PRIVACY NOTICE: BLOOM CHILDCARE

Last updated: June 28, 2026

This privacy notice describes how and why Bloom Childcare ("we", "us", or "our") collects, stores, uses, and shares ("processes") your and your child's information when you use our childcare services, visit our nurseries, or interact with our website bloomchildcare.fun.

1. WHAT INFORMATION DO WE COLLECT?

Because we provide professional early years childcare, we are legally required to collect comprehensive information about both parents/guardians and the children in our care.

Information You Provide Directly

Parent/Guardian Data: Names, phone numbers, email addresses, home addresses, billing information, national insurance numbers (for funding checks), and emergency contact details.

Child Data: Name, date of birth, gender, and attendance records.

Special Category (Sensitive) Data: Child’s medical history, dietary requirements, health/vaccination records, developmental observations, and any Special Educational Needs (SEN) or safeguarding details.

Information Collected Automatically

When you visit our website, we automatically collect basic technical details such as your IP address, browser type, and how you interact with our site via standard cookies and analytics tools (e.g., Google Analytics).

2. HOW AND WHY WE PROCESS YOUR INFORMATION

We only process personal data when we have a valid legal reason to do so under the UK GDPR. In a childcare setting, we rely on three main legal frameworks:

Legal Basis = What it Applies To

Legal Obligation = Fulfilling our statutory duties under the Early Years Foundation Stage (EYFS) statutory framework, Childcare Act 2006, and local authority safeguarding policies.

Performance of a Contract  = Managing your childcare bookings, processing payments, and contacting you regarding your child's care.

Consent = using your child's photograph for promotional marketing, social media or our website. You can withdraw consent for this at any time.

Vital Interests = Sharing medical data with emergency services if a child is taken seriously ill or injured while in our care.

3. WHEN AND WITH WHOM DO WE SHARE DATA?

We do not sell your data. We only share personal information with trusted third parties where required by law or to run our business effectively:

Regulatory and Legal Bodies: Ofsted, local authority early years teams (for funding/safeguarding), and the Department for Education (DfE).

Software Providers: Secure, GDPR-compliant childcare management software used for daily tracking, parental updates, and invoicing.

Emergency Services: Medical professionals in the event of an emergency.

4. HOW LONG DO WE KEEP YOUR INFORMATION?

We do not keep data forever, but as a childcare provider, we are legally restricted from deleting certain records immediately, even if requested. We retain data in strict accordance with UK law:

Child Attendance & EYFS Records: Retained for a minimum of 3 years after the child leaves our care (as required by EYFS statutory framework).

Accident and Medication Logs: Retained until the child reaches the age of 21 to 25 (under the Limitation Act 1980 for personal injury claims).

Safeguarding & Child Protection Records: Retained in line with local authority safeguarding board guidelines (typically until the child turns 25).

Enquiries and Marketing Data: Deleted after 1 year if the child does not end up enrolling with us.

5. DATA SECURITY

We take the security of your family's data incredibly seriously.

All digital childcare management systems are password-protected and encrypted.

Physical paperwork (such as registration forms) is held securely in locked filing cabinets accessible only to authorized senior staff.

All staff undergo mandatory data protection and cyber security training.

6. YOUR PRIVACY RIGHTS

Under the UK GDPR, you have significant rights regarding your data, including the right to request access to the data we hold about you (a Data Subject Access Request).

⚠️ Important Note on the "Right to Erasure" (Deletion): While you have the right to ask us to delete your data, this does not override our statutory duties. We cannot delete attendance, accident, or safeguarding records before their legal expiration dates because we are legally obligated to retain them for Ofsted and child protection compliance.

To exercise any of your rights (such as accessing your file or correcting inaccurate information), please contact us using the details below.

7. CONTACT US AND REGISTRATION DETAILS

Bloom Childcare is registered as a data controller with the Information Commissioner’s Office (ICO).

Email: enquiries@bloomchildcare.fun

Data Protection Officer: Mark Johnson — mark@bloomchildcare.fun

HOME