Privacy Policy

Aflah Nursery Oxford
Last updated: 22 September 2026

This Privacy Policy explains how Aflah Nursery collects, uses, stores and shares personal information when you visit aflahnurseryoxford.com, contact us, register your interest, apply for a nursery place, attend an event or use our childcare services.

1. Who We Are

Aflah & Co Ltd, trading as Aflah Nursery, is the data controller responsible for the personal information described in this policy.

Our contact details are:

Aflah Nursery
Regal Community Centre
Ridgefield Road
Oxford
OX4 3BY

Email: aflahnurseryox@gmail.com
Telephone: 07814 159288
Website: aflahnurseryoxford.com

Please use the email address above for privacy questions or requests and mark your message for the attention of the Nursery Director.

2. The information we collect

Depending on how you interact with us, we may collect:

Your name, address, email address and telephone number.
Your relationship to a child.
A child’s name, address, date of birth, expected start date and attendance information.
Information provided through our website forms, emails, telephone calls, nursery visits, Stay and Play registrations, waiting-list forms and admission forms.
Emergency contact details and information about people authorised to collect a child.
Health, allergy, dietary, disability, special educational needs and development information where required to keep a child safe and support their care.
Religious or cultural information where this is relevant to a child’s care or the family’s preferences.
Funding, eligibility, payment, invoice and transaction information.
Safeguarding, accident, incident, medication and welfare information.
Photographs, videos and learning observations where we have a lawful reason and any required permission.
Correspondence, complaints, feedback and records of your dealings with us.
Technical information when you use our website, such as your IP address, browser, device, pages visited, cookie choices and approximate location derived from your IP address.

We normally collect information directly from parents or carers. We may also receive information from local authorities, previous settings, schools, health professionals, safeguarding agencies or other people involved in a child’s care where it is lawful and appropriate.

3. How we use personal information

We may use personal information to:

Respond to enquiries and arrange nursery visits.
Manage our waiting list and admission process.
Arrange settling-in sessions and childcare arrangements.
Provide safe, suitable and inclusive early years care and education.
Support children’s learning, development, health and wellbeing.
Administer funded places, nursery fees, invoices and accounts.
Contact parents, carers and emergency contacts.
Maintain children’s learning and development records.
Meet our safeguarding and welfare responsibilities.
Meet Early Years Foundation Stage, Ofsted, funding, tax and other legal or regulatory requirements.
Manage complaints, incidents, insurance matters and legal claims.
Operate, protect and improve our website and nursery services.
Send nursery news or marketing where you have asked to receive it or where the law otherwise permits us to do so.

4. Our lawful bases

Under UK data protection law, we must have a lawful reason for using personal information. Depending on the circumstances, we rely on the following lawful bases:

Contract: Where using the information is necessary to take steps before offering a nursery place or to provide childcare under an agreement with you.

Legal obligation: Where we must use or retain information to comply with safeguarding, welfare, record-keeping, Ofsted, funding, tax or other legal requirements.

Legitimate interests: Where using information is reasonably necessary to operate and protect the nursery, manage enquiries and waiting lists, maintain records, improve our services or establish and defend legal claims. We will consider whether your rights override our interests before relying on this basis.

Consent: Where we provide you with a genuine choice, such as for certain photographs, marketing communications or non-essential website cookies. You may withdraw your consent at any time. Withdrawing consent will not affect information used lawfully before consent was withdrawn.

Vital interests: Where using information is necessary to protect someone’s life in an emergency.

Some information about health, disability, religion or safeguarding is classed as special category information. Where we use this information, we will also rely on an appropriate additional legal condition, such as explicit consent, safeguarding, health or social care, substantial public interest or the establishment or defence of legal claims.

5. Children’s personal information

Children’s personal information requires particular protection. We only collect and use information about children where it is necessary to provide care, support their development, keep them safe or meet our legal and regulatory responsibilities.

We will consider the best interests of the child when making decisions about how their information is used or shared.

We do not sell children’s personal information or use it for commercial advertising.

6. Who we may share information with

Where it is relevant, necessary and lawful, we may share personal information with:

Oxfordshire County Council and other local authorities, including for early education funding and support.
Ofsted and other regulators.
Schools, other early years settings and education providers.
Health professionals and special educational needs support services.
Children’s social care, the Local Authority Designated Officer, the police and other safeguarding organisations.
Our insurers, accountants, payroll providers, payment providers and legal advisers.
Trusted providers that support our website, email, childcare records, communications and IT systems.
Another organisation if the nursery or business is transferred, subject to suitable confidentiality and legal safeguards.

We only share information that is relevant and necessary. We may share information without consent where the law requires or permits us to do so, including where this is necessary to safeguard a child or protect someone from harm.

7. Our website and third-party services

Our website may use third-party services for hosting, enquiry forms, maps, security, embedded content and website analytics.

These providers may receive technical information when you use the relevant website feature. They are only permitted to use information in accordance with their own legal responsibilities and any agreements we have with them.

Our website may contain links to other websites. If you follow an external link, the privacy policy of that website will apply. We are not responsible for the privacy practices or content of third-party websites.