Privacy & Cookie Policy
1. Data Controller
The data controller responsible for this website is:
Toddlers Academy
Sofia, Bulgaria
Email: toddlersacademykindergarten@gmail.com
Phone: +359 898 455 375
If you have any questions about how we handle your personal data, please contact us using the details above.
2. Data We Collect
2.1 Information you provide directly
When you submit an enrollment inquiry through our website, we collect the following data about the child and parent / legal guardian:
- Child's full name, date of birth, and age at entry
- Preferred kindergarten location (Q-Center or The Bells)
- Parent / guardian full name
- Parent / guardian contact email address and phone number
- Any additional information you voluntarily include in the inquiry
When you contact us directly by email or phone, we retain the content of that communication and your contact details.
2.2 Information collected automatically
When you visit our website, certain technical data is collected automatically, subject to your cookie consent:
- Browser type, version, and operating system
- Pages visited, time spent, and navigation path
- IP address (anonymised where applicable)
- Cookie identifiers and consent preferences
- Referral source (the URL that led you to our site)
3. Purposes & Legal Basis for Processing
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Processing enrollment inquiries and responding to prospective families | Pre-contractual steps at the request of the data subject (Art. 6(1)(b)) |
| Communicating information about our programmes and services | Legitimate interest (Art. 6(1)(f)) or consent where required |
| Operating and improving the website (analytics) | Consent (Art. 6(1)(a)) — managed via your cookie preferences |
| Managing cookie consent preferences | Legal obligation to demonstrate consent (Art. 6(1)(c); ePrivacy Directive) |
| Complying with legal obligations (e.g., accounting, child-protection records) | Legal obligation (Art. 6(1)(c)) |
| Protecting the vital interests of children in our care | Vital interests (Art. 6(1)(d)) |
4. Processing of Children's Data
As a kindergarten, we necessarily process personal data about children. We observe the following safeguards:
- We only collect children's data through their parents or legal guardians. We do not collect data directly from children.
- The minimum data required for an enrollment inquiry is collected; we do not ask for more information than is necessary (data minimisation principle).
- All children's data is stored securely and accessed only by authorised staff.
- If you believe we have received information about your child incorrectly or without authorisation, please contact us immediately at toddlersacademykindergarten@gmail.com and we will promptly review and delete that data.
5. Data Retention
| Category | Retention Period |
|---|---|
| Enrollment inquiry data (unsuccessful inquiries) | 12 months from the date of inquiry, then securely deleted |
| Enrollment and attendance records (enrolled children) | Duration of enrollment plus 5 years for legal and accounting purposes |
| Email and phone communication records | Up to 3 years from last contact |
| Cookie consent records | 12 months (refreshed on renewal of consent) |
| Website analytics data | As configured in your cookie settings (typically up to 13 months) |
At the end of each retention period, data is deleted or anonymised.
6. Third-Party Services
We use the following third-party services that may receive or process your personal data. All processors have been assessed for GDPR compliance and, where required, data processing agreements (DPAs) are in place.
Cookiebot by Usercentrics
Used to manage and record cookie consent on our website. Cookiebot processes consent logs on our behalf. Privacy policy: cookiebot.com/en/privacy-policy
Google Fonts
Web fonts are served by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When the page loads, your browser may send your IP address to Google servers to retrieve the fonts. Google's privacy policy: policies.google.com/privacy
Facebook & Instagram (Meta Platforms, Inc.)
Our website contains links to our Facebook and Instagram profiles. Clicking these links takes you to Meta's platforms, which operate under their own privacy policies. We do not control how Meta processes your data once you leave our website. Meta's privacy policy: facebook.com/privacy/policy
We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
7. Your Rights Under GDPR
Under the GDPR and the Bulgarian Personal Data Protection Act (PDPA), you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you and information about how it is used. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") where there is no overriding legal basis for retention. |
| Restriction of processing (Art. 18) | Request that we restrict processing of your data in certain circumstances (e.g., while accuracy is disputed). |
| Data portability (Art. 20) | Receive your data in a structured, machine-readable format and transfer it to another controller, where technically feasible. |
| Objection (Art. 21) | Object to processing based on our legitimate interest. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests. |
| Withdraw consent (Art. 7(3)) | Withdraw previously given consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
To exercise any of these rights, please email us at toddlersacademykindergarten@gmail.com. We will respond within 30 days in line with Art. 12 GDPR. Requests are free of charge unless manifestly unfounded or excessive.
Supervisory Authority
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP):
- Website: www.cpdp.bg
- Address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria
- Email: kzld@cpdp.bg
- Phone: +359 2 915 3580
8. Cookie Policy
8.1 What are cookies?
Cookies are small text files placed on your device by the websites you visit. They are widely used to make websites work more efficiently, to remember your preferences, and to provide information to website owners. Cookies set by the website operator are called "first-party cookies"; cookies set by other parties are called "third-party cookies".
8.2 Types of cookies we use
| Category | Description | Can be disabled? |
|---|---|---|
| Necessary | Essential for the website to function correctly. These include cookies that record your cookie consent decision. The website cannot function properly without them. | No |
| Functional | Enable enhanced functionality and personalisation, such as remembering language preferences or previously viewed content. | Yes |
| Statistics / Analytics | Help us understand how visitors interact with the website by collecting and reporting information anonymously (e.g., pages visited, session duration). | Yes |
| Marketing | Used to build a profile of your interests and show you relevant advertisements on other websites. We currently use social media links (Facebook, Instagram) which may set third-party cookies. | Yes |
For the full, up-to-date list of specific cookies used on this website, see our Cookie Declaration.
8.3 Managing your cookie preferences
You can review and update your cookie preferences at any time:
- Open cookie settings (footer of any page on this website)
- Through your browser settings (see guidance below)
Be aware that disabling certain cookies may affect website functionality. Withdrawing consent does not affect the lawfulness of prior processing.
8.4 Browser cookie controls
- Google Chrome: Settings → Privacy and Security → Cookies and other site data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Apple Safari: Preferences → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These include:
- HTTPS encryption for all data transmitted between your browser and our website
- Restricted access to personal data (need-to-know basis)
- Regular review of data handling practices
Despite these measures, no transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately.
10. International Data Transfers
Some of our third-party service providers (including Google LLC for Google Fonts) are based outside the European Economic Area (EEA) in countries that may not offer the same level of data protection. Where such transfers occur, we rely on appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR)
- Adequacy decisions by the European Commission where applicable
11. Changes to This Policy
We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, legal requirements, or the services we use. The "Last updated" date at the top of this page indicates when it was last revised.
We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to bring them to your attention.
12. Contact
For any questions, requests, or concerns regarding this policy or your personal data, please contact us:
Toddlers Academy
Email: toddlersacademykindergarten@gmail.com
Phone: +359 898 455 375