Privacy Notice

Introduction

Your privacy matters to us. We look after a lot of important information at Cherubs – from children’s learning and medical needs to information about our families, people, applicants and visitors. We take our responsibility to keep that information safe seriously.

This notice explains what personal information Cherubs Nurseries collects, why we use it, where it comes from, who we may share it with, how long we keep it and the rights you have over your personal information.

We process personal information in accordance with applicable UK data protection and early years legislation and guidance, including:

UK General Data Protection Regulation (UK GDPR);
Data Protection Act 2018;
Data (Use and Access) Act 2025;
Privacy and Electronic Communications Regulations (PECR), where applicable;
Statutory Framework for the Early Years Foundation Stage (EYFS);
applicable safeguarding legislation and statutory guidance; and
relevant guidance issued by the Information Commissioner’s Office (ICO).

This notice applies to:

Children attending Cherubs Nurseries;
Parents and those with Parental responsibility;
Family Members and Emergency Contacts, where we process their personal information;
Employees, Apprentices, Placement Students and agency workers;
Applicants and Prospective employees;
Contractors, Suppliers and Professionals working with Cherubs Nurseries;
Visitors to our nurseries; and
Visitors to the Cherubs Nurseries website

1. Who are We?

Childcare East Midlands LLP trading as Cherubs Nurseries, is the Data Controller for the personal information we process in connection with the operation of our nurseries and the provision of early years education and care. As Data Controller, we are responsible for deciding why and how personal information is collected and used.

Cherubs Nurseries
Cherubs Longdale
Longdale Lane
Ravenshead
Nottingham
NG15 9AH

Telephone: 0330 0553373

Data Protection Contacts

For questions about how we use personal information, please contact:

Sarah Savage – Head of Operations
Email: sarahsavage@cherubsnurseries.com

Dionne Atkinson – Head of Training
Email: dionneatkinson@cherubsnurseries.com

2. Our Commitments to Data Protection

Cherubs Nurseries will ensure that personal information is:

Processed lawfully, fairly and transparently;
Collected for specific, explicit and legitimate purposes;
Adequate, relevant and limited to what is necessary;
Accurate and kept up to date where necessary;
Retained only for as long as necessary;
Protected against unauthorised access, loss, misuse or disclosure;
Processed in accordance with individuals’ rights

We maintain appropriate records, policies and procedures to demonstrate our compliance with data protection legislation.

3. What is Personal Information?

Personal information is information relating to an identified or identifiable living individual. This can include: name, address, telephone number, email address, date of birth, photographs and video recordings, identification numbers, online identifiers, attendance information, financial information, employment information, health information and information about an individual’s personal circumstances.

4. Special Category Information

Some personal information is considered particularly sensitive and is given additional protection under data protection law. Special category information includes information about:

Health;
Racial or ethnic origin;
Religious or philosophical beliefs;
Political opinions;
Trade union membership;
Genetic information;
Biometric information used for identification;
Sex life;
Sexual orientation

For children, information of this nature may include:

Allergies;
Medical conditions;
Medication;
Health Care Plans;
Health or Disability information relating to SEND;
Dietary information where it reveals health or religious information;
Certain Safeguarding information

For employees and applicants, it may include health or disability information, sickness information, reasonable adjustments and equality and diversity information.

We will only process special category information where we have both an appropriate lawful basis under Article 6 UK GDPR and an appropriate condition under Article 9 UK GDPR. Depending on the circumstances, these additional conditions may include processing necessary for employment, social security and social protection law; protecting someone’s vital interests; establishing, exercising or defending legal claims; substantial public interest reasons permitted by law; or health and social care purposes. We may also rely on explicit consent where this is appropriate. Where required, we maintain a full GDPR Policy Document setting out how relevant special category information is handled, retained and protected.

5. Criminal Offence and Suitability Information

Criminal offence information is not special category information but is subject to additional protection under data protection law. As an early years provider, Cherubs Nurseries may process information relating to criminal convictions, offences and allegations where this is necessary and lawful, particularly in connection with safer recruitment, safeguarding and assessing an individual’s suitability to work with children.

This may include information obtained through:

Disclosure and Barring Service (DBS) checks;
Barred list checks where applicable;
Safeguarding and suitability processes;
Information disclosed by an individual;
Information provided by relevant authorities

We will only process criminal offence information where permitted under Article 10 UK GDPR and the Data Protection Act 2018. Access is strictly limited and information will only be retained for as long as necessary in accordance with applicable legal requirements, regulatory guidance and our retention arrangements. Where required by law, our GDPR Policy Document also covers our processing of criminal offence information.

6. Information about Children

Children have their own data protection rights and deserve particular protection when their personal information is used. Because the children we care for are very young and may have limited understanding of how their information is used, Cherubs takes additional care when collecting, using and sharing their information.

We may collect and use:

Name;
Date of birth;
Address;
Parent/Carer details;
Emergency Contacts;
Attendance and Absence;
Health and Medical information;
Allergies and Dietary requirements;
Medication Records;
SEND information;
Learning and Development information;
Observations and Assessments;
Photographs and Videos;
Accident and Incident records;
Pre-existing injury information;
Safeguarding and child protection information;
Information relating to speech, language and communication;
Information required for early years funding;
Transition information; and
Other information required to provide appropriate care or meet EYFS requirements.

Information will only be collected and used where necessary, appropriate and lawful.

7. Children’s Welfare and Safeguarding

The safety and welfare of children is central to everything we do. Data protection law does not prevent information from being shared where there is a lawful basis for doing so and sharing is necessary and proportionate to protect a child. Where there are safeguarding concerns, Cherubs Nurseries may share information with relevant professionals and agencies, including:

Children’s Social Care;
The Police;
Local Authorities;
Health Professionals;
Safeguarding Partners;
Other organisations involved in protecting or supporting a child.

We will follow our Safeguarding and Child Protection Policy and applicable statutory guidance when sharing safeguarding information. Information will be shared on a need-to-know basis and only to the extent that is relevant and necessary for the purpose.

8. Information about Parents and Families

We may collect information about parents, carers and family members where necessary to provide childcare, manage our relationship with families, meet legal requirements or safeguard children.

This may include:

Names;
Addresses;
Telephone numbers;
Email addresses;
Relationship to the child;
Parental responsibility information;
Emergency contact information;
Payment and account information;
Funding information;
Communications with the nursery;
Information relevant to the child’s care;
Information relating to safeguarding;
Information relating to SEND, health or other support where necessary

9. Information about Employees

We may process employee information including:

Name and contact details;
Date of birth;
Address;
Emergency Contacts;
National Insurance number;
Bank and payroll information;
Pension information;
Right to Work information;
Identification documents;
Qualifications and training;
Employment history;
References;
DBS and suitability information;
Attendance and Absence information;
Health Information;
Information relating to reasonable adjustments;
Performance, Supervision and Appraisal information;
Disciplinary and Grievance information;
Safeguarding information where relevant;
Photographs and video;
CCTV information;
Other information necessary to manage employment and meet our legal and regulatory responsibilities.

10. Information about Applicants and Recruitment

When you apply to work with Cherubs Nurseries, or are considered for a role with us, we process personal information to manage our recruitment and selection process, assess your suitability for the role and meet our legal, regulatory and safeguarding responsibilities.

Depending on the role and stage of recruitment, we may collect and use:

Name and contact details;
Address and date of birth;
Application forms and CVs;
Employment and education history;
Qualifications and professional memberships;
Interview notes, assessments and selection information;
References and referee details;
Right to work information;
Identification documents;
Information about availability and preferred working arrangements;
Information about reasonable adjustments;
Health or disability information where relevant and lawful;
Equality and diversity monitoring information where collected;
Driving licence information where relevant;
DBS, barred list and other suitability information where required;
Information relating to safeguarding or suitability to work with children;
Information provided by recruitment agencies or recruitment platforms;
Other information necessary to assess suitability for employment or meet our legal and regulatory responsibilities.

We use this information to:

Communicate with you about your application;
Assess your skills, experience, qualifications and suitability;
Arrange and conduct interviews and assessments;
Make recruitment and selection decisions;
Verify qualifications, identity and right to work;
Obtain references;
Make reasonable adjustments to our recruitment process;
Undertake appropriate safeguarding, DBS and suitability checks;
Meet our safer recruitment and safeguarding responsibilities;
Make and administer offers of employment;
Establish, exercise or defend legal claims.

If your application is successful, relevant recruitment information will normally become part of your employment record. If your application is unsuccessful, we will retain relevant information only for as long as necessary in accordance with our retention arrangements, after which it will be securely deleted or destroyed.

11. Information about Visitors

For safeguarding, security and health and safety purposes, we may collect information about visitors to our nurseries. This may include:

Name;
Organisation;
Reason for visiting;
Arrival and departure times;
Identification information where appropriate;
CCTV images;
Information necessary to safely manage access to our premises

12. Where do we get personal information from?

We collect much of the personal information we use directly from you. However, because of the nature of early years care, employment and recruitment, we may also receive information from other people and organisations. Depending on the circumstances, these may include:

Parents and carers;
Other family members and emergency contacts;
Previous early years settings and schools;
Local Authorities;
Health professionals;
SEND professionals;
Children’s Social Care and safeguarding agencies;
Police and other public authorities;
Employees and managers;
Previous employers and referees;
Recruitment agencies and platforms;
The Disclosure and Barring Service;
Government services used to verify right to work;
Professional advisers;
Publicly available professional information where its use is lawful and appropriate.

Where we obtain personal information from another source, we will provide appropriate privacy information in accordance with our legal obligations, unless an exemption applies.

13. Why do we use Personal Information?

We may use personal information to:

Provide safe and effective childcare;
Meet EYFS requirements;
Monitor and support children’s learning and development;
Support children’s individual needs;
Safeguard and protect children;
Manage attendance;
Administer early years funding;
Communicate with parents and families;
Respond to enquiries;
Manage fees and payments;
Manage recruitment and safer recruitment;
Administer employment;
Manage payroll, pensions and benefits;
Meet our legal and regulatory responsibilities;
Manage health and safety;
Investigate complaints, concerns and incidents;
Prevent and detect crime;
Maintain safe and secure premises;
Improve the quality of our services;
Provide training and professional development;
Communicate relevant information about our services;
Establish, exercise or defend legal claims

14. Our Lawful Bases for Processing

We will only use personal information where we have an appropriate lawful basis. The basis we rely upon depends on why we are using the information.

Depending on the circumstances, we may rely on:

Contract – where processing is necessary to enter into or perform a contract;
Legal obligation – where we need to comply with a legal or regulatory requirement;
Vital interests – where processing is necessary to protect someone’s life;
Legitimate interests – where processing is necessary for our legitimate interests or those of another person, provided those interests are not overridden by an individual’s rights and freedoms;
Recognised legitimate interests – where the processing meets one of the purposes specifically recognised in UK data protection law;
Consent – where consent is the appropriate lawful basis.

15. Do you have to provide personal information?

Some information is necessary for us to provide childcare, employ people, process job applications, meet safeguarding requirements or comply with the law. For example, we may need certain information to:

Safely care for a child;
Meet EYFS requirements;
Administer funding;
Enter into or perform a childcare or employment contract;
Establish an individual’s right to work;
Complete safer recruitment and suitability checks;
Administer payroll and tax; or
Meet safeguarding requirements.

If required information is not provided, we may be unable to provide a nursery place or particular service, safely care for a child, employ an individual or progress a job application. Where providing information is optional, we will make this clear where appropriate.

16. Sharing Personal Information

We only share personal information where there is an appropriate reason and it is lawful, necessary and proportionate to do so. Depending on the circumstances, information may be shared with:

Ofsted;
Local Authorities;
Children’s Social Care;
Safeguarding partners;
Police;
Health professionals;
SEND professionals;
Schools and other educational settings;
Funding authorities;
HM Revenue & Customs;
Disclosure and Barring Service;
Pension providers;
Payroll providers;
Recruitment agencies and platforms;
Referees and previous employers where appropriate;
Training providers;
Professional advisers;
Insurers;
Legal representatives;
Courts and tribunals;
IT, software and cloud service providers;
Other organisations providing services on our behalf.

Organisations processing personal information on our behalf are required to protect it appropriately and may only use it in accordance with our instructions and applicable law. We do not sell personal information.

17. Information Shared with Schools and other Settings

As children move from Cherubs into school or another educational setting, relevant information may be shared to support their transition, safety, wellbeing and continuity of learning. This may include:

Learning and Development information;
Relevant Assessments;
SEND information;
Health or Safeguarding information where necessary;
Interests and Strengths;
Communication Information;
Other information necessary to support the child

Information will only be shared where there is an appropriate lawful basis and will be limited to what is relevant and necessary.

18. Photographs and Videos

We may take photographs and videos of children and employees for legitimate nursery purposes. Depending on the circumstances, these may be used for:

Children’s learning journals;
Observations and assessment;
Displays;
Communication with parents;
Staff training;
Nursery records;
Safeguarding;
Promotional purposes, where appropriate

Different purposes may rely upon different lawful bases. Where consent is required or we have chosen consent as the appropriate basis, we will obtain appropriate consent before using photographs or videos for that purpose. Photographs and videos must only be captured, accessed, stored and shared through approved Cherubs systems and devices in accordance with our policies and procedures. Employees must never share photographs or videos of children through personal social media accounts or other unauthorised channels.

19. CCTV

Cherubs Nurseries uses CCTV at its premises to support:

Safeguarding and child protection;
Health and safety;
Security;
Prevention and detection of crime;
Training, development and quality improvement;
Investigation of incidents;
Protection of children, employees and visitors.

CCTV will only be used where there is a lawful and proportionate reason. Cameras will not be positioned in areas where people would reasonably expect a high level of privacy, such as toilets or designated changing areas. Recordings will only be accessed by authorised individuals and retained in accordance with our CCTV and retention arrangements.

Requests for CCTV footage will be considered in accordance with UK data protection law, including the privacy and rights of other people who may appear in the footage. Further information about our use of CCTV is available in our CCTV Privacy Notice and GDPR Policy.

20. Website and Cookies

When you visit the Cherubs Nurseries website, we may collect technical and usage information such as:

IP address;
Browser type;
Device information;
Website usage information;
Information collected through cookies and similar technologies.

We use cookies and similar technologies to operate and secure our website and, where appropriate, understand how people use it. Where consent is required, non-essential cookies will only be used after the appropriate consent has been obtained. You can manage your choices through our cookie management tools and can change your preferences where available. Further information is available in our Cookie Notice.

21. Service Communications and Direct Marketing

We may contact parents, employees, applicants and others with information necessary to manage our relationship with them. For example, communications about a child’s care, nursery closures, invoices, employment or a recruitment application are service or operational communications and are not necessarily direct marketing.

Separately, we may use personal information to tell people about Cherubs Nurseries, our services, events or other promotional information. Where consent is required for direct marketing, we will obtain it before sending the communication. You can object to direct marketing at any time and can use any unsubscribe facility provided. Stopping direct marketing will not prevent us from sending service, safeguarding, contractual or other necessary communications where we have another lawful reason to contact you.

22. Data Security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. These measures may include access controls, secure systems, appropriate authentication, encryption where appropriate, staff training, confidentiality requirements, secure storage, system monitoring and processes for managing information security incidents.

Access to personal information is limited to employees, contractors and service providers who have an appropriate reason to access it. Those individuals and organisations are required to handle personal information securely and confidentially. While no system can be guaranteed to be completely secure, we regularly review our arrangements and take appropriate steps to protect the information entrusted to us.

23. Artificial Intelligence (AI)

Cherubs Nurseries recognises that Artificial Intelligence (AI) is increasingly used within education, recruitment, business and administrative environments. Approved AI systems may be used to support appropriate administrative, training and operational activities. Where an AI system processes personal information, we will assess its use in accordance with data protection law, including the principles of lawfulness, fairness, transparency, data minimisation and security. We will take particular care where AI may involve children’s information, employee information, recruitment information, special category information or safeguarding information. AI will not replace professional safeguarding judgement or our responsibility for decisions affecting children or individuals. AI-generated information must be appropriately checked before being relied upon. Detailed requirements governing employees’ use of AI and confidential information are contained within our internal policies and procedures.

24. Automated Decision Making

Cherubs Nurseries does not currently make decisions about individuals based solely on automated processing where those decisions have legal or similarly significant effects. If we introduce this type of processing in the future, we will ensure that it is lawful, appropriate safeguards are in place and affected individuals are given the information and rights required by data protection law.

25. Data Retention

We only keep personal information for as long as it is necessary for the purpose for which it was collected and to meet applicable legal, regulatory, safeguarding, contractual and operational requirements. Retention periods vary depending on the type of information.

In determining how long information should be retained, we consider:

The purpose for which it was collected;
EYFS and regulatory requirements;
Safeguarding requirements;
Employment requirements;
Contractual requirements;
Financial, tax and accounting requirements;
Limitation periods and potential legal claims;
Applicable professional or regulatory guidance; and
The nature and sensitivity of the information.

Some safeguarding, children’s, employment and financial records may need to be retained for significantly longer than other information. Detailed retention periods are set out in our Data Retention Schedule. You can ask us for further information about the retention period applicable to your information by contacting our Data Protection Officer. Information that is no longer required will be securely deleted, destroyed or anonymised.

26. International Transfers

Some organisations providing services to Cherubs Nurseries may store or process personal information outside the United Kingdom. Where personal information is transferred internationally, we will ensure that the transfer complies with UK data protection law and that an appropriate mechanism or safeguard is in place where required. This may include an adequacy regulation or appropriate contractual safeguards. You can contact our Data Protection Officer for further information about international transfers affecting your personal information and the safeguards we use.

27. Your Data Protection Rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

Be informed about how your information is used;
Access personal information we hold about you;
Request correction of inaccurate or incomplete information;
Request erasure of information in certain circumstances;
Request restriction of processing in certain circumstances;
Receive certain information in a portable format where applicable;
Object to certain processing;
Withdraw consent at any time where we rely upon consent;
Exercise rights relating to certain automated decision-making

These rights are not always absolute and exemptions may apply.

28.1 Your Right to Object

Where we rely on legitimate interests to process your personal information, you have the right to object to that processing in certain circumstances. You also have the right to object to your personal information being used for direct marketing at any time. To exercise any of your rights, please contact our Data Protection Officer.

29. Children’s Data Protection Rights

Children have their own data protection rights. Where appropriate, parents or those with parental responsibility may exercise rights on behalf of a child. However, parental responsibility does not provide an automatic right to access every piece of information we hold about a child. When considering a request relating to a child’s information, Cherubs Nurseries may take into account:

The child’s age;
Maturity;
Understanding;
Best interests;
Safeguarding considerations;
Confidentiality;
The rights and privacy of other individuals

Our priority will always be to handle children’s information fairly, lawfully and in a way that protects their rights and welfare.

30. Subject Access Requests

You can request a copy of personal information Cherubs Nurseries holds about you or, where appropriate, your child. A Subject Access Request can be made verbally or in writing and does not normally need to use any particular wording or form. We may need to take reasonable steps to verify your identity before providing information. We will respond within the applicable statutory timescale and carry out reasonable and proportionate searches for information within the scope of the request.

Information relating to other individuals may need to be redacted or withheld where appropriate or legally required. To make a request or obtain further information, please contact our Data Protection Officer.

31. Keeping your Information Accurate

We take reasonable steps to keep personal information accurate and up to date. However, please tell us if your personal information changes. For children, parents and carers should notify the nursery as soon as possible about changes to:

Address;
Telephone number;
Email address;
Emergency contacts;
Parental responsibility or collection arrangements;
Medical information;
Allergies;
Dietary requirements;
Other information necessary to keep a child safe and appropriately cared for

Accurate information is particularly important for emergency and safeguarding purposes.

32. Personal Data Breaches

A personal data breach is a security incident that results in personal information being accidentally or unlawfully destroyed, lost, altered, disclosed or accessed. Examples may include:

Information being sent to the wrong person;
Loss or theft of paperwork;
Loss or theft of a device;
Unauthorised access;
Accidental disclosure;
Cyber attacks;
Inappropriate sharing;
Incorrect system permissions

If you believe a personal data breach involving Cherubs information has occurred, please report it to us immediately. We will investigate suspected breaches and assess the risks to affected individuals. Where required by law, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to an individual’s rights and freedoms, we will also notify affected individuals where required.

33. Confidentiality

Everyone working for or with Cherubs Nurseries has a responsibility to maintain appropriate confidentiality. Personal information must only be accessed, discussed or shared where there is a legitimate professional reason to do so. Employees must not discuss confidential information about children, families, colleagues, applicants or others with friends, family members or unauthorised individuals. Confidentiality requirements continue after an individual leaves Cherubs Nurseries.

34. Safeguarding and Confidentiality

Safeguarding concerns will always be treated seriously. Data protection legislation must not be used as a reason to prevent necessary and lawful safeguarding information sharing. Where information needs to be shared to protect a child, Cherubs Nurseries will follow its Safeguarding and Child Protection Policy, EYFS requirements and relevant statutory guidance. Information will be shared on a need-to-know basis and only to the extent necessary and proportionate to safeguard or support the child.

35. Messaging services
Where you choose to contact us through a third-party messaging service such as WhatsApp, information you provide may also be processed by the provider of that service in accordance with its own privacy terms. Please avoid sending sensitive information through these services unless it is necessary and appropriate to do so.

36. Changes to this Notice

We may update this notice from time to time to reflect changes in our services, systems, practices or legal and regulatory requirements. Where changes materially affect how we use personal information, we will take reasonable steps to bring those changes to the attention of affected individuals. The latest version will always be available, here, on the Cherubs Nurseries website.

Last updated: 17th August 2026
Version: 2.0

37. Concerns or Complaints

If you are unhappy with how we have used or handled your personal information, you can make a data protection complaint to us using the contact details above. We will acknowledge your complaint within 30 days, investigate it appropriately and provide you with an outcome without undue delay. We may contact you if we need further information to investigate your complaint. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Data Protection Officer
Cherubs Nurseries
Cherubs Longdale
Longdale Lane
Ravenshead
Nottingham
NG15 9AH

Telephone: 0330 0553373
Email: sarahsavage@cherubsnurseries.com

We would welcome the opportunity to address your concern.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information about your rights and how to make a complaint is available from the Information Commissioner’s Office.