Privacy Notice

This privacy notice has been written to inform individuals who come into contact with or visit us about how and why we process your personal data. It includes when we process information relating to general queries, school admissions and complaints.

Who are we?
Little Crickets Forest School is a data controller as defined by the UK GDPR. This means that we determine the purposes for which your personal data is processed and how it is processed. We will only collect and use your personal data in ways that are compliant with data protection legislation.

The nursery has appointed Veritau Ltd as its Data Protection Officer (DPO). The role of the DPO is to monitor our compliance with the UK GDPR and the Data Protection Act 2018 and advise on data protection issues. If you would like to discuss this privacy notice or our use of your data, please contact Veritau or the Operations Manager [email protected]

Veritau’s contact details are:

Schools DPO Service
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA
[email protected] // 01904 554025

What personal information do we collect?
The personal data we collect about you will be dependent on the nature of your contact and relationship with us, but could include:
• Personal details, including name, address and contact information.
• Company details and contact information, if appropriate.
• Details of the reasons for contact with us, and any communication preferences.
• Visitor information, such as the purpose of your visit and the time you enter and leave, your car registration number, and any health conditions or disability access needs you tell us about.

Any details provided by yourself or third parties relating to a complaint investigation, including witness statements and interview notes.
• Photographs or video images, including CCTV footage, if you visit our site or attend our events.
• Records of communications and interactions we have with you
• Information required for the school admissions process. This includes:
- Identifiers and contact details
- Reasons for the application
- SEN and/or Looked After status and history
- Relevant safeguarding information and professional involvement
- Equality information, such as ethnicity, religious observance, and gender.
- Characteristics including free school meal eligibility and language spoken
- Name of current and any previous school(s)
- Previous educational and assessment attainments

Why do we collect your personal information?
We process your information for the purposes outlined below:
• To effectively respond to your query or request.
• To comply with a legal or regulatory obligation, such as safeguarding and health and safety requirements.
• To process feedback and improve our services.
• To promote the school, including in newsletters, on the school website, and social media platforms.
• To effectively administer our complaints process.
• To effectively administer our admissions process and maintain a waiting list if the child is not allocated a place.
• To consider admissions appeals.
• To monitor and inform our policies on equality and diversity.

What is our lawful basis for processing your information?

Under the UK GDPR, it is essential to have a lawful basis when processing personal information. We normally rely on the following lawful bases:
• Article 6(1)(a) – consent
• Article 6(1)(c) - legal obligation
• Article 6(1)(e) - public task

If we process your personal data with your consent, you have the right to withdraw that consent at any time. If you change your mind or are unhappy with our use of your personal data, please let us know by contacting the school office.

There may be occasions where our processing is not covered by one of the legal bases above. In that case, we may rely on Article 6(1)(f) - legitimate interests. We only rely on legitimate interests when we are using your data in ways you would reasonably expect.

Some of the information we collect about you is classed as special category data under the UK GDPR. The additional conditions that allow for processing this data are:
• Article 9(2)(a) – explicit consent
• Article 9(2)(g) - reasons of substantial public interest

The applicable substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 are:
• Condition 6 - statutory and government purposes
• Condition 16 - support for individuals with a particular disability or medical condition
• Condition 18 - safeguarding of children and vulnerable people

Who do we obtain your information from?

We usually receive this information directly from you. However, we may also receive some information from the following third parties:
• Local Authority.
• Department for Education (DfE).
• Other educational settings previously attended.
• Ofsted.
• Health and/or social care providers.
• Police and/or other law enforcement bodies.

Who do we share your personal data with?
We may share your information with the following organisations:
• Department for Education (DfE).
• Local Authority.
• Ofsted.
• Information Commission and/or Local Government Ombudsman.

We may also share information with other third parties where there is a lawful basis to do so. For example, we sometimes share information with the police for crime detection or prevention.

How long do we keep your personal data?
We will retain your information in accordance with our Records Management Policy and Retention Schedule. Statutory obligations determine the retention period for most of the information we process about you. Any personal information which we are not required by law to retain will only be kept for as long as is reasonably necessary to fulfil its purpose.

We may also retain some information for historical and archiving purposes, where it is in the public interest.

Artificial intelligence (AI)

We may use some systems and platforms that incorporate an AI function. Where we do this, we ensure that the data is held securely and is not used for training the AI model. AI does not make any automated decisions about individuals, and outputs are always subject to human oversight.

International transfers of data

Although we are based in the UK, some of the digital information we hold may be stored on computer servers located outside the UK. Some of the IT applications we use may also transfer data outside the UK.

Usually, your information will not be transferred outside the European Economic Area, which is deemed to have adequate data protection standards by the UK government. If your information is transferred outside the EEA, we will take reasonable steps to ensure your data is protected and appropriate safeguards are in place.

What rights do you have over your data?

Under the UK GDPR, you have the following rights concerning the processing of your data:
• to be informed about how we process your personal data. This notice fulfils this obligation.
• to request a copy of the personal data we hold about you.
• to request that your personal data be amended if it is inaccurate or incomplete.
• to request that your personal data be erased where there is no compelling reason for its continued processing.
• to request that the processing of your personal data be restricted.
• to object to your personal data being processed.

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO using the details provided above.
If we cannot resolve your concerns, then you may also complain to the Information Commission, which is the UK’s data protection regulator. Its contact details are below: 

The telephone helpline (0303 123 1113) is open Monday to Friday between 9 a.m. and 5 p.m. (excluding bank holidays).

Alternative methods to report, enquire, register, and raise complaints are available on the ICO’s website.

Changes to this notice
We reserve the right to change this privacy notice at any time. We will typically notify you of changes that affect you. However, please check regularly to ensure you have the latest version.

This privacy notice was last reviewed 29th October 2025.

Cookies Used

Necessary

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms.

You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.