Who is responsible for what
For the data entered in the application (children, families, attendance, billing), your setting is the data controller and Kidola acts as processor within the meaning of Article 28 of the GDPR. A data processing agreement (DPA) governs that relationship: it sets out the purposes, the security measures and each party's obligations.
For the data collected on this site (forms, audience measurement), Kidola S.A. is the data controller.
Hosting and security
All data is hosted in the European Union, transmitted exclusively over encrypted connections, and backed up daily. Internal access is limited to what is strictly necessary, logged and protected by strong authentication. No data is transferred outside the European Union for the operation of the service.
Photos and children's data
Photos shared with families travel through the application only, never through personal messaging apps. Each parent sees only what concerns their own child, according to the permissions set by the setting. Consents (image rights in particular) are recorded and can be consulted in Kidola.
Your rights
Under the GDPR, every data subject has a right of access, rectification, erasure, restriction, objection and portability. Families exercise those rights with their childcare setting, which can rely on Kidola to respond: exports, deletion and anonymisation are built into the tool.
For data collected via this site, you can exercise your rights by writing to [email protected]. You also have the right to lodge a complaint with the CNPD in Luxembourg, the CNIL in France or the APD in Belgium.
In the event of an incident
In the event of a data breach likely to create a risk for the people concerned, Kidola notifies the settings involved without undue delay and supports them with their own notification obligations, in accordance with Articles 33 and 34 of the GDPR.