Privacy & Cookies Notice

Last updated: 29 September 2026

This notice explains how Tiny Steps Nursery looks after your family's personal information across our two Manchester nurseries — Longsight and Gorton — and how we use cookies on this website. Please read it alongside the information given to you when your child registers.

1. Who we are

Each Tiny Steps nursery is run by a separate limited company, and each is the "data controller" for the families at that setting:

2. The information we collect

• About your child: name, date of birth, address, photographs, development records and observations, attendance, and any additional or special educational needs (SEND).
• About parents/carers: names, contact details, National Insurance number (for funded-hours claims), emergency contacts, and eligibility information for funded places and benefits (e.g. EYPP, DAF).
• Health & dietary: allergies, medical conditions, dietary and cultural requirements, and consents for medication and emergency treatment.
• Religion and ethnic origin: collected on the registration form for the local-authority census only. These fields are optional — you may leave them blank.
• Website enquiries: the details you send us through our enquiry, tour and registration forms.

3. Why we use it, and our lawful bases

We use your information to care for your child, meet our legal duties, and run the nursery. Our lawful bases under UK GDPR are:

• Legal obligation — to meet the Early Years Foundation Stage (EYFS) framework, safeguarding law, and health & safety duties.
• Public task — to claim and administer funded early-education hours with Manchester City Council.
• Contract — to provide the childcare place you have arranged with us and to take payment where applicable.
• Consent — for optional things such as photographs, the optional online learning journal, and marketing cookies. You can withdraw consent at any time.

4. Special category data

Some information is treated as "special category" data and given extra protection — your child's health and dietary needs, and (where you choose to give them) religion and ethnic origin. We collect health information because we need it to keep your child safe, and religion/ethnic origin only for the local-authority census. Our additional condition for processing this is that it is necessary for reasons of substantial public interest (safeguarding children) and, for the census fields, your explicit consent. Providing the census fields is optional.

5. Children's data

Most of the information we hold is about children. We treat it with particular care, limit access to staff who need it to care for your child, and never use it for marketing. Parents and carers exercise data rights on behalf of their children.

6. Cookies & this website

This website uses a small number of essential items (for example, to remember your cookie choice) that are needed for it to work. With your consent we also use:

• Google Analytics — to understand how the site is used so we can improve it.
• The Meta (Facebook) Pixel — to measure our advertising.

These are only set if you choose "Accept all" in the cookie banner. If you choose "Essential only", they are not set. You can change your mind at any time by clearing your browser's site data and reloading the page. Our embedded location map loads from Google Maps only when you tap to load it.

7. Job applicants & staff

If you apply to work with us, we collect the details on your application, references, and — because roles involve working with children — information about criminal convictions and an enhanced DBS check. These roles are exempt from the Rehabilitation of Offenders Act 1974, so we may ask about spent as well as unspent convictions. We rely on legal obligation and safeguarding (substantial public interest) as our bases. Application information for unsuccessful candidates is kept for 6 months and then securely destroyed; staff records are kept in line with our retention policy.

8. Who we share it with

We only share information where we need to, including with: Ofsted; Manchester City Council (for funded hours and safeguarding); health and education professionals involved in your child's care; our online learning-journal provider (Tapestry) where you have consented; and, in an emergency, medical services. We do not sell your data.

9. How long we keep it

We keep children's records for as long as required by the EYFS and safeguarding guidance (generally until the child's 25th birthday, and longer where safeguarding requires). Funding and financial records are kept for at least 6 years. Enquiry details are kept only as long as needed to respond.

10. Your rights

Under UK GDPR you have the right to: be informed; access your data; have it corrected; have it erased (where it is not needed for a legal duty); restrict or object to processing; data portability; and to withdraw consent where we relied on it. To exercise any of these, contact the nursery using the details in section 1.

11. Complaints & the ICO

Please raise any concern with us first — we will always try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint · 0303 123 1113. Our ICO registration numbers are listed for each company in section 1.

12. Contact us

For anything about this notice or your data, email longsight@tinystepsnursery.co.uk (Longsight) or gorton@tinystepsnursery.co.uk (Gorton), or call 0161 248 7300 (Longsight) / 0161 317 0174 (Gorton).