top of page

Privacy & Data Protection 

Privacy and Data Protection Statement

Dottie Tots Limited respects your privacy and is committed to protecting the personal information of children, families, employees, applicants and others who interact with our nurseries.

This statement provides an overview of how we use personal information. More detailed privacy information may also be provided when you enrol a child, apply for a role, use a particular service or give us information for a specific purpose.

​

Who we are

Dottie Tots Limited is the data controller for the personal information described in this statement.

For privacy questions, information-rights requests or data protection complaints, please contact:

​

Data Protection Lead
Email: hello@dottietots.co.uk
Post: Dottie Tots Limited 

​

You do not need the name or personal contact details of an individual member of staff. Enquiries sent to the role-based contact above will be directed to the appropriate person.

​

Information we may collect

Depending on your relationship with us, we may collect and use:

  • names, addresses, contact details and emergency-contact information;

  • information about children’s attendance, funding, care, learning and development;

  • health, allergy, dietary, medication, accident and additional-needs information;

  • safeguarding and welfare information;

  • photographs or recordings where appropriately authorised;

  • payment, invoicing and contractual information;

  • correspondence, enquiries, complaints and information-rights requests;

  • recruitment, employment, training, suitability and payroll information; and

  • website, device, security or CCTV information where relevant.

We collect only information that is appropriate and necessary for the purpose concerned.

​

Why we use personal information

We may use personal information to:

  • provide safe and effective early years care and education;

  • administer admissions, attendance, funded places, contracts and payments;

  • understand and support children’s learning, development, health and welfare;

  • meet safeguarding, childcare, employment, tax, health and safety and regulatory duties;

  • recruit, employ, train and manage staff;

  • communicate with families and respond to enquiries, requests or complaints;

  • protect our children, staff, premises, systems and legal rights; and

  • improve and manage our services.

​

Our lawful bases

We use personal information only where data protection law allows us to do so. Depending on the purpose, we may rely on:

  • performance of a contract or steps requested before entering a contract;

  • compliance with a legal obligation;

  • protection of someone’s vital interests;

  • performance of a task in the public interest where applicable;

  • our or another person’s legitimate interests, after considering individual rights and giving particular protection to children;

  • a recognised legitimate interest established by law, including certain safeguarding purposes; or

  • consent, where a genuine and optional choice is appropriate.

​

We do not use consent where another lawful basis is more appropriate. Where we do rely on consent, it can be withdrawn at any time for future use.

​

Health, ethnicity, religion and certain other information receives additional legal protection. We use this information only when both a lawful basis and an additional special-category condition apply. Separate safeguards apply to criminal-offence information.

​

Children’s information

Children merit particular protection. We consider their best interests, age, development, vulnerability and reasonable expectations when deciding how to use or share their information.

​

Parents and carers may ask to see information about their child, but this is not an automatic right to every record. We must also consider the child’s rights and welfare, parental responsibility, court orders, safeguarding concerns and the privacy of other people.

​

Who we may share information with

Where necessary and lawful, we may share relevant information with:

  • parents, carers or authorised collectors;

  • schools, other early years providers and professionals supporting a child;

  • local authorities, the Department for Education and Ofsted;

  • safeguarding partners, health professionals, emergency services or the police;

  • HMRC and approved payroll, pension, funding or payment providers;

  • insurers, auditors, legal or professional advisers; and

  • approved technology and service providers working under appropriate contracts.

​

We share only information that is necessary for the purpose. We may share information without consent where another lawful basis applies, including where this is necessary to safeguard a child or another person, protect life, comply with the law or cooperate with an authorised regulator.

 

We do not sell personal information.

​

Photographs and promotional material

Identifiable photographs and recordings are personal information. Separate consent will normally be requested for optional external uses such as social media or promotional material.

Withdrawing consent stops future use based on that consent, although we may not be able to retrieve material that has already been lawfully printed or published. Images used for safeguarding, accident records, learning records or another necessary operational purpose may be processed under a different lawful basis.

​

Keeping information secure

We use proportionate organisational and technical measures to protect personal information. These include access restrictions, staff confidentiality and training, secure storage, password and account controls, approved systems, secure disposal and appropriate contracts with service providers.

No method of storage or transmission is completely risk-free, but we regularly review our safeguards and respond promptly to suspected incidents.

​

International transfers

Some approved service providers may store or access information outside the United Kingdom. Where this occurs, we use a lawful transfer mechanism and appropriate safeguards required by UK data protection law. Further information about a relevant safeguard is available on request.

​

How long we keep information

We keep personal information only for as long as necessary for the purpose for which it was collected and to meet applicable childcare, safeguarding, employment, tax, insurance, legal and regulatory requirements.

Different records have different retention periods. We securely delete, anonymise or destroy information when the applicable period ends, unless it must be preserved for a safeguarding concern, complaint, investigation or legal claim.

​

Your information rights

Depending on the circumstances, you may have the right to:

  • be informed about how we use your information;

  • obtain access to your personal information;

  • correct inaccurate or incomplete information;

  • request deletion or restriction in certain circumstances;

  • object to certain uses, including direct marketing;

  • receive and transfer certain information in a portable format; and

  • receive safeguards concerning solely automated decisions with legal or similarly significant effects.

​

These rights are not absolute, and an exemption may apply. We may need reasonable evidence of your identity or authority before acting on a request.

​

To exercise a right, contact the Data Protection Lead using the details above. We will respond without undue delay and normally within one calendar month once the legal response period begins.

​

Data protection complaints

If you believe we have not handled personal information properly, please contact the Data Protection Lead. Complaints can be made verbally or in writing.

​

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it, keep you appropriately informed and provide an outcome without unjustifiable or excessive delay.

​

You may also complain to the Information Commissioner’s Office:

​

We encourage you to give us an opportunity to address your concern first, but this does not affect your right to contact the ICO.

Website cookies and marketing

​

Our website may use essential cookies and, with the required choice or consent, optional analytics or marketing technologies. Details should be provided through our cookie notice and preference tool.

Electronic marketing will be sent only where permitted by law. You can opt out at any time by using the unsubscribe option or contacting us.

​

Changes to this statement

We may update this statement to reflect changes in our services, suppliers or legal obligations. The latest version will be published on this website.

​

Last updated: August 2026

​

​

bottom of page