Say hello to Tapestry;
the innovative, interactive online learning journal
It's easy to create exciting
online journals featuring digital photos, videos and text
Discover simple ways to record, share and track learning
Discover new ways to capture the fun at
Upload and share precious moments with
parents in real time
See what other teachers and parents say about
Introducing new & improved assessment tools for primary schools
Introducing the Montessori Curriculum
on Tapestry
The Tapestry Care Diary is now available
Tapestry is GDPR ready

Tapestry, You, and the GDPR: what you need to know

Data protection law has changed

You’ve no doubt heard that, on May 25th, the Europe-wide data protection regulation, known as the ‘GDPR’, came into effect.

The new law:

  1. Enhances the rights of people in the EU regarding their personal data.
  2. Places more stringent rules on those who process it.
  3. Covers paper based, as well as digital, records.

We strongly support the new law.

Tapestry GDPR-compliant

The good news is that we have always taken the privacy and security of data very seriously, so we have not had to change much about how we work.

But the new law does require data processing contracts to contain particular words. So, if you have not done so already, please take a look at our new contract. This goes into detail about how we work and how we keep data secure and private. It should answer many of the questions you might have.

Our customers have duties under the GDPR

The customers who pay for us (schools, nurseries, child-minders, educators and similar educational organisations) are data controllers for the data they add to Tapestry. We are their data processors.

The good news is that this means that, even if we wanted to, we can't do anything with the data on Tapestry without an instruction from our customer. The data is private.

But it does mean that some duties fall upon our customers, and some fall upon us. We need to work together to be GDPR compliant overall.

If you are a child-minder, or run a school or nursery, and haven't already, we strongly urge you to learn about your responsibilities as data controller. A good starting point is the Information Commissioner’s Office. We've also assembled some resources on the FSF forum.

Tapestry's privacy policy

One of our customer's duties is to write a privacy policy. This is because only they know what they are storing, why they are storing it, and how long they are storing it for. We have to provide them with the information they need about our systems in order to write that policy.

If you are one of our customers, the Information Commissioner's Office explains what needs to be included. A privacy policy might need to cover all the data stored on relatives and children in all the systems you use, not just Tapestry. That includes written records, billing systems, management systems, communication systems and other progress tracking systems.

The information you need from us to write a privacy policy is in our new contract, particulary 'Annex C: Tapestry Privacy'.

If you are someone whose data is stored in Tapestry and just want a few key facts. They are:

  • Our customers (schools, nurseries, child-minders etc) choose what data to store, who to store it about, what is done with it, and when it is deleted. We do not.
  • We ONLY access the data stored by our customers in order to carry out our customer’s instructions, to maintain or improve the service or to fix faults. That means that, even if we wanted to, we cannot use our customer’s data for marketing.
  • It also means we don't share data, unless a customer instructs us to (e.g., to transfer a child's data to a new school). We do use sub-contractors to process some of the data (you can see a list in our contract, 'Annex D: Tapestry Sub-processors') but we are responsible for their actions and have placed restrictions on what they can do.

Useful links

Contacting us

If you are someone whose data is stored on Tapestry and have a question that relates specifically to that data, please contact the person or organisation who added the data (the school, nursery, child-minder etc). If they need help in answering your question, they can forward it on to us. We have to do it this way because we, as a data processor, have to make sure that any instructions we get are authorised by our customers.

For any other questions you can reach us at:

The Foundation Stage Forum Ltd
1, Southdown Avenue
East Sussex

Tapestry Online Journal

Features Pricing & Plans About Resources Privacy Policy Status Jobs The Foundation Stage Forum Ltd, 1, Southdown Avenue, Lewes, East Sussex, BN7 1EL