We keep the Early Years and Childcare Providers Privacy Notice under review. It was last reviewed and updated in February 2023.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy information for all of the City of York Council (CYC).
- personal data
- collecting personal data
- using personal data
- our legal basis for using personal data
- sharing personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Personal data
When we ask you for personal data, we will:
- ensure you know why we need it
- only ask for what is necessary for the work we are undertaking
- store it securely
- ensure access is only given to authorised staff on a need to know basis
The amount and type of personal data we collect and use about children and young people will depend on why and how you are contacting or interacting with us and the service or information you are requesting.
We will also collect and use the following information from Early Years and Childcare Providers:
- your contact details
- bank details
- Ofsted registration and inspection details
- personal data about children and young people
See further details about how we define personal data and non-personal data.
Collecting personal data
Relevant and appropriate information is collected by the Education Support Service and from your Early Years provision – typically the Manager on behalf of the Local Authority.
Information about your provision is collected through a variety of sources such as:
- completion of the application form for registering to deliver early education places
- meetings with you, and your staff
- consultation with other professionals
- professional/relevant service reports or CYC databases
- provider portal
- post, email and telephone conversations as appropriate
Using personal data
The information you provide enables us to:
- make payment of the early education and related funding
- complete the statutory Early Years Census annual return
- support you to deliver quality early education and childcare places in-line with Department for Education (DfE) statutory guidance, Statutory framework for the early years foundation stage, Ofsted requirements
- support us in meeting our statutory duties around ensuring sufficient early education and childcare places across the city
- assess our own performance and improve our service
- help prioritise in relation to the above and to inform our strategy and commissioning arrangements
- invite providers to information sessions/briefings and network meetings which are virtual/face to face to support the improving of quality and the sufficiency of places
- create statistics that are anonymous and cannot be linked back to you or your provision for the purpose of local and national surveys
Our legal basis for using personal data
Any personal data including special category data that we process about individuals is done so in accordance with Article 6 and 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (DPA 2018).
The legal basis for processing your personal data is in accordance with one or more of the following:
- Article 6(1)(a) – Consent of the data subject
- Article 6(1)(b) – Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
- Article 6(1)(c) UK GDPR – processing is necessary for compliance with a legal obligation
- Article 6(1)(e) UK GDPR - where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
This is supported by the following legal framework:
- Statutory Framework for the Early Years Foundation Stage 2021
- Early Education and Childcare Statutory Guidance for Local Authorities 2018
- Childcare Act 2016
- Sufficiency duty within Childcare Act 2006
- SEND code of practice 0 to 25 years 2025
The legal basis for processing your special categories of personal data is in accordance with one or more of the following:
- Article 9(2)(a) – Explicit consent of the data subject, unless reliance on consent is prohibited by data protection law
- Article 9(2)(b) - Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement
- Article 9(2) (2)(g) – Processing is necessary for reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued and which contains appropriate safeguards
- Article 9(2)(h) – Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of data protection law or a contract with a health professional
This is supported by Schedule 1, Part 2 (6) of the Data Protection Act 2018 and the legislation listed above.
Some of the Schedule 1 conditions for processing special category data require an Appropriate Policy Document (APD) to be in place, that sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice. Read the council’s Appropriate Policy Document.
Sharing personal data
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
- delivering our statutory functions under the Children and Families Act 2014
- where it is necessary for safeguarding children and young people
We may share information about your provision with other relevant professionals who are already involved, or who become involved, to provide co-ordinated support and to improve multi-agency working, this will include accessing Early Education Funding. Below is a list of parties with whom we regularly share information:
- Educational settings
- CYC SEND Specialist Services
- Professionals from Health, Social Care and Early Help teams
- Community teams including Family Information Service
- Business Intelligence Unit
- School Support Services
- Finance and Creditors Team
We may use the information to create statistics that are anonymous and cannot be linked back to your provision or individuals. We could use these statistics to see how the Education Support Service and the wider Council and its partners are supporting early years providers, to help design better services and to contribute to national surveys and government returns, for example to the DfE.
We are required by law to pass some of your information to the DfE for the purposes set out above. The DfE may share individual level personal data that we supply to them, with third parties. This will only take place where legislation allows them to do so and it is in compliance with the current data protection and privacy legislations.
Retaining personal data
We will only keep your personal data and information for as long as is necessary, which is for 7 years after your involvement from Education Support Service stops. It will then be securely and confidentially deleted or destroyed.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.