Privacy Policy
How we process data in KinderManage — facilities, children, parents, and staff.
Who we are
KinderManage is operated by KinderManage Dawid Szoka (Tax ID / NIP 9662225808) — "KinderManage", "we". For any questions about how we handle personal data, contact us at kontakt@kindermanage.com.
Who controls your data
The facility (kindergarten/nursery) using KinderManage is the data controller for children's, parents'/guardians', and staff data — it decides what data is collected and why. KinderManage processes that data on its behalf, under a data processing agreement (GDPR Art. 28). For some data — your account in the app, and the security and diagnostics of the app itself — KinderManage is an independent controller. The specific terms of that data-processing relationship are set out in our Data Processing Agreement at kindermanage.com/dpa.
What data we process
Account data (name, email, phone, address, password stored only in hashed form); child data (name, date of birth, gender, group, photo — if the facility adds one); attendance; meals; naps and hygiene; consents given for the child; guardian–child relationships; staff data entered by the facility (salary, employment start date); financial data (invoices, payment history, transfer confirmations); in-app chat messages; a push-notification device token; your IP address and basic technical/diagnostic data (device model, OS and app version, error logs and, in the mobile app, recordings of a portion of sessions with all text and images masked). Providing some data is voluntary but necessary to use certain features — without it, those features may be unavailable.
Legal basis
Keeping the child's records, attendance, meals, and hygiene logs — performance of the contract with the facility and obligations under education law. Billing — contract plus tax/accounting rules. Communication and notifications — contract and the facility's legitimate interest in running smoothly. Account upkeep, security, and app diagnostics — KinderManage's legitimate interest in keeping the system stable and secure. Consent — where required separately (e.g. a child's image) — can always be withdrawn. Accepting this Policy is not itself a legal basis for processing — it confirms you've been informed of how your data is handled.
Children's data
A child is not a user of the app and isn't a party to any contract — all rights relating to their data are exercised on their behalf by a parent or legal guardian. KinderManage has no fields designed for collecting a child's health data (e.g. allergies, special diets, or medical information) or any other special category of data under GDPR Art. 9, and isn't intended for that purpose. Free-text fields — notes, chat messages, consent descriptions — shouldn't be used to record such information. The consent module lets the facility collect consents from parents and guardians whose wording the facility itself defines (e.g. for using a child's image); a consent can be withdrawn at any time.
Who we share data with
Data may be shared with trusted service providers under data processing agreements: error-diagnostics tooling (Sentry), with automatic masking of passwords and other sensitive content — in the mobile app it also receives the signed-in user's identifier and email address and recordings of a portion of sessions with all text and images masked; push-notification providers (Expo, Google Firebase Cloud Messaging, Apple Push Notification Service); Cloudflare (delivery of the browser-based app); and our hosting/cloud infrastructure provider. We don't currently use an online payment processor — invoices are settled by direct bank transfer — and we never sell data or share it with third parties for marketing purposes.
International data transfers
Some of our providers (e.g. error diagnostics, push notifications) may process data on servers located outside the European Economic Area, in particular in the United States. In such cases, the transfer relies on appropriate legal safeguards — Standard Contractual Clauses approved by the European Commission, or an adequacy decision (e.g. the EU-U.S. Data Privacy Framework).
Cookies and similar technologies
The KinderManage website and mobile app don't use cookies or other technologies for marketing or advertising purposes, and we don't use tools like Google Analytics. We use only technology that's strictly necessary to run the service: in the browser, local storage (localStorage) to remember preferences (e.g. light/dark theme, selected facility) and keep you logged in; in the mobile app, the device's encrypted system storage for login data and local app settings. These don't require separate consent, since they're necessary to provide the service. If we ever introduce analytics or marketing tools that require consent, we'll tell you and ask for it separately.
How long we keep data
Account data — for as long as the account exists, plus up to 30 days after deletion in case of recovery. Financial data — 5 years, per tax law. Child data, attendance, meals, and hygiene logs — for the duration of enrollment plus the facility's own record-retention rules. Consent records — for as long as the consent applies, and afterward as evidence it was given. Diagnostic data and security logs — up to 12 months, unless needed to investigate an incident.
Data security
Data in transit is encrypted (TLS), passwords are stored only in hashed form, and a child's data is visible only to their own guardians, their group's teachers, and facility management — never the whole facility or other parents. If a personal data breach occurs that could result in a high risk to your rights or freedoms, we'll notify you as required under GDPR.
Automated decisions and profiling
We don't make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. We don't use your data for targeted advertising.
Your rights
You have the right to access your data, have it corrected, deleted, have processing restricted, request data portability, and object to processing — and, where processing relies on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with the Polish data protection authority (Prezes UODO, ul. Stawki 2, 00-193 Warsaw). A child's rights are exercised on their behalf by a parent or legal guardian. For data controlled by the facility, contact the facility directly — for everything else, email us at kontakt@kindermanage.com; we may ask you to verify your identity before acting on a request.
Changes to this Policy
If we make a material change to how data is processed, we'll let you know in the app and ask you to accept the new version before you can keep using the service.