect about you and your child, why we collect it, how we use it, and what your rights are.
This notice applies to all parents, carers, and emergency contacts of children enrolled at or applying to ME Montessori. We ask you to read it carefully. It sits alongside our full GDPR Policy, which is available on request.
2. Data Controller
ME Montessori Nursery and Pre-School is the data controller for all personal information it holds about you and your child.
The data controller is responsible for deciding how and why your personal data is processed.
Data Controller Contact:
Francesco Antonazzo, Principal/Owner
ME Montessori Nursery and Pre-School
Bedgrove Community Centre, Bedgrove Park, Ambleside, Aylesbury, HP21 9TT
Email: [email protected]
Telephone: 07873 403672
Designated Data Protection Lead:
ME Montessori does not meet the threshold requiring appointment of a formal Data Protection Officer. Queries about data protection are directed to Francesco Antonazzo at the contact above.
3. What Personal Data We Collect
About Your Child
- Full name and date of birth
- Home address
- Photograph (for identification and learning journal purposes, subject to your consent)
- Medical information: health conditions, allergies, dietary requirements, prescribed medications
- Developmental information: observations, assessments, progress reports, learning journal entries
- Attendance records
- Special Educational Needs and Disabilities (SEND) information where relevant
- Any court orders, looked-after child status, or child protection information shared with us by statutory authorities
About Parents, Carers, and Emergency Contacts
- Full name
- Home address
- Phone number(s)
- Email address
- Relationship to the child
- Employer information (where relevant to funded hours eligibility)
- Emergency contact details (minimum three contacts per child, as required by EYFS 2025)
- Funded childcare eligibility code (15/30 hours)
- Bank details or payment records (where relevant for fee management)
- Communications records (emails, letters, meeting notes)
4. Legal Basis for Processing
We process your personal data on the following legal grounds:
| Type of Processing | Legal Basis |
|---|---|
| Registering your child and providing nursery care | Contractual necessity — we cannot provide our service without this information |
| Child welfare, safeguarding, and health and safety | Legal obligation — EYFS statutory framework, Children Act 1989, safeguarding legislation |
| SEND support and health care plans | Legal obligation and vital interests |
| Administering funded childcare hours | Legal obligation — Childcare Act 2006; reporting to Buckinghamshire Council |
| Learning journals, observations, and assessments | Legitimate interests — delivering high-quality early education; sharing with parents as part of the educational relationship |
| Photographs of your child in educational activities | Consent — you are asked for explicit consent at enrolment; consent can be withdrawn at any time |
| Communicating with parents about their child’s progress | Contractual necessity and legitimate interests |
5. How We Use Your Information
We use the personal data we collect to:
- Provide safe, high-quality early years education and childcare
- Maintain attendance registers and fulfil our legal obligations under EYFS
- Manage your child’s health, wellbeing, and dietary needs
- Create and maintain your child’s learning journal and developmental records
- Administer government-funded childcare hours and claim funding from Buckinghamshire Council
- Communicate with you about your child’s progress, wellbeing, and any issues that arise
- Manage fee payments and financial records
- Respond to safeguarding concerns in accordance with our statutory duties
- Comply with Ofsted registration conditions and facilitate inspections
- Fulfil our legal obligations as an employer and registered childcare provider
We do not use your personal data for marketing, profiling, or automated decision-making.
6. Who We Share Your Information With
We keep your information confidential. We only share it with the following organisations where there is a legal, contractual, or safeguarding reason to do so:
| Recipient | Reason |
|---|---|
| Ofsted | Statutory registration obligations; inspection |
| Buckinghamshire Council | Administering funded childcare hours; early years support; SEND referrals |
| NHS / Health Professionals | Health care plans; referrals for health assessments or intervention (e.g., speech and language therapy, health visitor) |
| Children’s Services / Social Care | Safeguarding referrals and Child Protection proceedings, where required by law |
| Police | Where required in connection with a safeguarding or criminal matter |
| Nursery management software provider | Tapestry (Foundation Stage Forum) — stores learning journals and observations on secure servers; subject to data processing agreement |
| Payroll / Accountancy services | Financial record-keeping and invoicing (parent data only, not child data) |
| HMRC | Tax-Free Childcare administration |
We do not sell your personal data to any third party. We do not share your data for advertising or marketing purposes.
7. International Data Transfers
We do not transfer personal data outside the United Kingdom. Our learning journal platform, Tapestry, stores data on UK-based servers.
8. How Long We Retain Your Data
| Category of Data | Retention Period |
|---|---|
| Child’s registration and general records | Until the child’s 25th birthday (to allow for potential future claims or safeguarding matters) |
| Safeguarding and child protection records | Until the child’s 25th birthday, or longer if directed by statutory authorities |
| Financial records (invoices, payment records) | 7 years from the end of the financial year (HMRC requirement) |
| Attendance registers | 3 years |
| Staff records (held separately) | 6 years after employment ends |
| CCTV footage | 28 days unless retained as evidence for a specific incident |
| Unsuccessful admissions applications | 6 months from the decision date |
When data is no longer needed, it is securely deleted or destroyed.
9. Your Rights Under UK GDPR
You have the following rights in relation to your personal data (and, as a parent or guardian, in relation to your child’s personal data):
Right of Access: You can request a copy of the personal data we hold about you or your child. This is called a Subject Access Request (see section 10).
Right to Rectification: If any data we hold is inaccurate or incomplete, you have the right to ask us to correct it.
Right to Erasure: In certain circumstances, you have the right to ask us to delete your personal data. This right does not apply where we have a legal obligation to retain the data (e.g., safeguarding records).
Right to Restrict Processing: You can ask us to restrict how we use your data in certain circumstances.
Right to Data Portability: Where data is processed on the basis of consent or contract, you may request a copy in a commonly used format.
Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent (e.g., photography), you can withdraw consent at any time by notifying the Manager. This will not affect the lawfulness of processing before withdrawal.
10. How to Make a Subject Access Request
10.1 To request a copy of the personal data we hold about you or your child, please contact:
Francesco Antonazzo
Email: [email protected]
Post: ME Montessori, Bedgrove Community Centre, Bedgrove Park, Ambleside, Aylesbury, HP21 9TT
10.2 Please include:
– Your full name and the child’s full name
– A description of the specific information you are requesting
– Your preferred format for receiving the information
10.3 We will respond within one calendar month of receiving a valid request. If the request is complex, we may extend this by a further two months and will inform you.
10.4 Requests are provided free of charge unless they are manifestly unfounded or excessive.
11. Complaints About Data Use
11.1 If you have a concern about how we handle your personal data, please raise it with Francesco Antonazzo in the first instance.
11.2 If your concern is not resolved to your satisfaction, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Helpline: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to This Notice
This notice may be updated from time to time. Where changes are significant, we will notify you directly. The current version is always available from the nursery office or on request.
13. Review
This notice is reviewed annually by the Policy Owner, or sooner following any change in data protection law, the nursery’s systems, or the introduction of new data processing activities.
Signed: Kellie Antonazzo, Manager