Busy Bees Privacy Notice May 2023
Busy Bees Privacy Notice
This Privacy Notice (“Privacy Notice”) constitutes the Information Notice required under the Data Protection Act
2018 and the UK General Data Protection Regulation.
1. What is this document and why should you read it?
1.1 Busy Bees respects your privacy and is committed to protecting your personal data.
1.2 This Privacy Notice explains how and why Busy Bees including each of its operating entities in the United
Kingdom (also referred to as “Busy Bees”, “we”, “our” and “us”) collects and processes your personal
data when you browse our website or when you complete a web form expressing your interest in our
services or when you complete the registration process to place your child at a Busy Bees nursery
centre (referred to in this Privacy Notice as “you”). For more information on what constitutes
personal data, please see section 11 below.
1.3 You should read this Privacy Notice, so that you know what we are doing with your personal data. This
Privacy Notice supplements other privacy notices and policies which we may make available to you
from time to time and is not intended to override them.
1.4 This Privacy Notice does not form part of any contract you may have with us including contracts under
which we provide childcare services to you.
2. What does this Privacy Notice contain?
2.1 This Privacy Notice contains the following sections:
2.1.1 What types of personal data do we process and where do we get it from?
2.1.2 How do we use your personal data and what is the legal basis on which we process it?
2.1.3 Who do we share your personal data with, and why?
2.1.4 How do we protect and keep your personal data secure?
2.1.5 How long do we keep your personal data for?
2.1.6 What are your rights in relation to your personal data and how can you exercise them?
2.1.7 Cookies.
2.1.8 Definitions.
2.2 The pages which follow explain each of the above sections.
3. General Information
3.1 If you want more information about any of the subjects in this Privacy Notice or if you would like to
discuss any issues or concerns with us or if you wish to exercise any of your data protection rights as
set out in this Privacy Notice, you can contact us by email addressed to DPO@BusyBees.com or by
writing to The Data Protection Officer, Busy Bees Holdings Limited, St Matthews, Shaftsbury Drive,
Burntwood, WS7 9QP, UK.
3.2 We may update this Privacy Notice from time to time to reflect changes to the personal data that we
process or the way in which it is processed or in response to changed legal, regulatory or operational
requirements. This Privacy Notice was last updated on 15
th
May 2023.
Busy Bees Privacy Notice May 2023
3.3 This Privacy Notice is published by Busy Bees Holdings Limited, Registered in England and Wales
under Company Registration No 06903391 with its registered office at St Matthews, Shaftsbury Drive,
Burntwood, WS7 9QP, UK.
4. What types of your personal data do we collect and where do we get it from?
4.1 We collect many different types of personal data about you and, if we provide you with childcare
services, about you and your child. We cannot respond to your enquiry or request for information or
manage our relationship with you and to provide you with childcare services without your or your
child’s personal data. Where we don’t need your or your child’s personal data, we will make this
clear, for instance we will explain if any data fields in our enquiry or enrolment forms are optional and
can be left blank.
4.2 Further details of the personal data we collect, where we get it from and what we do with it are
set out in the table below.
4.3 If any of the personal information you have given to us changes, such as your contact details,
please inform us without delay by contacting the nursery centre where your child is enrolled.
Please always check first whether there are any available self-help tools to correct the personal
data we process about you.
Type of personal data
Collected from
a) Contact Information
• Name(s)
• Address(es)
• Email address(es)
• Contact details including mobile telephone number(s)
• You
• Publicly available
information from online
resources including when
you browse our website
• Your use of Busy Bees
mobile Apps
b) Personal Information
• Date of birth of your child(ren)
• Gender
• Next of kin and details of other dependants (and their
dates of birth where applicable)
• Your marital or relationship status
• Lifestyle and social circumstances
• Emergency contact information
• National Insurance number
• Voice recordings from voice messages or telephone
calls
• You
c) Identity and Background Information
• Passport, drivers licence or such like forms of ID
• Verification of your address
• Birth certificate(s) relating to your child(ren)
• Your child’s medical and health reports and dietary
requirements
• Image or photographs of your child(ren)
• Application form(s)
• Credit check reports
• Conflicts of interests (including where related to family
networks)
• You
• Your GP or health centre
• Government and local
agencies
• Third party credit
referencing agencies
and background
check providers
Busy Bees Privacy Notice May 2023
d) Financial Information
• Bank account details
• Direct Debit
• Credit and/or debit card
• Funding for special educational needs and childcare
• You
• Your bank or building
society
• Your local authority and
related agencies
e) Special Category Personal Data
• Racial or ethnic origin (including your nationality),
religious or philosophical beliefs
• Your child’s health data including allergy and
vaccination status, accident reports, risk assessments,
day-to-day health and safety concerns
• You
• Your emergency contact(s)
• External agencies
• Police, local or central
government authorities
• Your GP or heath centre
• Us in the course of
providing childcare services
f) Security, Location and Access Information
• Information (including image data) captured or
recorded by electronic card access systems, CCTV and
other security control systems to the extent they are
available
• Data associated with passwords which may be assigned
to you for dropping off and the collection of your child at
our centres
• You
• Your use of Busy Bees
security control
systems
• Records held at our
centres
5. How do we use your personal data and what is the legal basis on which we process it?
5.1 We process your personal data for particular purposes in connection with your engagement with us
including when you browse our website, telephone us, complete a web form or when you register
and place your child at a nursery centre.
5.2 We are required by law to always have a permitted reason or justification (called a “lawful basis”) for
processing your personal data. There are six such permitted lawful bases for processing personal
data. The table below sets out a non-exhaustive list of the different purposes for which we process
your personal data and the relevant lawful basis on which we rely for that processing. These may
change at any time and from time to time in response to changed legal, regulatory or operational
requirements including, your requirements.
5.3 Please note that where we have indicated in the table below that our processing of your personal
data is either:
5.3.1 necessary for us to comply with a legal obligation; or
5.3.2 necessary for us to take steps, at your request, to potentially enter into a contract
with you, or to perform it
and you choose not to provide the relevant personal data to us, we may not be able to enter
into
or continue our contract with you.
5.4 We may also convert your personal data into statistical or aggregated form to better protect your or
your child’s privacy, or so that you or your child are not identified or identifiable from it. Anonymised
data cannot be linked back to you or your child. We may use it to conduct research and analysis,
including to produce statistical research and reports. For example, to help us understand what
resources may be required at nursery centres or to manage and control outbreaks of illness.
Busy Bees Privacy Notice May 2023
5.5 We may use some of your personal data for checking your credit worthiness using an external agency
for this purpose. We will discuss any adverse findings with you rather than relying on an automated
decision.
Processing Activity
Legal Basis for Processing
Managing all aspects of our relationship
with you including, but not limited to,
providing you with information about our
services, visiting a nursery centre,
considering your request to place a child,
our fees and charges and your ability to pay,
your bank account details, credit and or
debit card information, carrying out credit
checks, managing absence and sickness
records for your child, understanding health
and dietary needs and special education
needs, accidents and injuries, progress and
development.
•
The processing is necessary in connection
with any contract that you have entered
into with us, or to take steps prior to
entering into a contract with us; or
• We have a legitimate interest
in carrying
out the processing for the purpose of
managing and operating our business; or
• The processing is necessary for compliance
with a legal obligation; or
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way).
Operating our business including
administering our business activities,
operating, and managing our website and
mobile Apps, providing content to you,
displaying advertising and other information
to you, communicating, and interacting with
you through our website, mobile Apps or
telephone and our services, and providing
customer service, including handling
enquiries and complaints.
•
The processing is necessary in connection
with any contract that you have entered
into with us, or to take steps prior to
entering with us; or
• We have a legitimate interest in carrying
out the processing for the purpose of our
website, mobile Apps, or our services to
you.
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way).
Communications and marketing,
communicating with you through any
means (including by email, telephone, SMS,
social media, post or in person) about news,
offers or services that we believe may be of
interest to you, subject always to obtaining
your prior opt-in consent to the extent
required under applicable law, telling about
changes to our services, providing you with
information about our mobile Apps,
providing you with information about other
services we offer, maintaining and updating
your contact information where
appropriate, and obtaining your opt-in
consent where required.
•
The processing is necessary in connection
with taking steps to enter into any contract
with us or to take steps prior to entering
into a contract with us;
• We have a legitimate interest in carrying
out the processing for the purpose of
contacting you, subject always to
compliance with appliable law.
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way).
Busy Bees Privacy Notice May 2023
Evaluation of registration forms to assess
and consider your request to place your
child at a nursery centre.
•
The processing is necessary in connection
with taking steps to enter into any contract
with us or to take steps prior to entering
into a contract with us;
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way) ; or
• We have a legitimate interest in carrying
out the processing for the purpose of
managing our operations and resources.
Maintaining emergency contact (which
involve us holding information on those you
nominate in this respect)
•
The processing is necessary in connection
with any contract that you have entered
into with us, or to take steps prior to
entering into a contract with us; or
• We have a legitimate interest in carrying
out the processing for the purpose of
managing and operating our business; or
• The processing is necessary to protect the
vital interests of your child.
Child education and training including,
progress and development assessments and
reports, participation in activities,
photographs and videos.
•
The processing is necessary in connection
with any contract that you have entered
into with us, or to take steps prior to
entering into a contract with us;
• The processing is necessary for compliance
with a legal obligation (e.g., Ofsted); or
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way); or
• We have a legitimate interest in carrying
out the processing for the purpose of
managing, operating and developing our
business.
Financial management including, arising
from registrations and enrolments,
managing your account with us, finance,
corporate audit, insurance, service provider
and supplier management, the services we
provide to you and billing.
•
The processing is necessary in connection
with any contract that you have entered
into with us, or to take steps prior to
entering into a contract with us;
• The processing is necessary for compliance
with a legal obligation.
• We have a legitimate interest in carrying
out the processing for the purpose of
managing and operating the financial affairs
of our business; or
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
Busy Bees Privacy Notice May 2023
voluntary – it is not used for processing that
is necessary or obligatory in any way.
Surveys engaging with you for the purpose
of obtaining your views on our services.
•
We have a legitimate interest in carrying
out the processing for the purpose of
conducting surveys, satisfaction reports and
market research; or
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
voluntary – it is not used for processing that
is necessary or obligatory in any way.
Management and maintenance of our
nursery centre premises and facilities for
the purpose of meeting legal and regulatory
obligations including Ofsted requirements
for maintaining space-per child ratios,
facilities and equipment.
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
providing and maintaining a safe child care
environment.
Management of IT systems for the purpose
of the management and operation of our
communications, IT and security systems,
and audits (including security audits) and
the monitoring of such systems.
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
managing and maintaining our
commuinications and IT systems.
Compliance with applicable laws relating to
our childcare operations including legal and
regulatory obligations applying to us and
judicial or administrative orders regarding
custody, access, safeguarding, education
and special needs.
•
The processing is necessary for compliance
with a legal obligation.
To protect our safety and security and
those of our staff, parents, children and
visitors including physical security of our
premises, access to and records of visits to
our premises, monitoring activity in our
premises, CCTV recordings (to the extent
that these are used and available) and
electronic security (including login records
and access details).
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
ensuring safety and well being of individulas
and the physical and electronic security of
our business and our premises.
Health and Safety including health and
safety assessments and record keeping
including to prevent communicable health
or medical conditions and viruses such as
COVID-19, administration of first aid,
administration of medicine (but only with
your consent and direction), providing a
safe environment at our premises and
compliance with related legal obligations.
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
ensuring safety at our nursery centre; or
• The processing is necessary to protect the
vital interests of any individual.
• We have obtained your prior consent to
the processing (this legal basis is only used
in relation to processing that is entirely
Busy Bees Privacy Notice May 2023
6. Who do we share your personal data with, and why?
6.1 Sometimes we need to disclose your personal data to other people.
Inside the Busy Bees group
6.2 We are part of the Busy Bees group of companies. Therefore, we will need to share your personal data
with other companies in the Busy Bees group for our general business, for management purposes, for
managing our nursery centres, incident and accident reporting, authorisations/approvals with
relevant decision makers, parental reporting and where systems and services are provided on a
shared basis.
6.3 Access rights between members of the Busy Bees group are limited and granted only on a need-to-
know basis, depending on job functions and roles.
6.4 Where any Busy Bees group companies process your personal data on our behalf (as our processor),
we will make sure that they have appropriate security standards in place to make sure your personal
data is protected and we will enter into a written contract imposing appropriate security standards
on them.
Outside the Busy Bees group
6.5 We engage service providers or partners to manage or support certain aspects of our business
operations on our behalf. These service providers or partners may be located outside of the UK and
the European Economic Area and may, for example, provide services such as credit card processing,
providing and managing hosted childcare software processing systems, advertising and marketing
services, IT services, email services, data hosting and cloud storage, debt collection and management,
and customer satisfaction surveys. Our service providers and partners are required by contract to
voluntary – it is not used for processing that
is necessary or obligatory in any way).
Investigations required for Safeguarding,
detecting, investigating and preventing
breaches of policy, and criminal offences, in
accordance with applicable law.
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
detecting and protecting against, breaches
of our policies and applicable laws.
Legal proceedings required for establishing,
exercising and defending legal rights,
including investigating and responding to
claims against us and our staff.
•
The processing is necessary for compliance
with a legal obligation; or
• We have a legitimate interest in carrying
out the processing for the purpose of
establishing, exercising or defending our
legal rights and our staff.
Fraud prevention required for detecting,
preventing and investigating fraud.
•
The processing is necessary for compliance
with a legal obligation ; or
• We have a legitimate interest in carrying
out the processing for the purpose of
detecting and protecting against fraud.
Busy Bees Privacy Notice May 2023
safeguard any personal data they receive from us and are prohibited from using the personal data for
any purpose other than to perform the services as instructed by Busy Bees.
6.6 In certain circumstances, we will also disclose your personal data to third parties who will receive it
as controllers of your personal data in their own right for the purposes set out above, in particular:
6.6.1 if we transfer, purchase, reorganise, merge or sell any part of our business or the business
of a third party, and we disclose or transfer your personal data to the prospective seller,
buyer or other third party involved in a business transfer, reorganisation or merger
arrangement (and their advisors); and
6.6.2 if we need to disclose your personal data in order to comply with a legal obligation, to
enforce a contract or to protect the rights, property or safety of our staff, parents, children
or other individuals.
6.7 We have set out below a list of the categories of recipients with whom we are likely to share your
personal data:
6.7.1 our bank;
6.7.2 consultants and professional advisors including legal advisors and accountants;
6.7.3 medical care and health providers;
6.7.4 background check providers;
6.7.5 courts, court-appointed persons, local authority designated officer (LADO) for Safeguarding
purposes and local authority Special Educational Needs (SEN) officers;
6.7.6 business partners and joint ventures;
6.7.7 educational training providers;
6.7.8 insurers; and
6.7.9 governmental departments, statutory and regulatory bodies, Information Commissioner’s
Office (ICO), Disclosure and Barring Services (DBS), Ofsted, the police, social services and
Her Majesty’s Revenue and Customs.
We may also share your personal data with third parties, as directed by you.
6.8 If any of our processing activities require your personal data to be transferred outside the European
Economic Area, we will only make that transfer if:
6.8.1 the country to which the personal data is to be transferred ensures an adequate
level of protection for personal data;
6.8.2 we have put in place appropriate safeguards to protect your personal data, such
as an appropriate contract with the recipient;
6.8.3 the transfer is necessary for one of the reasons specified in data protection legislation,
such as the performance of a contract between us and you; or
6.8.4 you explicitly consent to the transfer.
Busy Bees Privacy Notice May 2023
7. How do we protect and keep your personal data secure?
We employ physical, electronic and managerial control procedures to safeguard and prevent
unauthorised access, accidental loss, destruction or damage of your personal data. We choose these
safeguards based on the sensitivity of the personal data that we collect, process and store and the
current state of technology. Our outsourced service providers who support our operations are also
vetted to ensure that they have appropriate technical and organisational measures in place to
protect your personal data.
8. How long do we keep your personal data for?
8.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it
for.
8.2 To determine the appropriate retention period for personal data, we consider the amount, nature
and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of
your personal data, the purposes for which we process your personal data and whether we can
achieve those purposes through other means. Further the period of time that we will retain your
personal data will also depend on a number of other factors, including:
8.2.1 any laws, regulations, tax, accounting or reporting requirements that we are required to
follow;
8.2.2 whether we are in a legal or other type of dispute with each other or any third party;
8.2.3 whether we are asked by you or a regulatory authority such as Ofsted to keep your
personal data for a valid reason.
9. What are your rights in relation to your personal data and how can you exercise them?
9.1 You have certain legal rights, which are briefly summarised in the table below, in relation to any
personal data which we hold about you.
Your Right
What does it mean?
Limitations & Conditions on your
Right
Right of access
Subject to certain conditions, you
are entitled to have access to your
personal data (this is more
commonly known as submitting a
“data subject access request”).
If possible, you should specify the
type of information you would like
to see to ensure that our
disclosure is meeting your
expectations.
We must be able to verify your
identity. Your request may not
impact the rights and freedoms of
other people, e.g. privacy and
confidentiality rights of others.
Right to data
portability
Subject to certain conditions, you
are entitled to receive the personal
data which you have provided to us
and which is processed by us by
automated means, in a structured,
commonly used machine-readable
format.
If you exercise this right, you
should specify the type of
information you would like to
receive (and where we should
send it) where possible to ensure
that our disclosure is meeting your
expectations.
This right only applies if the
Busy Bees Privacy Notice May 2023
processing is based on your
consent or on our contract with
you and when the processing is
carried out by automated means
(i.e. not for paper records). It
covers only the personal data that
has been provided to us by you.
Rights in relation
to inaccurate
personal data or
incomplete
personal data
You may challenge the accuracy or
completeness of your personal
data and have it corrected or
completed, as applicable. You have
a responsibility to help us to keep
your personal information accurate
and up to date.
We encourage you to notify us of
any changes regarding your
personal data as soon as they
occur, including changes to your
contact details, email and
telephone number.
Please always check first whether
there are any available self-help
tools to correct the personal data
we process about you.
This right only applies to your own
personal data. When exercising
this right, please be as specific as
possible.
Right to object to
or restrict our
processing of your
personal data
Subject to certain conditions, you
have the right to object to ask us to
restrict the processing of your
personal data.
This right applies where our
processing of your personal data is
necessary for our legitimate
interests. You can also object to
our processing of your personal
data for direct marketing
purposes.
Right to erasure
Subject to certain conditions, you
are entitled to have your personal
data erased (also known as the
“right to be forgotten”),
e.g. where your personal data is no
longer needed for the purposes it
was collected for, or where the
relevant processing is unlawful.
We may not be in a position to
erase your personal data, if for
example, we need it to (i) comply
with a legal obligation, or (ii)
exercise or defend legal claims
including, for the purposes of debt
recovery.
Right to withdraw
consent
Where our processing of your
personal data is based on your
consent you have the right to
withdraw your consent at any time.
If you withdraw your consent, this
will only take effect for future
processing.
9.2 Where our processing of your personal data is based on your consent, you have the right to
withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing
your personal data for that purpose, unless there is another lawful basis we can rely on and in which
case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to
that point but you may, for example, lose future access to information about activities, promotions
and offers.
9.3 Where our processing of your personal data is necessary for our legitimate interests, you can object
to this processing at any time. If you do this, we will need to show either a compelling reason why
our processing should continue, which overrides your interests, rights and freedoms or that the
Busy Bees Privacy Notice May 2023
processing is necessary for us to establish, exercise or defend a legal claim.
9.4 If you wish to exercise any of your rights please contact DPO@BusyBees.com.
9.5 You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the
UK data protection regulator. More information can be found on the Information Commissioner’s
Office website at https://ico.org.uk/.
10. Cookies
10.1 Similar to other commercial websites, our website uses technology called “cookies” and our web
server logs collect information about how our website is used.
10.2 Cookies in conjunction with our web server’s log files allow us to calculate the aggregate number of
people visiting our website and which parts of our website are most popular. This helps us gather
feedback so that we can improve our website and better serve our customers.
10.3 You can find out more about cookies at https://cookiepedia.co.uk/giving-consent-to-cookies
10.4 You can manage your cookie preferences by clicking Cookie Settings. Some cookies are necessary or
essential for our website to operate.
11. Definitions
11.1 “Personal data” is any information that relates to an identifiable natural person. Your name, address,
contact details, banking details in direct debit forms are all examples of your personal data, if they
identify you.
11.2 The term “process” or “processing” means any activity relating to personal data, including, by way of
example, collection, storage, use, organisation, consultation and disclosure by transmission.
11.3 Busy Bees is a "controller" of your personal data. This is a legal term – it means that we make decisions
about how and why we process your personal data, and, because of this, we are responsible for
making sure it is used in accordance with data protection laws.
