Business Name: Crids Kids

Policy Owner: Rachel Fardy

Effective Date: 01/09/2026

Review Date: 01/09/2027

Data Protection Policy

1. Policy Statement

Crids Kids is committed to protecting the privacy and personal information of all children, parents, carers, schools, nurseries, staff, volunteers and business contacts.

Crids Kids is a member of the Information Commissioning Office (ICO) and therefore we will process personal data fairly, lawfully and transparently in accordance with:

UK General Data Protection Regulation (UK GDPR)
Data Protection Act 2018
Privacy and Electronic Communications Regulations (PECR), where applicable

As a provider of EYFS sensory classes and science enrichment activities within nurseries and schools, we recognise our responsibility to safeguard personal information, particularly information relating to young children.

2. Scope

This policy applies to:

The business owner
Employees
Freelance instructors
Volunteers
Contractors
Anyone handling personal information on behalf of the business

It covers all personal information whether stored:

electronically
on paper
on mobile devices
in cloud-based systems
in emails
in photographs or videos

3. Data Protection Principles

We will ensure personal data is:

Processed lawfully, fairly and transparently.
Collected only for specified legitimate purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date.
Retained only as long as necessary.
Stored securely.
Processed in a way that demonstrates accountability.

4. Personal Data We May Collect

Parents and Carers

Name
Address
Telephone number
Email address
Emergency contact information
Child’s name
Child’s date of birth or age
Medical information relevant to participation
Allergy information
SEN or accessibility requirements
Attendance records
Payment information
Communication preferences

Children

Only information necessary to safely deliver sessions is collected.

This may include:

First name
Age
School or nursery attended
Medical needs
Allergies
Additional support needs
Emergency information

We do not intentionally collect unnecessary personal information about children.

Schools and Nurseries

Staff names
Work email addresses
Telephone numbers
Job titles
Booking information
Invoices
Correspondence

Staff and Volunteers

Where applicable:

Contact details
DBS information
Qualifications
Training records
Payroll information
Right to work documentation
Emergency contacts

5. Lawful Basis for Processing

We process personal information under one or more lawful bases including:

Contract

To:

process bookings
provide Courses and Sessions
communicate about sessions
issue invoices

Legal Obligation

To comply with:

safeguarding requirements
accounting and tax law
health and safety legislation

Legitimate Interests

For:

running and improving the business
communicating with customers
responding to enquiries
preventing fraud
maintaining business records

Consent

Consent will normally be obtained for:

marketing emails
photographs
videos
social media content
promotional materials

Consent may be withdrawn at any time.

6. Special Category Data

Some medical information about children or adults may be collected to ensure safe participation.

This may include:

allergies
medical conditions
disabilities
accessibility requirements

Such information is only collected where necessary and handled with additional security.

7. Children’s Data

As many participants are under five years old, we take particular care when processing children’s information.

We will:

collect the minimum information required
obtain information from parents or legal guardians
never knowingly market directly to children
protect children’s identities
only use photographs with explicit written consent

8. Photography and Video

Photographs or videos will only be taken where appropriate consent has been obtained.

Parents may withdraw consent at any time.

Images will only be used for agreed purposes such as:

website
social media
promotional leaflets
newsletter
children will not be identified by name.

9. Sharing Information

Personal data may be shared only where necessary with:

schools
nurseries
emergency services
accountants
payment providers
booking software providers
IT providers
insurers
legal advisers

Information will never be sold to third parties.

10. Data Security

We take appropriate technical and organisational measures including:

password-protected devices
encrypted cloud storage where available
secure Wi-Fi
antivirus software
software updates
limited access to personal information
secure disposal of paper records
locked storage for paper documents
secure backups

Only authorised individuals may access personal information.

11. Email and Communication Security

Business communications containing personal information will be handled securely.

Sensitive information will not be sent unnecessarily by email.

Where appropriate we will use secure file sharing or password protection.

12. Data Retention

Information is retained only for as long as necessary.

Typical retention periods include:

Booking records – 6 years

Financial records – 6 years plus current year

Accident records involving children – in accordance with current legal guidance

Marketing consent records – until consent is withdrawn

Photographs – until consent is withdrawn or no longer required

Recruitment records – up to 12 months unless legally required otherwise

Information will then be securely deleted or destroyed.

13. Individual Rights

Individuals have the right to:

be informed
access their information
request correction
request deletion where applicable
restrict processing
object to processing
request data portability where applicable
withdraw consent

Requests should be made in writing to the business owner.

Responses will normally be provided within one calendar month.

14. Data Breaches

Any actual or suspected data breach must be reported immediately to the business owner.

The business will:

investigate promptly
assess risk
contain the breach
notify affected individuals where required
report serious breaches to the UK Information Commissioner’s Office (ICO) within 72 hours where legally required
review procedures to prevent recurrence

15. Staff Responsibilities

Anyone handling personal information must:

follow this policy
keep information confidential
use secure passwords
lock devices when unattended
report breaches immediately
complete appropriate data protection training where required

16. Data Processors

The business only works with reputable service providers who provide appropriate data protection safeguards.

Examples may include:

online booking systems
online registration forms
payment processors
cloud storage providers
accounting software
email marketing platforms

Data Processing Agreements will be in place where required.

17. This Website

Cookies

Our website uses cookies to improve your browsing experience and to help us understand how visitors use our website.

Cookies are small text files stored on your device when you visit a website. They help websites function efficiently and provide information to website owners.

We may use the following types of cookies:

Essential Cookies

These cookies are necessary for the operation of our website. They enable basic functions such as page navigation, security and accessibility. The website cannot function properly without these cookies.

Performance and Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting anonymous information about page visits, user journeys and website performance. We use this information to improve our website and services.

Where required by law, these cookies will only be placed on your device after you have given your consent.

Functional Cookies

These cookies remember choices you make, such as your preferred language or cookie preferences, to provide a more personalised experience.

Managing Cookies

You can manage or delete cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of the website.

Our website uses a cookie consent banner allowing you to accept, reject or manage non-essential cookies when you first visit the site.

Links to other websites

We may provide links to other websites. We have no control over such websites and are not responsible for the content of these websites. This privacy policy does not extend to your use of such websites. You are advised to read the privacy policy or statement of other websites prior to using them.

Embedded Content from Other Websites

Articles and pages on this website may include embedded content such as:

YouTube videos
Google Maps
Social media posts
Images
Other external content

Embedded content behaves in exactly the same way as if you had visited the external website directly.

These websites may:

collect personal information about you;
use cookies;
embed additional third-party tracking technologies; and
monitor your interaction with the embedded content, including tracking your interaction if you have an account and are logged in to that website.

We recommend reviewing the privacy policies of any third-party websites before interacting with embedded content.

Comments

If visitors are able to leave comments on our website, we collect the information shown in the comments form, together with the visitor’s IP address and browser user agent string to help detect spam and prevent misuse.

If you use a profile image service (such as Gravatar), an anonymised string (also known as a hash) created from your email address may be sent to that service to determine whether you use it. Once your comment is approved, your profile picture may be publicly visible alongside your comment.

Comments submitted to our website may be moderated before publication.

We reserve the right to remove comments that are:

abusive or offensive;
discriminatory or defamatory;
spam or promotional in nature;
misleading or unlawful; or
unrelated to the content being discussed.

By submitting a comment, you grant us permission to publish it on our website.

If you wish to have one of your published comments removed, please contact us and we will consider your request in accordance with applicable data protection legislation.

Media

Where users are permitted to upload images or other media to our website, they should ensure that uploaded files do not contain embedded location data (EXIF GPS), as visitors to the website may be able to download and extract this information.

Parents, carers and other visitors should only upload photographs or videos where they have the appropriate permission from anyone identifiable in the image.

We ask that images uploaded to our website do not include identifiable photographs of children unless you have obtained the explicit consent of the child’s parent or legal guardian.

18. Complaints

Individuals who have concerns regarding data protection should contact:

Rachel Fardy

Email: info@cridskids.com

Telephone: 07421259510

If concerns cannot be resolved, individuals may contact the Information Commissioner’s Office (ICO) https://ico.org.uk/

19. Monitoring and Review

This policy will be reviewed:

annually
following changes in legislation
following significant changes to business operations
after any significant data breach

The business owner is responsible for ensuring this policy remains current and effective.

Policy Approval

Approved by: Rachel Fardy

Position: Business Owner

Signature: R.Fardy

Date: 01/09/2026