The General Data Protection Regulation (GDPR) is designed to protect the privacy of individuals. It requires that any personal information about an individual is processed securely and confidentially. This includes both staff and children. How ABC obtains, shares and uses information is critical, as personal data is sensitive and private. Everyone, adults and children alike, have the right to know how the information about them is used. We will respect the privacy of children and their parents and carers, while ensuring that they access high quality early years care and education.
The eight General Data Protection Regulation Principles
• Personal data shall be processed fairly and lawfully. •Personal data
shall be obtained only for one or more specified and lawful
purposes, and shall not be further processed in any manner i
incompatible with that purpose or those purposes.
• Personal data shall be adequate, relevant and not excessive in
relation to the purpose or purposes for which they are processed.
• Personal data shall be accurate and, where necessary, kept up to
• Personal data processed for any purpose or purposes shall not be
kept for longer than is necessary for that purpose or those
• Personal data shall be processed in accordance with the rights of
data subjects under this Act.
• Appropriate technical and organisational measures shall be taken
against unauthorised or unlawful processing of personal data and
against accidental loss or destruction of, or damage to, personal
• Personal data shall not be transferred to a country or territory
outside the European Economic Area unless that country or
territory ensures an adequate level of protection for the rights and
freedoms of data subjects in relation to the processing of personal
• The General Data Protection Regulation includes the following rights
• the right to be informed
• he right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• rights in relation to automated decision making and profiling
Sensitive personal information will not be processed until an assessment has been made of the proposed processing as to whether it complies with the criteria above and the individual has been informed (by way of a privacy notice or consent) of the nature of the processing, the purposes for which it is being carried out and the legal basis for it. Unless the School can rely on another legal basis of processing, explicit consent is usually required for processing sensitive personal data. Evidence of consent will need to be captured and recorded so that the school can demonstrate compliance with the GDPR.
Personal data is information that relates to an identifiable living individual that is processed as data. Processing amounts to collecting, using, disclosing, retaining or disposing of information. The General Data Protection Regulation principles apply to all information held electronically or in structured paper files.
In practice, it means that ABC must:
Have legitimate grounds for collecting and using the personal data.
Not use the data in ways that have unjustified adverse effects on the individuals concerned. Be transparent about how we intend to use the data, and give individuals appropriate privacy notices when collecting their personal data. Handle people’s personal data only in ways they would reasonably expect; and make sure that we do not do anything unlawful with the data. Sensitive personal data is information that relates to:
race and ethnicity
• political opinions
• religious beliefs
• membership of trade unions
• physical and mental health
• criminal offenses
We will not disclose information about you to third parties unless we are legally obliged to do so or where we need to comply with our contractual duties to you, for instance we may need to pass on certain information to our subcontractors or Government agencies
Legal Basis Article 6.1b, processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Article 6.1c, of the Data Protection Regulation, processing is necessary for compliance with a legal obligation to which the controller is subject;
Article 6.1d, processing is necessary in order to protect the vital interests of the data subject or of another natural person;
Article 6.1e, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Article 6.1f, processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Skollagen. It is with the support of these regulations that ABC All About Children processes personal data.
What kind of personal data do we collect?
Personal information (such as name, Personal identification number, telephone number, address and email).
• Personal information (such as name,
• Personal identification number, telephone number, address and
• Characteristics (such as language, nationality, food preference and
country of birth).
• Medical information (relevant medical conditions, allergies, etc)
• Attendance information (number of attendance/absences and
reasons where necessary).
• Behavioural information (such as behaviour incidents).
• Assessment information (such as national curriculum assessments).
• Special educational needs information.
• Financial and bank information.
• Photographic documentation.
• Parent schedules and certificates of need/employment from the
parent’s place of employment.
How do we collect your data?
You directly provide us with most of the data we collect.
We collect data and process data:
• When you register your child in our queue to attend ABC from our
• When you are accepted into the school.
• Tyra/COR Advantage app.
• During the school year.
How will we use your data? We collect your data so that we can:
• Enrol you and your child/children into the school.
• Help support home language and culture
• Inform your teachers of any medical and or allergic reactions that
may put you child at risk.
• Keep records of attendance
• Keep a record for your child’s assessments in Tyra and COR
Advantage apps including those for national curriculum, behavioural
and or special educational needs if required.
• Calculation and collection of school fees.
• Photographic documentation for school reports and identification in
Tyra apps, as well as daily update to parents of class activities in
individual and group posts.
• Ascertain appropriate hours of care and corresponding staffing
More information on Personal information and legal basis for collection of personal data is as follows:
At ABC All About Children Preschool we take your privacy seriously and will only use the personal information we need to manage and provide care for your child.
Personal information such as name, personal identification numbers, telephone number, address and email used in registration the legal premise is processing of personal data takes place on the legal basis of GDPR 6.1b/c(public interest) avtal /contract. If you are accepted into the school we keep your information for the period you are at ABC and we keep your contact information for one year after you leave. If the information is for queue placement for the preschool, this is deleted after new registrations have taken place on the 31st August every year.
Pedagogical Documentation/COR Advantage reports
Are given out two times a year at individual parent meetings with your class teachers. They are shared in my documents in your childs profile in Tyra. We will keep pedagogical documentation while your child is at ABC and for one year after you leave. HighScope is a comprehensive approach to working with children based on proven practice and scientific theory. It was originally created for at-risk children and children with additional needs in the early 1960s. HighScope aligns with the Swedish curriculum. It is an authentic assessment of individual children’s developmental progress in relation to themselves based on what children can do. It does not compare children or ages. It is called authentic, as we identify and collect objective anecdotes based on what the children are doing and saying naturally in the classroom when they interact with the environment, their peers and adults around them. HighScope does not test the children in any way. The teachers take the children’s interests and the curriculum into account to develop the environment and learning opportunities. Processing of personal data takes place on the legal basis of Skollagen/GDPR 6.1c
We collect information in regard to language, nationality, food preference and country of birth to help support your child’s home language and culture, as well as any special nutritional requirements, processing of personal data takes place on the legal basis of Diskrimineringslagen (2008:567)/ Skollagen/GDPR 6.1e.
Allergy and Medical
ABC will administer medication only in the case of life-threatening allergiess and chronic illness, i.e. asthma and diabetes. In the interest of safety for all involved, we do not medicate children for acute, short term illness, such as general infections, this includes medication prescribed by a doctor, such as antibiotics or cough syrups. Allergy and Medical, as well as emergency information that may require immediate access during the school day, will be stored in Tyra under your child’s profile section page as well as posted in food areas of the school. Any sensitive medical information is stored in protected areas either in paper or in digital format, such as Permission for Egenvård. Processing of personal data takes place on the legal basis of Skollagen/GDPR 6.1d.
Photographs and Video
At ABC we keep pedagogical records of your child. To complement your Child’s records, we use both photographs and video in school situations to support this. All photographs and videos are stored on school computers/devices and in cloud backed up service. Images of staff and students may be captured at appropriate times and as part of educational activities for use in the school documentation. It is the school’s policy that only employed staff members are allowed to capture images of staff or pupils during such activities unless prior consent is achieved. Your child’s photographs/videos will be deleted at the end of the school year. Except those used in pedagogical documentation. Images are uploaded to Tyra in your Childs profile as well as in Tyra class blogs which is seen only by parents and guardians. Photographs are also used in COR reports. It is important for you to know that other children’s images might be included in your own child’s report and your child in other children’s reports. Your child’s picture may also be used to indicate their place in the classroom and in Tyra for identification, as well as in kitchens for food preferences and allergies. We also use Photographs of parents and guardians in certain instances in the classroom as well as for identification on your Child’s records and in your child/children’s Tyra profile. Where there is no legal basis for photography or filming we will ask for permission. Parents will receive a attachment or link to the email address we have registered under your Tyra profile. We recommend that parents do not share the slideshow on social media. Legal bias GDPR 6.1 e/f.
How we store your personal information
Your information and your child’s data is held in secure data centres and hard copy data, records, and personal information are stored in a secure area and can only be accessed by authorised personnel. We will delete you and your child’s personal information when you are on longer enrolled in the school, unless there is a compelling or legal requirement to do so. We will keep pedagogical documentation, class registration for one school year after the date of completion. Accounting records are kept for 7 years. We keep a secure back up of all computers/mobile devices. This is an automated system. Sensitive or personal information and data should not be removed from the school, however the school acknowledges that sometimes it may need to be transported outside of the school premises, for example (Class excursions, to our accountant, government offices etc). There are guidelines in place for staff in order to reduce the risk of personal data being compromised. All phone/devices are password protected.
We share information with government offices in regards to your child being enrolled at ABC in regards to financing and attendance. Our legal basis of GDPR 6.1c.
Companies and systems where we use digital/financial services and IT
We use companies for services within IT, accounting and various applications where ABC is the data controller. We only use companies that can offer sufficient guarantees under Article 28 GDPR.
ABC uses the Tyra app which is a secure registration and communication system between the school and parents to provide you with updated information and share relevant news and therefore you need to access Tyra for your child to be enrolled at ABC. Your personal data will be removed from this system when you are no longer enrolled at ABC. Our legal basis of GDPR 6.1b/c/d/e, avtal /contract, Skollagen.
Our acountants for invoicing parent fees. You and your child’s information will be removed once any legal restictions are waved. Invoiced information will be kept for the legal period time stated by the tax authorities. Our legal basis of GDPR 6.1c.
Kaymbu HighScope COR Advantage
At ABC we use HighScope COR Advantage. It is an observation-based assessment instrument for children from birth through kindergarten. It is designed to measure children's progress in all early childhood programs. We use your child name, birthday (not the last 4digits of the personal number) in creating your Child’s HighScope profile. HighScope Online COR is an objective, observation-based assessment of children's individual learning and is an authentic, positive and appropriate approach to measuring children’s individual, developmental progress based on their strengths. Our Child Observation Record (COR) is for use with children from infancy through kindergarten. Your child’s information will be transferred outside of the EEA to (Third Land) USA. In regard to the GDPR privacy regulation, HighScope COR Advantage certifies that they meet the high data protection standard set out by the GDPR privacy Regulation and has appropriate security and encryption measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way. Our Accounts are password protected and only accessed by class teachers, and authorised personal and your child’s profile is deleted when you leave the school. We keep a pdf copy of your child’s observational report for one year after you leave the school on our I.T. system.
Withdrawal of Consent
Under the GDPR, data subjects can withdraw their consent at any time. If this happens, we will cease the processing of that subject’s data as soon as possible, unless there is a lawful basis to continue to process the data. If an individual withdraws their consent, this does not affect the processing of any data for which you have given consent previously. Parents/guardians should contact ABC to inform them if circumstances have changed and they no longer wish their child’s data/image to be taken, used or retained. You will be asked to fill in and sign a withdrawal form please email. email@example.com
In the event of a personal data breach, an investigation will be carried out and you will be notified as to what information has been breached.
Subject Access Request (SAR)
The General Data Protection Regulation entitles an individual the right to request the personal information a preschool holds on their behalf – this is known as a Subject Access Request (SAR) and includes all and any information held by ABC not just that information held on central files or electronically, so it could also include correspondence or notes held by others in the pre-school. •SARs must be responded to within 40 days of receipt.
•The SAR should be made in writing by the individual making the request.
•ABC can refuse requests that are manifestly unfounded or excessive.
•Parents can make SARs on behalf of their children if the children are
deemed to be too young or they have consented to their parents doing
so on their behalf.
Complaints If you believe we treat your personal information in violation
You can also contact the Data Inspectorate directly and submit your complaint.
Our Company Information Abc All About Children Ab
Tredje Långgatan 33,
Organisation number 556646-7691
Tel no Judy Vanstone +46 709 58 01 60