Attendance Policy

Brikshya Bal Batika – Data Protection & Privacy Policy

  1. Introduction
    Brikshya Bal Batika (hereafter “the Preschool”) collects and processes personal data for a range of purposes related to its staff, contractors, parents/guardians, children, website users and others who interact with the Preschool. In doing so, the Preschool is committed to protecting the rights of individuals to privacy and data protection.

  2. Why This Policy Exists
    This Data Protection & Privacy Policy sets out the rules that all personal data collected, processed, stored, shared or disposed of on behalf of the Preschool must comply with. We aim to:

  • comply with applicable data protection legislation;

  • protect the rights and privacy of all individuals whose data we hold;

  • reduce the risk of data breaches;

  • ensure a clear and consistent approach to data collection, storage and handling.

  1. Scope
    This policy applies to all settings, operations, staff, volunteers, contractors and any other service providers working with the Preschool. It covers all personal data (including digital, paper and other formats) relating to identifiable individuals.

  2. Policy Statement
    Brikshya Bal Batika will:

  • be lawful, fair and transparent in how it processes personal data;

  • collect personal data only for specified, explicit and legitimate purposes;

  • ensure data is accurate, kept up-to-date and retained only as long as necessary;

  • process personal data in a way that ensures appropriate security, protecting against unauthorised or unlawful processing, accidental loss, destruction or damage.

  1. Roles & Responsibilities
    All staff, volunteers and contractors at the Preschool have a responsibility to handle personal data appropriately. A designated person (e.g., the Data Protection Lead) is responsible for overseeing implementation of this policy, ensuring resources are provided, staff are trained, data breaches are managed and data subject requests are handled in a timely manner.

  2. Collecting & Processing Personal Data
    The Preschool will only collect and process personal data where a lawful basis applies (for example: consent, contract, legal obligation, vital interests, legitimate interests). For parents/guardians and children, data may be collected as part of the enrolment/contract process (e.g., name, date of birth, contact details, medical information, dietary requirements, special educational needs). The Preschool will inform data subjects whether the provision of specific data is mandatory or voluntary.

  3. Data Security, Retention & Disposal
    The Preschool is committed to ensuring personal data is not held longer than necessary. Data will be stored securely (whether paper or electronic) and access restricted to those who need it. Electronic records will be protected via passwords, encryption, access controls, backups and antivirus measures where appropriate. Paper records will be stored in locked locations when not in use, and shredded or otherwise securely destroyed at end-of-life. Hardware reaching end-of-life will be wiped of personal data and destroyed as required.

  4. Data Sharing & Third Parties
    The Preschool may need to share personal data with third-party organisations (for example, statutory authorities, health services, partner schools) where required by law or contract, or where you have given explicit consent. Wherever third parties process data on our behalf, the Preschool will ensure they have appropriate safeguards and contractual obligations in place. Internally, data sharing will be limited to those with a legitimate need to know and secure means of transfer will be used.

  5. Use of Photographs & Social Media
    Photographs of children may be used by the Preschool for internal records, displays, social media or promotional materials only with prior consent from parents/guardians. Parents/guardians may withdraw consent at any time. The Preschool cannot be responsible for social media groups or forums set up by parents or external parties beyond our control.

  6. Data Subject Rights
    Individuals whose data is held have the right to:

  • request access to the personal data we hold about them or their child (“Subject Access Request”);

  • request rectification of inaccurate or incomplete data;

  • request erasure (“right to be forgotten”) where appropriate and lawful;

  • object to processing where lawful bases apply (e.g., direct marketing);

  • restrict processing in certain circumstances.
    Requests should be made in writing to the Preschool’s designated Data Protection Lead. The Preschool will respond within a reasonable timeframe (in line with applicable law).

  1. Data Breach Reporting & Monitoring
    All staff must report any suspected or actual data breach to the designated lead as soon as possible. The Preschool will maintain a log of data breaches, investigate incidents, and where required by law or regulation, notify relevant supervisory authorities and affected individuals.

  2. Complaints
    If you are unhappy with how the Preschool has handled your personal data or a request under your rights, you should raise the matter in writing to the Preschool’s Data Protection Lead. If you remain dissatisfied, you may raise your concerns with the relevant data protection regulatory body in Nepal.

  3. Training & Awareness
    The Preschool will provide appropriate training and awareness for all staff, volunteers and contractors to ensure they understand their responsibilities under this policy and applicable data protection laws. New staff will receive induction training and periodic refresher training will be provided.

Contact Details
If you have any questions or requests relating to this privacy policy or personal data held by Brikshya Bal Batika, please feel free to contact us.

Last reviewed: [1 Jan, 2025]