Privacy Policy
Last updated: 28 October 2026
Who we are
The Castle Pre-School Whitstable is run by The Castle Pre-school Whitstable Ltd (company number 15867282, Ofsted URN 2834582). We are the data controller for the personal information described in this policy.
This policy explains what information we collect through our website and when you contact or register with us, why we need it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact us about your data:
- Address: Garden Lodge, Whitstable Castle, Tower Hill, Whitstable CT5 2BW
- Phone: 01227 277 878
- Email: admin@castlepreschoolwhitstable.com
- ICO registration number: ZB864061
What information we collect
We only collect the information we need to answer your enquiry, provide a place for your child, and meet our legal duties.
| When | What we collect |
|---|---|
| You browse our website | Basic technical data such as your IP address, browser type and pages visited, collected through cookies (see Cookies below) |
| You contact us or make an enquiry | Your name, email address, phone number, your child’s name and age, and anything you choose to tell us in your message |
| You arrange a visit or settling-in session | Your contact details and your preferred dates and sessions |
| You buy tickets or uniform from our online shop | Your name, email address, billing details and order history. Card payments are processed securely by our payment provider and we do not see or store your full card details |
| You register your child | Parent/carer names, addresses, contact details and emergency contacts; your child’s name, date of birth, address, health, medical and dietary needs, allergies, SEND information, GP details, people authorised to collect them, and any relevant court orders |
| You claim funded hours | Information needed for early education funding, such as National Insurance numbers and eligibility codes |
| You pay fees | Billing details and payment records |
| You attend the setting | Photographs and videos of your child taken for learning journals and, only with your consent, for our website and social media |
| You come to our front door | Images captured by our video doorbell (see Video doorbell below) |
Some of this is special category data, such as health information, ethnicity and religion where you choose to share it. We handle it with extra care and only where the law allows.
How we use your information
We use your information to run the pre-school safely and to keep you informed. We never sell it or use it for unrelated marketing.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Replying to enquiries and arranging visits | Legitimate interests, or steps before entering a contract |
| Providing your child’s place, invoicing and collecting fees | Contract |
| Processing online orders for tickets and uniform | Contract |
| Meeting the Early Years Foundation Stage (EYFS), Ofsted and funding requirements | Legal obligation |
| Safeguarding and child protection | Legal obligation; public task; substantial public interest for special category data |
| Meeting medical, dietary and SEND needs | Legal obligation; vital interests in an emergency; explicit consent where needed |
| Using photos on our website or social media | Consent, which you can withdraw at any time |
| Sending newsletters and updates about the setting | Legitimate interests, or consent where required |
| Keeping our entrance secure with a video doorbell | Legitimate interests (the safety and security of children, staff and visitors) |
| Understanding how our website is used | Legitimate interests, or consent where required for non-essential cookies |
Where we rely on consent, you can withdraw it at any time by contacting us. This does not affect anything we did before you withdrew it.
Children’s information and safeguarding
Keeping children safe comes first, and it can override other privacy considerations. Our website is for parents and carers and is not designed to collect information directly from children.
We keep records of children’s learning, development, attendance, accidents and medication as required by the EYFS. Parents and carers can see their own child’s records on request.
If we have a concern about a child’s welfare, we may share information with Kent Children’s Social Care (Kent Front Door), the Local Authority Designated Officer (LADO), the police or health professionals without consent. We do this where seeking consent would put a child at risk, in line with our Safeguarding and Child Protection Policy and the government guidance Information sharing: advice for practitioners.
Video doorbell
We do not use CCTV. We use a camera-based video doorbell at our entrance so that staff can see who is at the door before letting anyone in. It is used only for safeguarding, security and safety. Any images or recordings it captures are stored securely, kept only for a limited period, and can only be accessed by senior staff.
Who we share information with
We only share information when the law requires it, when it is needed to care for your child, or when you have agreed.
- Ofsted, for inspections and regulatory duties
- Kent County Council, for early education funding claims, SEND support and safeguarding
- The Department for Education, through the Early Years Census
- Health professionals, such as health visitors, speech and language therapists and your GP, where relevant to your child’s care
- Your child’s next school or setting, when they move on, so their learning and any support continue smoothly
- Service providers who help us run the setting, such as our website host, online shop and payment provider, online learning journal, accounting software and IT support. They act only on our instructions and must keep your data secure.
- Our insurers and professional advisers, where needed to manage claims or legal matters
We do not transfer personal data outside the UK unless suitable safeguards are in place.
How long we keep information
We keep information only as long as we need it or the law requires, then delete or securely destroy it. Typical periods are below; our full retention schedule is available on request.
| Record | How long we keep it |
|---|---|
| Enquiries that do not lead to a place | Up to 12 months |
| Children’s registration and learning records, including registers | 3 years after your child leaves the setting, or until our next Ofsted inspection after they leave. Learning journeys are passed to you or your child’s next setting |
| Accident, incident and medication records | Until the child is 21 years and 3 months old |
| Safeguarding and child protection records | Until the child is 25 years old, or longer where required |
| Fees, online orders and financial records | 6 years after the end of the financial year |
| Photos used on the website or social media | Until you withdraw consent, or 2 years after your child leaves |
Keeping your information secure
We protect your information with practical measures suited to a small setting.
- Paper records are kept in locked cabinets, with access limited to staff who need them.
- Electronic records are password-protected, and devices are secured.
- Staff receive data protection and safeguarding training, and confidentiality is part of their contracts.
- Personal mobile phones and cameras are not used in the children’s rooms, in line with our E-safety policy (06.09).
If a data breach happens that is likely to put you at risk, we will tell you and, where required, report it to the Information Commissioner’s Office (ICO) within 72 hours.
Cookies
Cookies are small files stored on your device when you visit a website. Our website uses:
- Essential cookies that make the site and our online shop work, such as remembering what is in your basket and keeping checkout secure (WooCommerce cart and session cookies).
- Analytics cookies that help us understand how visitors use the site, such as Google Analytics (
_ga) and Jetpack visitor statistics. - Order attribution cookies (
sbjs_) that tell us how shoppers found our online shop.
When you first visit our website, a cookie banner asks whether you accept analytics cookies. Analytics cookies and embedded maps are only used if you click Accept. You can change your choice at any time below, and you can also block or delete cookies in your browser settings. Blocking essential cookies may stop the online shop from working.
Links to other websites
Our website links to other sites, including our Facebook and Instagram pages. Those sites have their own privacy policies, and we are not responsible for how they use your data.
Your rights
You have rights over your personal information and, as a parent or carer, usually over your child’s information too.
- Access: ask for a copy of the information we hold about you or your child.
- Correction: ask us to fix information that is wrong or incomplete.
- Erasure: ask us to delete information, where we have no legal reason to keep it.
- Restriction: ask us to limit how we use your information.
- Objection: object to us using your information on the basis of legitimate interests.
- Portability: ask for information you gave us in a format you can pass to someone else.
- Withdraw consent: for example, for photos on our website or social media.
To use any of these rights, contact us using the details at the top of this policy. We will respond within one month and there is normally no charge. Some rights are limited where we must keep records by law or where sharing them could put a child at risk.
Complaints and changes to this policy
If you are unhappy with how we have handled your information, please talk to our Manager, Lucy Mottram, first so we can put it right. If you are still not satisfied, you can complain to the Information Commissioner’s Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
We review this policy every year and whenever our practices change. The latest version will always be on this page, with the date it was last updated shown at the top.