1. Summary of the Policy

   The Privacy Notice relates to the Nursery Milk Scheme, and the Nursery Milk Reimbursement Unit.

   The Nursery Milk Scheme is a statutory scheme operated by the Department of Health and Social Care (DHSC). The legislation governing the Nursery Milk Scheme allows childcare settings registered with OFSTED or the Care Inspectorate Wales, such as childminders, nurseries and schools, to reclaim the cost of providing one-third of a pint of milk (or the equivalent in infant formula) to children under the age of five who attend the setting for at least two hours per day.

   DHSC operates the Nursery Milk Scheme on a day-to-day basis using a private contractor. While the private contractor operating the scheme may change from time to time following procurement exercises, the service is always carried out under the name "The Nursery Milk Reimbursement Unit" (NMRU).

2. Definitions and interpretation

   • 2.1 The following terms are defined:

     • a) “You” and “your” mean the person who is using the the Nursery Milk Scheme.
     • b) “We”, “us” and “our” mean the NMRU, which administers the the Nursery Milk Scheme.
     • c) “Setting” means a registered childcare provider.
     • d) “Service” means the The Nursery Milk Scheme online claims system.
     • e) The “website” means the website at www.nurserymilk.co.uk unless otherwise stated.
     • f) “Data Controller” means the party who determines the purpose and means of processing personal data, as per prevailing data protection legislation. The Data Controller for the Nursery Milk Scheme is DHSC.
     • g) “Data Processor” means the party who is responsible for processing personal data on behalf of a controller. The Data Processor for the Nursery Milk Scheme is Wider Plan Ltd, 11 - 16 Chestnut Court, Jill Lane, Sambourne, B96 6EW, who currently hold the contract to run the Nursery Milk Reimbursement Unit.

   • The headings of the paragraphs below are for convenience only and shall not affect the construction or interpretation of these terms.

   • 2.3 Unless otherwise stated,

     • a) The singular includes the plural and vice versa;
     • b) The words “includes” and “including”, and variations thereof, are each without limitation.

3. How information is collected

   Childcare settings:

   We will collect your contact details and details relevant to your setting such as attendance numbers. We will collect your setting’s bank details if you wish to make a claim for reimbursement, or your milk agent or local authority’s details if they supply milk to your setting and are receiving reimbursement direct.

   Details of the milk supplier, where childcare settings have decided to use a milk agent;

   Milk agents and local authorities:

   We will collect your contact details, details relevant to your milk agency or local authority, bank details and milk supply details.

   In all cases:

   Redacted attendance records from childcare settings and milk agents, which are sometimes requested for audit purposes;

   Proof of milk purchase in the form of invoices and receipts;

   We may also collect any personal information which you provide to us voluntarily, for example by contacting us by email or phone.

   Website usage information may be collected using cookies.

   You may decline to share certain items of personal data with us, in which case we may not be able to provide you with some or all features of the service.

   If additional information is needed, for example for audit purposes, or a fraud investigation, or following a request from HMRC, then this will usually be collected in electronic form by email, or in paper form through the post.

4. How the data is used

   We will use only use the information we have collected about you where we have a legal basis for doing so, and this is covered in the section below.

   The data which is collected is needed to ensure that childcare settings who wish to register and claim are eligible to claim from the nursery milk scheme. It is also needed so that claims can be checked to ensure that eligible childcare settings are claiming in accordance with the Nursery Milk Scheme legislation, and therefore that public money is being spent on its intended purpose.

5. Legal basis for processing personal data

   The legal basis for processing under data protection law is UK GDPR Article 6.1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.

   DHSC has a legal obligation to operate the Nursery Milk Scheme as set out in the Welfare Foods Regulations 1996. These Regulations set out the eligibility for the scheme, and the details which may be requested in order to verify claims. This is the information which is collected, as set out above.

6. Data Processor and other recipients of personal data

   If you are setting with an appointed milk agent or local authority, the Data Processor will share your contact details and relevant information about your childcare setting in the relevant milk agent’s or local authority’s online account.

   In all cases, the Data Processor will share all your information with the Data Controller. Information may also be shared with the NHS Business Services Authority as necessary to ensure the Nursery Milk Scheme is administered in accordance with legislation.

   We will not share any of your personal information with any other third parties without your permission, unless:

   • a) We suspect any form of illegal behaviour.
   • b) It is necessary by law, regulation or legal proceedings.
   • c) It is required to enforce our Terms and Conditions.
   • d) We consider it necessary action to protect the property, rights or safety of the NMRU or any other party.
   • e) The third party is acting in a professional capacity, for example as a regulator, auditor or appointed data processor and has suitable confidentiality and privacy measures in place.

7. Marketing and communications

   We will not pass your contact details to third parties except as detailed above.

   If you are a user of the Nursery Milk Scheme:

   We will contact you with information relating to your use of the service. This may include, for example, notifying you of your claim status, alerting you to relevant enhancements to the service and advising you if you need to take any action

8. International data transfers and storage locations

   Nursery Milk Scheme databases are held at data centres within the UK or EEA.

   Routine cloud-based business services, for example communication by email, may involve Nursery Milk Scheme data being saved on or passing through servers outside the UK or EEA. We will only use third parties which have contractually committed to adhere to the data location safeguards required under GDPR.

9. Retention and disposal policy

   Nursery Milk Scheme data is retained for six tax years after which it is destroyed securely within one month.

10. How we keep your data secure

    Both the Data Controller and the Data Processor have implemented security measures to o protect the information collected against unauthorised access, loss, misuse or destruction.

    If you use a shared computer to access the Nursery Milk Scheme website, we recommend that you always sign out when you have finished.

    If we become aware that there has been a security breach and that your personal data may have been compromised, we will take appropriate steps to rectify the breach and we will contact you as soon as reasonably practical.

11. Your rights as a data subject

    By law, data subjects have a number of rights and this processing does not take away or reduce these rights under UK GDPR and the UK Data Protection Act 2018 applies.

    These rights are:

    1. The right to get copies of information – individuals have the right to ask for a copy of any information about them that is used.
    2. The right to get information corrected – individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected
    3. The right to limit how the information is used – individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.
    4. The right to object to the information being used – individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
    5. The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

12. Comments and complaints

    Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact data_protection@dhsc.gov.uk in the first instance or write to:

    Data Protection Officer
    1st Floor North
    39 Victoria Street
    London
    SW1H 0EU

    Anyone who is still not satisfied can complain to the Information Commissioners Office. Their website address is www.ico.org.uk and their postal address is:

    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF

13. Automated decision making or profiling

    No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

14. Changes to this policy

    This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 30th September 2021

We welcome all feedback on matters relating to privacy or to any other aspect of our service. You can provide feedback by contacting us.