We respect and protect your privacy – it does not matter if you are a child, a legal guardian/parent in terms of §§ 1626-1698b BGB, an authorised or an interested person. Below, you will get a detailed overview about which data about you or your child we collect and how we process these data. We also inform you about your Data Protection Rights and to whom you may refer with your questions concerning this matter.

About Us   

Controller responsible for data processing:

educcare Bildungskindertagesstätten gGmbH
Alter Markt 36-42
50667 Köln
phone: 0221 466 194 00
fax: 0221 466 194 99
e-mail: info@educcare.de
Managing directors: Axel Thelen, Marcus Bracht

educcare Kita gGmbH
Alter Markt 36-42
50667 Köln
phone: 0221 466 194 00
fax: 0221 466 194 99
e-mail: info@educcare.de
Managing directors: Axel Thelen, Marcus Bracht

We are a German, nationwide acknowledged, free agency of educational day-care centres (“Bildungskindertagesstätten”), and we support communes and companies in matters of planning, constructing and organising day-care centres. The data processing is necessary for serving the purposes mentioned below.

Concerning questions about this Data Protection Information, processing of your data, your rights or other data protection topics, our Data Protection Officer (DPO) would be pleased to help you.

Contact Data of the DPO for the above-mentioned companies:

Der Datenschutzbeauftragte
Alter Markt 36-42
50667 Köln
dsb@educcare.de

To whom this information refers

This Data Protection Information refers to the children, cared by us, and their parents and legal guardians as well as interested persons.

Your obligations

For using our offer, we ask you to give us personal data within the framework of our business relationship.

Additionally we process your data for preserving our legitimate interests based on a balance of interests, so we can make sure that our services will improve.

We also offer services for which we need your consent to process your data. Giving your consent is always voluntary. If you deny or withdraw your consent, it won`t have consequences for the business relationship between us.

Please be aware that, if you deliver us information about other (further) persons, you will need their approval and you will have to inform them – regarding this Data Protection Information – about the purpose of forwarding their data in advance.

Which data will be processed?

1. Processed data and purposes

Here we explain to you which personal data we process for the following purposes:

• Processing data for the initiation of a contract is necessary for deciding about the allocation of available places in the day-care centre.
• Processing data for the fulfilment of a contract are necessary for enabling the whole workflow of childcare in our facilities and for meeting our obligations. Picture and audio records of your child, created by us, are used for the educational documentation (“Bildungsdokumentation”) in order to identify the belongings, the whereabouts or the personal spaces of children. In addition, they serve as a medium for reflection with children, interaction consulting, for internal case discussions, parent-educator talks, trainings and work documentation by placing pictures on the walls of our rooms.
• In the framework of our company communication, we process your data in order to create invitations for events, for sending information and materials about our campaigns and for the organisation of events.
• Our accounts receivable department processes data for execution and fulfilment of legal standards (especially tax law, commercial law, communal guidelines for collecting child data and registering children, specific country rules for operating methods of day-care centres as well as for data administration and fulfilment of contracts.
• For the purpose of allowance management, we process data in order to apply and keep up the operating allowance, to apply and account subsidies, to fulfil legal statistic requests and for economic controlling.
• If your commune approves benefits (i. e. Bonus Card; social educational or participation benefits (“Leistungen aus Bildungs- und Teilhabepaket”) for using the services of a day-care centre, we process your personal data for accounting.
• We process the employer confirmation (“Bestätigung des Arbeitgebers”) for the allocation of places in the day-care centre and for accounting.

Legal basis for using your data

We process your data in the framework of initiation and fulfilment of contracts (Art. 6 (1)(b) GDPR), as well as on the basis of several laws concerning the operation of day-care centres and early infantile education (such as German SGB VIII, BStatG, specific country rules for operating methods of day-care centres, and communal rules for the use of day-care facilities) (Art. 6 (1)(c) GDPR).

Furthermore we process data in the framework of consents (Art. 6 (1)(a) GDPR).

Moreover, we process your data in order to preserve our legitimate interests (Art. 6(1)(f) GDPR):

• As it is our legitimate interest to improve our service, we regularly organise opinion surveys.
• We use your name and your address for sending event invitations, information and materials for our campaigns as well as for the organisation of events due to our legitimate interest of communicating these topics.
• For purposes of risk management and for business and finance strategies, we create risk, finance and business reports based on all data available in our company. Customer data and data of interested persons might be concerned.
• Moreover, it is in our interest to examine suspect incidents and to inform the law enforcement agency in case of a concrete criminal suspect against a customer or interested person.
• In case of a security incident in our company concerning your data, we are obliged to inform the Data Protection Authority in charge (Art. 33 GDPR). As it is our legitimate interest to meet this legal obligation immediately, possibly data may be processed during clearing up of the concerned security incident. Reports to the Data Protection Authority do not contain any personal data.
• In order to meet our legal obligation to control the annual report as prescribed by German § 316 (1) HGB, we engage financial auditors. Possibly the auditor may see personal data while controlling documents. However, as secret carriers financial auditors are obliged to professional discretion.
• For meeting our tax obligations, we engage tax counsellors. During the consultation, the tax counsellor may see documents containing personal data. However, as secret carriers tax counsellors are obliged to professional discretion.
• In case of controlling the disposition of public benefits, the Controlling Authority may see documents, containing personal data. However, as secret carriers controlling authorities are obliged to professional discretion.
• Our clients have a legitimate interest in obtaining statistic data for demand planning and controlling from us.

Deletion period (or retention period)

After closing a childcare contract, the processed data will be deleted 10 years after final clearing with the public benefit communes. The deadline begins at the end of the year of the final clearing for the last day-care centre year („Kitajahr“) or calendar year of the childcare contract. For example: If the contract ends on 31.07.2016 and the final clearing of this contract took place in 2017, the deletion period ends on 31.12.2027.

Our processed personal data

Data	Initiation of a contract	Fulfilment of a contract (Childcare contract)	Company communication	Accounts receivable	Allowance management	Benefits ( i. e. BonusCard/ BuT)	Data for employer confirmation
Data of parent/legal guardian (i. e. Family name, first name, family status, date of birth, nationality, contact data, employment fulltime/halftime	x	x	x	x	x	x	x
Data of child (i. e. Family name, first name, date of birth, place of birth, confession, nationality, brothers and sisters)	x	x	x	x	x	x	x
Data of persons assigned with bringing and fetching your child (“Bring/Abholberechtigter“) (i. e. Family name, first name, date of birth)		x	x	x
Short time care costs		x	x	x	x
Subsistence costs		x	x	x	x	x
Care costs		x	x	x	x	x
Desired date of start	x	x	x	x	x	x
Data of child´s health (i. e. medical prevention data, specifics, allergies, vaccinations, contagious diseases, vaccination consultation)		x		x	x
Habits of eating		x
Desired care volume	x	x	x	x	x	x	x
Subsistence volume	x	x	x	x	x	x	x
Kind of care (“Krippe”/nursery, “Kita”/daycare)	x	x	x	x	x	x	x
Current childcare	x
Observation form (Family name, date of birth, date, time, age: years-months, name of observer, kind of observation).		x
Contact data parent/legal guardian and child (Address, street, city, post code, phone number, email)	x	x	x	x	x		x
Job (Parent/legal guardian)	x	x	x	x	x		x
Ordered promotion materials			x
Given consents		x	x
Date of receipt of postcard order			x
Postage and interest for new cards			x
Information about diseases/permanent disturbances of child	x	x			x
Bank connection parents (account holder, IBAN/account number, BIC bank code, bank, credit institute)		x		x	x
Fee for care category	x	x		x	x	x	x
Billing and accounting data (i. e. customer number, amount, invoice line items)		x		x		x
Data of material orders (i. e. family name, contact data, ordered items)			x
Statement of youth welfare office	x	x			x
Information about physical developement	x	x			x
Faculty of speech	x	x			x
Information about emotional development	x	x			x
Daily routine	x	x			x
Information about movement behaviour	x	x
Information about playing behaviour	x	x
Information about emotional development: prevailing mood information		x
Data of accounting		x		x		x	x
Picture and audio records of child		x

Origin of data

Beside the data, which you (or an authorised person) gave us, we get personal data from communes and educational day-care centres („Betriebskindertagesstätten“), as well as from our clients.

Which organisations receive your data?

The following table gives you a complete overview of all cases in which your data will be forwarded to a third party. Explanations about the actual data can be found in the corresponding chapters of this information letter.

In order to fulfil our tasks, we engage selected assistants and service providers (commissioned data processors regarding Art. 28 DS-GVO), which have access to your data in the individually required scope for performing their services. The commissioned data processors are liable to numerous contractual obligations. In particular, they may process your personal data in accordance with our instructions only and exclusively for fulfilling our orders.

An additional part of data recipients is represented by bodies to whom we deliver data in order to meet our legal notification requirements.

 

Data recipient	Explanation
Public external sources	Forwarding personal data to public external sources happens in order to fulfil our legal obligations only.
Agencies	For creating brochures, posters, invitations etc. we engage service providers.
Employer of the parent/legal guardian	Forwarding personal data happens in order to fulfil our legal obligations only.
Employer and communes	Forwarding of personal data to these institutions happens in order to fulfil our legal obligations only.
Authority for operating license	Forwarding personal data to authorities happens in order to fulfil our legal obligations only.
Service provider for mass data/document destruction	In the framework of commissioned processing, we engage service providers for the elimination of documents and data records.
Service provider for printing, letter shops	For printing and sending letters, we engage service providers in the framework of commissioned processing.
educcare Lösungen für Familie und Beruf GmbH	Supporting the development of pedagogical work in our facilities.
IT-provider	In the framework of providing our IT infrastructure, our registration platform („Anmeldeportal“) and our website, the corresponding service providers (commissioned data processors) may get access to your data.
Public or legal auditors appointed by our clients (communes and companies) or other external sources	Forwarding personal data to these audit instances happens in order to fulfil our legal obligations only.
Courts, lawyers, experts	In the framework of legal and extrajudicial disputes, data may be delivered to the involved (process) parties.
Tax authorities	Forwarding personal data to these authorities happens in order to fulfil our legal obligations only.
Tax counsellors	For meeting our tax obligations, we engage tax counsellors. During the consultation, the tax counsellor may see documents containing personal data. However, as secret carriers, tax counsellors are obliged to professional discretion.
Law enforcement authorities	It is in our interest to examine suspect incidents and – in case of a concrete criminal suspicion – to forward the necessary data to the law enforcement authorities.
Payment service providers	For processing payments, we engage payment service providers, i. e. bank institutes.
Financial auditors	In order to meet our legal obligation to control the annual report re § 316 Abs. 1 HGB, we engage financial auditors. Possibly the auditor may see personal data while controlling documents. However, as secret carriers, financial auditors are obliged to professional discretion.

Your rights

You have the legal right to data portability (Art. 20 DS-GVO) as well as to access (Art. 15 DS-GVO), rectification (Art. 16 DS-GVO), erasure (Art. 17 DS-GVO) or restriction of processing (Art. 18 DS-GVO) of your personal data.

Furthermore, you have the right to object to such processing (Art. 21 DS-GVO) of your personal data for reasons arising from your particular situation; this also applies to profiling based on these provisions within the terms of Art. 4 Abs. 4 DS-GVO.

Withdrawal of consent

If the collection or processing of your personal data is based on your consent, you can always withdraw your consent with effect for the future. The lawfulness of all processing before your withdrawal will remain unaffected.

For practising your rights, you can refer to:

dsb@educcare.de

Right to lodge a complaint with a supervisory authority

You also have the legal right to lodge a complaint with a Data Protection Authority (Art. 77 DS-GVO).