Summary of the Policy
The Privacy Notice relates to the Nursery Milk Scheme, and the Nursery Milk
The Nursery Milk Scheme is a statutory scheme operated by the Department of Health
Social Care (DHSC). The legislation governing the Nursery Milk Scheme allows
settings registered with OFSTED or the Care Inspectorate Wales, such as
nurseries and schools, to reclaim the cost of providing one-third of a pint of milk
the equivalent in infant formula) to children under the age of five who attend the
setting for at least two hours per day.
DHSC operates the Nursery Milk Scheme on a day-to-day basis using a private
While the private contractor operating the scheme may change from time to time
procurement exercises, the service is always carried out under the name "The Nursery
Milk Reimbursement Unit" (NMRU).
Definitions and interpretation
2.1 The following terms are defined:
a) “You” and “your” mean the person who is using the the Nursery Milk
b) “We”, “us” and “our” mean the NMRU, which administers the the Nursery
c) “Setting” means a registered childcare provider.
d) “Service” means the The Nursery Milk Scheme online claims system.
e) The “website” means the website at www.nurserymilk.co.uk unless
f) “Data Controller” means the party who determines the purpose and
means of processing
personal data, as per prevailing data protection legislation.
The Data Controller for the Nursery Milk Scheme is DHSC.
g) “Data Processor” means the party who is responsible for processing
personal data on
behalf of a controller. The Data Processor for the Nursery Milk Scheme
Wider Plan Ltd, 11 - 16 Chestnut Court, Jill Lane, Sambourne, B96 6EW,
who currently hold the contract to run the Nursery Milk Reimbursement
2.2 The headings of the paragraphs below are for convenience only and shall not
affect the construction or interpretation of these terms.
2.3 Unless otherwise stated,
a) The singular includes the plural and vice versa;
b) The words “includes” and “including”, and variations thereof, are
How information is collected
We will collect your contact details and details relevant to your setting such as
attendance numbers. We will collect your setting’s bank details if you wish to make
a claim for reimbursement, or your milk agent or local authority’s details if they
supply milk to your setting and are receiving reimbursement direct.
Details of the milk supplier, where childcare settings have decided to use a milk
Milk agents and local authorities:
We will collect your contact details, details relevant to your milk agency or local
authority, bank details and milk supply details.
In all cases:
Redacted attendance records from childcare settings and milk agents, which are
sometimes requested for audit purposes;
Proof of milk purchase in the form of invoices and receipts;
We may also collect any personal information which you provide to us voluntarily,
example by contacting us by email or phone.
Website usage information may be collected using cookies.
You may decline to share certain items of personal data with us, in which case we
not be able to provide you with some or all features of the service.
If additional information is needed, for example for audit purposes, or a fraud
investigation, or following a request from HMRC, then this will usually be collected
in electronic form by email, or in paper form through the post.
How the data is used
We will use only use the information we have collected about you where we have a
legal basis for doing so, and this is covered in the section below.
The data which is collected is needed to ensure that childcare settings who wish to
register and claim are eligible to claim from the nursery milk scheme. It is also
needed so that claims can be checked to ensure that eligible childcare settings are
claiming in accordance with the Nursery Milk Scheme legislation, and therefore that
public money is being spent on its intended purpose.
Legal basis for processing personal data
The legal basis for processing under data protection law is UK GDPR Article 6.1(c):
processing is necessary for compliance with a legal obligation to which the
controller is subject.
DHSC has a legal obligation to operate the Nursery Milk Scheme as set out in the
Welfare Foods Regulations 1996. These Regulations set out the eligibility for the
scheme, and the details which may be requested in order to verify claims. This is
the information which is collected, as set out above.
Data Processor and other recipients of personal data
If you are setting with an appointed milk agent or local authority, the Data
Processor will share your contact details and relevant information about your
childcare setting in the relevant milk agent’s or local authority’s online account.
In all cases, the Data Processor will share all your information with the Data
Controller. Information may also be shared with the NHS Business Services Authority
as necessary to ensure the Nursery Milk Scheme is administered in accordance with
We will not share any of your personal information with any other third parties
without your permission, unless:
a) We suspect any form of illegal behaviour.
b) It is necessary by law, regulation or legal proceedings.
c) It is required to enforce our Terms and Conditions.
d) We consider it necessary action to protect the property, rights or safety of
the NMRU or any other party.
e) The third party is acting in a professional capacity, for example as a
regulator, auditor or appointed data processor and has suitable confidentiality
and privacy measures in place.
Marketing and communications
We will not pass your contact details to third parties except as detailed above.
If you are a user of the Nursery Milk Scheme:
We will contact you with information relating to your use of the service. This may
include, for example, notifying you of your claim status, alerting you to relevant
enhancements to the service and advising you if you need to take any action
International data transfers and storage locations
Nursery Milk Scheme databases are held at data centres within the UK or EEA.
Routine cloud-based business services, for example communication by email, may
involve Nursery Milk Scheme data being saved on or passing through servers outside
the UK or EEA. We will only use third parties which have contractually committed to
adhere to the data location safeguards required under GDPR.
Retention and disposal policy
Nursery Milk Scheme data is retained for six tax years after which it is destroyed
securely within one month.
How we keep your data secure
Both the Data Controller and the Data Processor have implemented security measures
to o protect the information collected against unauthorised access, loss, misuse or
If you use a shared computer to access the Nursery Milk Scheme website, we recommend
that you always sign out when you have finished.
If we become aware that there has been a security breach and that your personal data
may have been compromised, we will take appropriate steps to rectify the breach and
we will contact you as soon as reasonably practical.
Your rights as a data subject
By law, data subjects have a number of rights and this processing does not take away
or reduce these rights under UK GDPR and the UK Data Protection Act 2018 applies.
These rights are:
The right to get copies of information – individuals have the right to ask
for a copy of any information about them that is used.
The right to get information corrected – individuals have the right to ask
for any information held about them that they think is inaccurate, to be
The right to limit how the information is used – individuals have the right
to ask for any of the information held about them to be restricted, for example,
if they think inaccurate information is being used.
The right to object to the information being used – individuals can ask for
any information held about them to not be used. However, this is not an absolute
right, and continued use of the information may be necessary, with individuals
being advised if this is the case.
The right to get information deleted – this is not an absolute right, and
continued use of the information may be necessary, with individuals being
advised if this is the case.
Comments and complaints
Anyone unhappy or wishing to complain about how personal data is used as part of
this programme, should contact firstname.lastname@example.org in the first instance or
Data Protection Officer
1st Floor North
39 Victoria Street
Anyone who is still not satisfied can complain to the Information Commissioners
Office. Their website address is www.ico.org.uk and their postal address is:
Information Commissioner's Office
Automated decision making or profiling
No decision will be made about individuals solely based on automated decision making
(where a decision is taken about them using an electronic system without human
involvement) which has a significant impact on them.
Changes to this policy
This privacy notice is kept under regular review, and new versions will be available
on our privacy notice page on our website. This privacy notice was last updated
on 30th September 2021