RGPD

1. Introduction

Kidola is an app used by childcare facilities to improve communication with parents and facilitate time consuming tasks. As such, we’re talking about sensitive personal data. Kidola takes your privacy very seriously and we hope to explain to you how we deal with it in a clear and simple way. 
Data privacy is a vast topic with a fast changing environment. If you have any questions or feedback, you can always contact us at hello@kidola.lu. 
Last modified: Feb 04, 2021

2. Scope

Before we start, let’s cover the basics. What do we mean by personal data ? As defined in the GDPR ( General Data Protection Regulation ), Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.
Example: the arrival and departure time of a child is personal data because it’s linked to his profile, where you can see the child’s name.

3. Data controller and transfer

First we need to define the roles. Kidola is giving access to the kidola web app to users / companies (in the childcare sector) As such, Kidola is acting at the request of the nursery as a service provider. Therefore, Kidola is not initiating the data collection and does not set how and why the data of parents and children will be processed. 
⇒ The nursery is the data controller while Kidola is a subcontractor. Thus, as a tutor, please contact the manager of your nursery if you have any question related to your personal data stored in Kidola. Ainsi, en tant que tuteur, veuillez vous adresser au gérant de votre crèche pour toute question relative à vos données personnelles dans Kidola.
Kidola is data controller only for personal data related to customers and prospects. Kidola and its employees save contact information like email and phone numbers of clients / prospects. Kidola’s data protection officer is Quentin de Madre: quentin@kidola.lu

4. Legal basis

Kidola is authorized to store and process data on the data’s controller behalf as a subcontractor as defined in Kidola Terms and Conditions signed by the data controller.

5. The data we collect

To support child care facilities, kidola gives nursery and their teams the possibility to store the different types of personal data. To identify everyone, the following data is collected by the nursery on Kidola
Children profiles : Name, age, gender,and ID number.
Tutor profiles : Name, email address and phone number
Nursery internal user profile : Name and email address
During the day, for the nursery to provide an extensive reports to the parents, the following data is collected by the nursery’ team on Kidola :
Arrival and departure time
Activities: timing, activity type and appreciation / comments
Naps: timing
Hygiene: timing, type of feces and/or change of clothes
Health: timing, nose cleaning, temperature check, medicine intake
Food: timing, type of food or drinks, quantity and appreciation
Pictures 
This page cannot list all types of personal data that is being collected: free text fields are left to be used by educators how they see fit. On top of that, the app is evolving quickly. The goal is to give a clear overview of the type of data being collected, more than a definitive list.

6. How personal data is used

As a subcontractor, Kidola only processes data at the request of the data controller.
Exceptionally, Kidola may have to process personal data if required so by the law of the European union or of one the member states. In that case, Kidola will inform the nursery before processing the data, if allowed by the law.
This data is used by the nursery to inform parents about their children’s day. It’s also used for administrative purposes like invoicing, managing team schedules, and accessing forecasts to plan arrival of new children. Basically, the data is used to support the nursery in its day to day life.
examples: Nurseries use the email address to send parents the daily reports, and communications. Children’s birth dates are used to switch them from one group to another based on age. It’s also used as a reminder to wish them a happy birthday on this very special day.

7. Data sharing

• Kidola, as a subcontractor, is only sharing data at the request of the nursery. Kidola does not share personal data of children to third parties on its own behalf. Typically, data is shared by the nursery with the following categories of people.

• The Nursery manager has access to all the personal data as it’s needed to perform well on his job. In a similar manner, the educators need access to past daily reports, parents communication etc. to take good care of the children. Within the nursery, data is shared based on settings chosen by the manager.

• Parents only have access to the data of their own child (or children). The reports, except for administrative tasks within the nursery, are meant only for the tutors of the child. Pictures are only shared with parents, and not included in any other type of export.

• With the government for invoicing purposes.

8. Data retention and deletion

In accordance with the GDPR Law, Kidola stores data on behalf of the data controller in servers within the European region. This means personal data will not be extracted to other countries outside the EU.
Pictures are only saved for 3 months on Kidola servers. Afterwards, they’re deleted. Backups of the pictures are also deleted after 1 additional month.
All other personal data are kept on Kidola until asked otherwise by the data controller (the nursery). At the request of the data controller, Kidola can provide an export of the data and / or delete the personal data. All copies of the personal data are also deleted within 1 month. 
Kidola may have to keep personal data if required so by the law of the European union or of one the member states. 

9. Secondary subcontractors

For technical reasons, Kidola uses other external companies for part of its services. Kidola selects those companies based on the quality of their services while also taking into account their privacy policy. Keeping your personal data private is our priority.