Legal

Privacy Policy

Last updated 30 July 2026 · Version 1.1

This Privacy Policy explains how KidzSync (“KidzSync”, “we”, “us”), a product created and operated by Ian Louw, collects and uses personal data when you use the KidzSync mobile apps and website (together, the “Service”). We take particular care with children's data.

1. Who is responsible for your data

For your own account data, KidzSync acts as a data controller. For information a childcare centre records about children and families, the centre is the controller and KidzSync acts as a processor on the centre's instructions under a data-processing agreement. You can reach us about any of this at privacy@kidzsync.com, or our Data Protection Officer at dpo@kidzsync.com. Our postal address is available on request.

KidzSync is available in more than one country. Rather than give different people different protections, we apply the standard set out in this policy — modelled on the EU General Data Protection Regulation — to every user, wherever you live. Where your own country's law gives you something extra, that applies too.

2. The data we collect

  • Account & contact data — name, email, phone number, role (parent/guardian or educator) and centre.
  • Child profile data — a child's name, date of birth, room/group, allergies and care notes, entered by the centre or by you.
  • Activity & content — daily updates, observations, photos, messages, milestones and reports shared within your centre.
  • Payment data — invoices, balances and, where your centre collects payment through the app, the mandate or reference details needed for it. Card payments are handled by a regulated payment provider; we never see or store full card numbers.
  • Technical data — device type, app version, and diagnostic logs needed to keep the Service secure and working.

3. How and why we use it (legal bases)

  • To provide the Service — performance of a contract (Art. 6(1)(b) GDPR).
  • To record and share a child's day — the centre's task in the public interest / its legitimate interest as controller, with parental consent for a child's personal data where required (Art. 6(1)(a) & Art. 8 GDPR).
  • To keep the Service safe and reliable — our legitimate interests in security and fraud prevention (Art. 6(1)(f)).
  • To meet legal duties — accounting, safeguarding and record-keeping obligations (Art. 6(1)(c)).

We do not use personal data for behavioural advertising or to build marketing profiles, and we never sell personal data.

4. Children's data

KidzSync is designed for adults (parents/guardians and staff) to record information about children. Children do not create their own accounts. A child's personal data is only processed on the basis of the centre's lawful basis and, where consent is relied upon, the consent of a person with parental responsibility, consistent with GDPR Article 8. See our Children's Privacy notice for full detail.

5. Who we share data with

We share personal data only with: your childcare centre and its authorised staff; sub-processors who help us run the Service (cloud hosting, error monitoring and payment processing) under contract; and authorities where the law requires. A current list of sub-processors is available at privacy@kidzsync.com. We do not permit third-party analytics or advertising SDKs to collect children's data.

6. Where your data is stored & transfers

Personal data is hosted on servers inside the European Union (Ireland region), which means data is protected by EU data-protection law wherever you use the Service from. If you are outside the EU, your data is transferred there to be stored — that is the whole point, and it is the stricter option, not the looser one. Where a sub-processor operates outside the EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses plus additional safeguards.

7. How long we keep it

We keep personal data only as long as needed for the purposes above, or as your centre instructs. When your centre closes an account or you delete yours, we delete or anonymise the data within 30 days, except where we must keep records to meet legal obligations (for example, financial records). See Data & account deletion.

8. Your rights

You have the right to access, correct, delete, restrict or object to processing, and to data portability. You can withdraw consent at any time. Full detail and how to exercise each right is in GDPR & your rights.

9. Security

We protect data with encryption in transit and at rest, role-based access controls, least-privilege staff access and regular backups. No system is perfectly secure, but we work hard to keep your family's data safe and will notify you and the relevant authority of a breach where the law requires.

10. Changes & contact

We'll tell you about material changes in the app. Questions? Email privacy@kidzsync.com or our DPO at dpo@kidzsync.com. You may also complain to the data-protection authority for the country you live in.