Ben Case explains Tapestry’s approach to your online data, as well as some key questions to consider

Ben Case, from our product support and education teams, takes a closer look at how Tapestry takes care of your online data, and shares some important questions to make sure you are confident about how your data is looked after.

Do you know what you’re signing up for?

Since Tapestry began in 2012, the market for online journals has grown considerably. Starting out as a way to build links between settings and families, Tapestry now offers in-depth monitoring of children’s development, ways to share messages with relatives through observations, memos, or the comments tool included in the Care Diary, set activities for the children to complete by logging in themselves, and even create bookings, invoices and take registers for your children. All with partnership with parents remaining at it’s heart. And every feature in Tapestry is included in the price of your package – no extra charge.

When you sign up for a Tapestry account, one thing you can be sure of is that you have the tools to ensure that your data is secure. Some software companies claim that they do all the worrying for you – ‘we take care of your data so you don’t have to’. This would be a risky decision though – you have a responsibility to ensure that you comply with data protection laws of any data you are collecting. This does not mean you need to have a full understanding of what encryption is for and how it works, for example, but it does mean that you should follow some basic safety standards, such as not sharing passwords, and considering what data you are collecting and why. You want your parents and carers to trust you to do this.

Data processing and how you store your data was a real focus a few years ago when the new GDPR rules came into force. Whether people are more confident about data now, or whether there is some complacency creeping in, this focus on protecting your data seems to be discussed less than before.

Tapestry stores all your data within the UK/EU. But why should where your data is stored matter to you? Under the current laws, it is your legal responsibility to make sure your data subjects’ rights are protected. If your data is not being stored in the UK/EU, you would need to be making sure that the country it is going to is covered by the UK’s adequacy regulations. This may mean checking that the contract you have with the company includes standard contractual clauses (SCCs).

What checks are made on those who do have access to your data? At Tapestry, every member of staff has a full DBS check completed, which is renewed annually, and is part of our contract with our customers.

Once you have established who has access to the data, have you considered what they can do with your data? In an ideal situation, you will want to be the sole controller of your data, the supplier being the data processor. This is something that Tapestry thought very carefully about, and each customer is the only controller of their data. This is why when a non-manager or relative contacts customer services, we are unable to help them further without permission from a manager.

Why does it matter that you are the sole data controller? Knowing who has access to your data, and when, is important so that you know that no one is going to be using the data that you have added to their financial advantage. For example, if you were to add relatives to your account so that they can access things you want to share with them, it’s a fair expectation that these relatives won’t then have their information sold on to another company that can target them with adverts about things for children. If you’re not the only one in control of your data, you have no guarantee that this won’t be happening at some point in the future. When you set up someone on your account, are you confident that no one else will contact them on your behalf offering something that you may not be aware of? If something is sent out and offered, is it something that you are happy being associated with?

Whilst thinking about the future, when you no longer require some data to be on your account, do you know what happens to it when it is deleted? Is it deleted forever immediately? Is it stored somewhere for a period of time, and yes, how long for? Once you have deleted the data, does anyone else still have access to it? For Tapestry accounts, once a manager deletes some data, or an account expires, that data remains on the servers for 90 days. This period of time allows managers to request access to this data easily should they realise that they need it again. After the 90 days, the data is then stored for a further 90 days on our backup servers, after which it is deleted forever.

At Tapestry, we are confident that each setting is fully in control of all their data and that we will never access this data unless we have permission from the data controller, and even then, only if it is completely necessary. When setting up a child on Tapestry, the only information required is their name, and date of birth. Everything else is optional. When setting up staff and relatives for full accounts (not PIN only), all that is required is a name and email address. As the data controller, you can decide what information you want to collect and add to your Tapestry account, and how you want to use it.

When you are completing your own data impact assessment, you need to be as sure as you can be that you know and understand what any company you are sharing the data with does with that information, and that they take their responsibility for that data seriously. The contract between Tapestry and the data controller for each setting can be viewed here, and as always, our customer service team are more than happy to answer any further questions that you may have.