Children and families

Early Years and Childcare Providers Privacy Notice

We keep the Early Years and Childcare Providers Privacy Notice under review. It was last reviewed and updated in June 2020.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy information for all of the City of York Council (CYC).


Personal data

We collect and use the following information:

  • your contact details
  • bank details
  • Ofsted registration and inspection details
  • notes of visit

See further details about how we define personal data and non-personal data.


Collecting personal data

Information is collected by the Early Years and Childcare Service and from your Early years provision – typically the Manager on behalf of the Local Authority.

Information about your provision is collected through:

  • completion of the application form for registering to deliver early education places
  • meetings with you, and your staff
  • consultation with other professionals
  • professional/relevant service reports or CYC databases

post, email and telephone conversations as appropriate


Using personal data

The information you provide enables us to:

  • make payment of the early education and related funding
  • complete the statutory Early Years Census annual return
  • support you to deliver quality early education and childcare places inline with DfE statutory guidance, Statutory framework for the early years foundation stage, Ofsted requirements
  • support us in meeting our statutory duties around ensuring sufficient early education and childcare places across the city.
  • assess our own performance and improve our service
  • invite providers to information sessions/briefings and network meetings which are virtual/face to face to support the improving of quality and the sufficiency of places
  • create statistics that are anonymous and cannot be linked back to you or your provision for the purpose of local and national surveys

Our legal basis for using personal data

The collection of the information for the above reasons is carried out in line with:

  • Early Education and Childcare Statutory Guidance for Local Authorities 2018
  • Childcare Act 2016
  • Sufficiency duty within Childcare Act 2006
  • SEND code of practice 0-25 years 2015

Sharing personal data

We may share information about your provision with other relevant professionals who are already involved, or who become involved, during the time of accessing Early Education Funding to provide co-ordinated support and to improve multi-agency working. Below is a list of parties with whom we regularly share information:

  • Educational settings
  • CYC SEND Specialist Services
  • Professionals from Health, Social Care and Early Help teams
  • Local Area Teams including Families Information Service
  • Business Intelligence Unit
  • School Support Services
  • Finance /Creditors Team

We will not give information about you to anyone outside CYC without your consent unless required to do so by law, in delivering our statutory functions (Children and Families Act 2014), or such actions are necessary for safeguarding children and young people.

We may use the information to create statistics that are anonymous and cannot be linked back to your provision or individuals. We could use these statistics to see how the Early Years and Childcare Service and the wider Council and its partners are supporting early years providers, to help design better services and to contribute to national surveys and government returns e.g. to the Department for Education (DfE). 

We are required by law to pass some of your information to the DfE for the purposes set out above. The DfE may share individual level personal data that we supply to them, with third parties. This will only take place where legislation allows it to do so and it is in compliance with the Data Protection Act 1998 and any successor legislation.

As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA). However, for as long as the provisions of the Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020/392 remain in effect, we are currently using Zoom Video Communications Inc Pro or Business version (“Zoom”) to host meetings (version 5).

Where meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom. Some personal data, such as user’s names, email addresses; telephone numbers where applicable, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. will be stored securely on Zoom’s system in the US (that is, outside the EEA) in compliance with the EU – US Privacy Shield Framework. Zoom’s certification may be viewed online.

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services. Zoom’s privacy policy can be viewed online.

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

Retaining personal data

When we ask you for personal information, we will:

  • ensure you know why we need it
  • only ask for what is necessary for the work we are undertaking
  • store it securely
  • ensure access is only given to authorised staff on a need to know basis
  • securely and confidentially delete/destroy this personal information after a period of 7 years if you no longer have involvement from Early Years and Childcare Service.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.


Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.


Also see