Who we are
The Nursery Milk Scheme is operated by the Nursery Milk Reimbursement Unit (NMRU) on
behalf of the Department of Health and Social Care. The NMRU is administered by Wider
Plan Ltd which is committed to protecting your privacy and the security of your
Registered office: Wider Plan Ltd, 11-16 Chestnut Court, Jill Lane, Sambourne, B96 6EW
Company registration number: 5207145 (England & Wales)
Definitions and interpretation
2.1 The following terms are defined:
a) “You” and “your” mean the person who is using the the Nursery Milk Scheme.
b) “We”, “us” and “our” mean the NMRU, which administers the the Nursery Milk Scheme.
c) “Setting” means a registered childcare provider.
d) “Service” means the The Nursery Milk Scheme online claims system.
e) The “website” means the website at www.nurserymilk.co.uk unless otherwise stated.
f) “Data Controller” means the party who determines the purpose and means of processing
personal data, as per prevailing data protection legislation.
g) “Data Processor” means the party who is responsible for processing personal data on
behalf of a controller.
2.2 The headings to clauses are for convenience only and shall not affect the construction
or interpretation of these terms.
2.3 Unless otherwise stated,
a) The singular includes the plural and vice versa;
b) The words “includes” and “including”, and variations thereof, are each without
Our commitment to data protection
information we collect about you when you use the Nursery Milk Scheme.
The Nursery Milk Scheme is not publicly available but can be accessed by eligible settings,
milk agents and local authorities. The setting, milk agent or local authority must register
with the NMRU to gain access to the service.
The Department of Health and Social Care is the Data Controller for the Nursery Milk Scheme.
Wider Plan acts as a Data Processor for the Department of Health and Social Care in
administering the NMRU.
How we collect information about you
If you are a setting:
We will collect your contact details and details relevant to your setting such as attendance
numbers. We will collect your setting’s bank details if you wish to make a claim for
reimbursement, or your milk agent or local authority’s details if they supply milk to your
setting and are receiving reimbursement direct.
If you are a milk agent or local authority:
We will collect your contact details, details relevant to your milk agency or local authority,
bank details and milk supply details.
In all cases:
We may also collect any personal information which you provide to us voluntarily, for example
by contacting us by email or phone.
Website usage information may be collected using cookies as detailed below.
You may decline to share certain items of personal data with us, in which case we may not be
able to provide you with some or all features of the service.
How we use the information about you
We will use only use the information we have collected about you where we have a legal basis for
In all cases:
We will process your data in accordance with instructions from the Department of Health and
Social Care in meeting its public task of operating the Nursery Milk Scheme in compliance
with the underlying legislation.
We will also process your data where the Department of Health and Social Care has a
legitimate interest in instructing us to do so, for example to monitor and improve our
services, to investigate an actual or potential breach of the Nursery Milk Scheme terms and
conditions, to facilitate continuity of our services and to protect our rights and property
or those of other parties.
We will process your data where we have a legal obligation to do so, for example in respect
of a fraud investigation or a request from HMRC.
How we share your personal information
If you are setting with an appointed milk agent or local authority:
We will share your contact details and relevant information about your childcare setting in
the relevant milk agent’s or local authority’s online account.
In all cases:
We will share all your information with the Department of Health and Social Care. We will
share information with NHS Business Services Authority as necessary to ensure the Nursery
Milk Scheme is administered in accordance with legislation.
We will not share any of your personal information with any other third parties without your
a) We suspect any form of illegal behaviour.
b) It is necessary by law, regulation or legal proceedings.
c) It is required to enforce our Terms and Conditions.
d) We consider it necessary action to protect the property, rights or safety of the NMRU
or any other party.
e) The third party is acting in a professional capacity, for example as a regulator,
auditor or appointed data processor and has suitable confidentiality and privacy measures
Marketing and communications
We will not pass your contact details to third parties except as detailed above.
If you are a user of the Nursery Milk Scheme:
We will contact you with information relating to your use of the service. This may include,
for example, notifying you of your claim status, alerting you to relevant enhancements to
the service and advising you if you need to take any action.
Your data protection rights
You can make a request in respect of your data protection rights through any of our usual
You have the right to request a copy of any information which we hold about you. This is
called a subject access request.
You have the right to have your data rectified in the event it is incorrect or incomplete.
Please do contact us in the event of any of your information being inaccurate, as we are
committed to maintaining the high quality of our data.
You have a limited right to ask us to restrict processing of your personal data in certain
circumstances. We will consider the reasonableness of each request along with the Department
of Health where applicable and will respond accordingly. Your access to the service will be
suspended in the event of us agreeing to such a request.
You have the right to request erasure of your personal data. This is also known as the
‘right to be forgotten’. We will anonymise or delete your data in response to this request
unless there is an overriding reason for not doing so.
Copies of your data may also be retained to satisfy legal, regulatory and accounting
requirements. We routinely take backups of data for business continuity purposes. The
backups would only be accessed for routine tests or in the event of a failure of our live
database. In the event of using this data any previous requests for anonymisation or deletion
will be upheld. We will retain a record of requests in order to facilitate this.
You have the right to object to the way in which we are processing your personal data. If you
wish to object, you must provide specify which processing you object to, including a reason
for your objection.
file that is sent to your browser from a web server and then stored on your hard drive. Cookies
enable us to recognise your computer and record information from your visits to the site, such
as your preferred settings. This saves you having to re-enter the same data each time you use
the site and allows us to provide you with a more customised experience.
purposes and to compile statistical reports on website activity.
Most internet browsers accept cookies by default; however, you can usually change your browser
settings to reject cookies. If you choose not to receive our cookies you will not be able to
receive any personalised features and you may not be able to benefit from all our services.
Using other websites
Our website may contain links to websites which are owned or controlled by parties other than
the NMRU. These links are provided for your convenience and do not imply that we have reviewed
or approved the third-party sites or their policies.
When you access the linked third party websites, you do so at your own risk. You should check
any of your personal details.
Our commitment to data security
We take data protection seriously and we have implemented technical, physical and administrative
security measures to protect your information against unauthorised access, loss, misuse or
If you use a shared computer to access the Nursery Milk Scheme website, we recommend that you
always sign out when you have finished.
While we work very hard to protect your privacy, online data transmission can never be entirely
secure. Therefore, we cannot guarantee that your personal information will always remain private.
If we become aware that there has been a security breach and that your personal data may have
been compromised, we will take appropriate steps to rectify the breach and we will contact you
as soon as reasonably practical.
Data retention policy
We will retain your personal information for six full tax years following your final claim on
the Nursery Milk Scheme website. We will then delete your personal data within one month.
Location of data processing
Nursery Milk Scheme databases are held at data centres within the UK or EEA.
Routine cloud-based business services, for example communication by email, may involve Nursery
Milk Scheme data being saved on or passing through servers outside the UK or EEA. We will only
use third parties which have contractually committed to adhere to the data location safeguards
required under GDPR.
convenience to ensure that you are aware of any updates. We will bring any substantial changes
to your attention by email.
Your continued use of the service will constitute your acceptance of any changes.
Please contact us if you have any questions. We hope that we will be able to resolve any queries
or complaints to your satisfaction.
You also have the right to make a complaint about the processing of your personal data to your
local Data Protection Authority.