Privacy policy
Version: October 2024
Purpose
To maintain a clear and thoughtful procedure for handling sensitive personal data to protect personal information.
Scope
All employees and administration of De Groene Boomhut (hereinafter referred to as DGB)
References
General Data Protection Regulation (GDPR)
Principles
-
The organization ensures that customer personal data is stored in a locked cabinet.
-
The organization ensures that digital personal data is stored in a way that protects it from unauthorized use and prevents data loss. This means that it is securely stored and prevents unauthorized access.
This privacy regulation is established to protect personal privacy regarding personal registration at DGB.
1. Definitions
1.1. Personal Data:
Data that can be traced back to an individual natural person.
1.2. Personal Registration:
A collection of data relating to different individuals that has been systematically compiled.
1.3. Disclosure of Data from Personal Registration:
Making known or providing personal data that is included in the personal registration or obtained through its processing, whether or not in connection with other data.
1.4. Holder of the Personal Registration:
The person who has control over the personal registration and is responsible for compliance with the provisions of the regulation: the director-manager.
1.5. Administrator of the Personal Registration:
The person tasked with the daily care of a personal registration or a portion thereof, under the responsibility of the director-manager.
1.6. Registered Individuals:
Natural persons for whom DGB manages administration, children for whom childcare is requested or provided, parents/caregivers of the child, staff members, volunteers, management.
1.7. Users of the Personal Registration:
Those authorized according to their job/function description to enter and/or modify data in the personal registration or to be informed about any execution of the personal registration.
2. Scope of the Personal Registration
2.1. The objective of DGB is to provide administrative services for legal entities and childcare organizations. DGB will not include personal data in the registration for purposes other than those mentioned in the description above.
2.2. Processing of personal data will only occur in accordance with the objective mentioned in article 2.1.
2.3. DGB will not store or retain more data in the registration than is necessary for the purpose of the personal registration.
3. Security of the Personal Registration
3.1. DGB ensures the necessary technical and organizational measures to secure the personal registration against loss or alteration of data and against unauthorized access, modification, or disclosure.
4. Confidentiality
4.1. Employees of DGB are obliged to maintain confidentiality regarding personal data.
5. Data Processing
5.1. Personal data will only be processed for the following purposes:
- Processing salaries.
- Processing invoices and collections.
5.2. For the above purposes, the following personal data may be requested:
- Name, address, and city (NAW) data, phone numbers, and email addresses.
- Date of birth.
- BSN number.
- Salary data from previous employers, salary data from parents regarding VVE target children.
- Bank details.
6. Disclosure of Data
6.1. For disclosing personal data to third parties outside the cases mentioned in articles 5.1 and 5.2, explicit consent from the registered individual is required and will never be provided to parties with whom M-A has not entered into a data processing agreement.
6.2. The disclosed data will not be provided to other parties unless legally required and permitted. An example of this is when the police request (personal) data from us in the context of an investigation. In such a case, we must cooperate and are obligated to provide this data, or when the tax authorities request childcare data.
6.3. We will only process personal data of minors (persons under 16 years) if written consent has been provided by the parent, caregiver, or legal representative.
7. Access to Recorded Data
7.1. Legal entities for whom administration is managed by DGB have the right to access their registered data. They can submit a written request to the director-manager for this purpose.
7.2. Staff members, volunteers, and interns have the right to access their registered data. They can submit a written request for this.
8. Correction, Addition, and/or Deletion of Recorded Data
8.1. Legal entities for whom administration is provided, parents and/or caregivers of a child for whom childcare is requested or provided, may request correction or addition of their relevant data or deletion and destruction of data that is in violation of the regulation or is irrelevant. They must submit a written and reasoned request to the director-manager. If warranted, the director-manager will decide on this request, and this decision will be communicated in writing to the legal entity, parents, and/or caregivers of the child.
8.2. Staff members, volunteers, and interns may request correction or addition of their relevant data or deletion and destruction of data that is in violation of the regulation or is irrelevant. They must submit a written and reasoned request to their supervisor. If warranted, the director-manager will decide on this request, and this decision will be communicated in writing to the individual.
9. Retention Period
9.1. DGB retains the registered personal data of legal entities, children, and/or their parents/caregivers for a maximum of 7 years after the completion of childcare or a maximum of 7 years after registration (applicable when registration does not lead to a placement agreement). Once the retention period has expired, the personal data will be removed and destroyed from the registration within a period of 1 year, or processed in such a way that re-identification of individual persons is reasonably impossible, resulting in anonymous data.
9.2. DGB retains the registered data of legal entities, parents, children, staff members, volunteers, and interns for at least the period set by the tax authorities (in 2018: 7 years) after the termination of the contract. Once the retention period has expired, the personal data will be removed and destroyed from the registration within a period of 1 year, or processed in such a way that re-identification of individual persons is reasonably impossible, resulting in anonymous data.
10. Transfer/Transition
10.1. In the event of transfer/transition of the registration to a holder other than the director-manager of DGB, the registered individuals must be informed of this fact, so they can object to the transfer or transition of data relating to them.
10.2. The data provided to DGB may be shared with third parties if this is necessary for the execution of the purposes described above. For instance, we utilize third parties for:
- Providing the internet environment of DGB;
- Providing (financial) administration;
- Providing payroll administration;
- Providing child administration.
We will never share personal data with other parties with whom we have not entered into a data processing agreement.
Name of Entity
| Data to be Processed | Legal Basis | Processed by | ICT System | Security Measure | Retention Period |
|---|---|---|---|---|---|
| Nanny for All | NAW data of child/parent and caregiver, Email and phone data, BSN numbers | Invoicing childcare | Nanny for All | Via web | Username, Password, Processing agreement, Backup by entity |
| DGB Administration | Own administration | Diplomas/certificates of caregiver | NAW data of child/parent and caregiver | BSN numbers of child/parent/caregiver | Bank details of parent/caregiver |
| Office365 | Schedule/planning system/excel | Username, Password | Confidentiality declaration of employees/parents | Locked cabinets | 7 years |
| Nanny for All | Via web | Username, Password | Processing agreement | 7 years | |
| PFZW | NAW data of employees | Email and phone data | BSN numbers | Pensions | PFZW |
| Quebble | NAW data of clients | Email and phone data | BSN numbers/Data of child/parent | Financial administration | Quebble |
| Tax Authority | NAW data of child/parent | BSN numbers of child/parent | Bank details of parent | Phone data | Tax declaration |
| Advisory & Administration Office | Data of the business, NAW data of child/parent/employee | BSN numbers of child/parent | Bank details of parent | Phone data | Jack Das |