Privacy Policy
How we process data in KinderManage — facilities, children, parents, and staff.
Who controls your data
The facility (kindergarten/nursery) using KinderManage is the data controller for children's, parents'/guardians', and staff data — it decides what data is collected and why. KinderManage processes that data on its behalf, under a data processing agreement. For some data — your account in the app, and the security and diagnostics of the app itself — KinderManage is an independent controller.
What data we process
Account data (name, email, phone, address, password); child data (name, date of birth, group, photo); attendance; meals and diet; consents given for the child; guardian–child relationships; financial data (invoices, payments); in-app chat messages; a push-notification device token; basic technical and diagnostic data.
Legal basis
Keeping the child's records and attendance — performance of the contract with the facility and obligations under education law. Billing — contract plus tax/accounting rules. Communication and notifications — contract and the facility's legitimate interest in running smoothly. App security and diagnostics — KinderManage's legitimate interest in keeping the system stable and secure.
Children's data and health data
A child is not a user of the app and isn't a party to any contract — all rights relating to their data are exercised on their behalf by a parent or legal guardian. Allergy, special-diet, or other health-related information about a child is a special category of data — processed only with a separate, explicit consent, which can be withdrawn at any time. The same applies to consent for using a child's image.
Who we share data with
Data may be shared with trusted service providers under data processing agreements: online payment processors (your card number never touches our servers), error-diagnostics tooling, push-notification providers, and hosting infrastructure. We never sell data or share it with third parties for marketing purposes.
How long we keep data
Account data — for as long as the account exists, plus up to 30 days after deletion in case of recovery. Financial data — 5 years, per tax law. Child data and attendance — for the duration of enrollment plus the facility's own record-retention rules.
Your rights
You have the right to access your data, have it corrected, deleted, have processing restricted, request data portability, object to processing, and withdraw consent at any time. You also have the right to lodge a complaint with the Polish data protection authority (Prezes UODO). A child's rights are exercised on their behalf by a parent or legal guardian. For data controlled by the facility, contact the facility directly.
Security
Data in transit is encrypted, passwords are stored only in hashed form, and a child's data is visible only to their own guardians, their group's teachers, and facility management — never the whole facility or other parents.
Changes to this Policy
If we make a material change to how data is processed, we'll ask you to accept the new version before you can keep using the app.