Privacy Policy

1. Introduction

Pandablooms, S.L. (NIF: B24874943), operating as el Petit Panda International Kids Center, is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and Spanish data protection legislation (Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales).

As a data controller, we are responsible for ensuring that your personal data is processed fairly, lawfully, and transparently. This policy applies to all parents, guardians, children, staff, and visitors to our center.

3. What Personal Data We Collect

We collect and process the following categories of personal information:

3.1 Parent/Guardian Information

• Full name and contact details (address, phone number, email)
• Emergency contact information
• National identification documents (DNI/NIE) for enrollment verification
• Bank account details (for payment processing)
• Employment information (if relevant for childcare vouchers)
• Communication preferences

3.2 Child Information

• Full name, date of birth, and place of birth
• Health information (allergies, medical conditions, dietary requirements)
• Immunization records
• Developmental and educational information
• Behavioral observations and learning progress
• Photographs and videos (with explicit consent)
• Attendance records
• Special educational needs or disabilities (if applicable)

3.3 Website and Communication Data

• Information submitted through contact forms (name, email, phone, message)
• Website usage data (IP address, browser type, pages visited)
• Cookies (see our Cookie Policy)

4. Legal Basis for Processing

We process your personal data under the following legal grounds:

• Contractual Necessity: To fulfill our childcare services agreement with you
• Legal Obligation: To comply with Spanish early years education requirements, health and safety regulations, and safeguarding obligations
• Legitimate Interests: To operate our nursery effectively, ensure child safety, and maintain quality education standards
• Consent: For photographs/videos, marketing communications, and sharing information with third parties (where required)
• Vital Interests: In emergency situations to protect the health and wellbeing of children

5. How We Use Your Personal Data

We use your personal information for the following purposes:

• Providing childcare and education services
• Monitoring and supporting your child's development and wellbeing
• Communicating with parents/guardians about their child's progress
• Processing enrollment applications and managing admissions
• Processing payments and managing accounts
• Complying with legal and regulatory requirements
• Emergency contact and safeguarding
• Sharing information with schools for transition purposes (with consent)
• Marketing and promotional activities (with explicit consent)
• Improving our services and website functionality

6. Who We Share Your Data With

We may share your personal data with the following parties:

• Local Authorities: For funding purposes (e.g., "beca guardería" applications) and regulatory compliance
• Healthcare Professionals: In case of medical emergencies or with parental consent
• Schools: When your child transitions to primary school (with consent)
• Payment Processors: For processing childcare vouchers (Sodexo, Cobee, Edenred, Pluxee)
• IT Service Providers: For secure data storage and website hosting (e.g., Vercel, Web3Forms)
• Professional Advisors: Lawyers, accountants, insurers (when necessary)
• Law Enforcement: When legally required or to protect children's welfare

We ensure that any third-party processors comply with GDPR and have appropriate data protection measures in place. We do not sell or rent your personal data to third parties for marketing purposes.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Enrollment Records: 3 years after your child leaves our center
• Accident/Incident Reports: Until the child turns 25 (safeguarding requirement)
• Financial Records: 6 years (Spanish tax law requirement)
• Staff Records: 4 years after employment ends
• Marketing Consent: Until consent is withdrawn, reviewed every 2 years
• Website Inquiry Data: 1 year from last contact

After these periods, data will be securely deleted or anonymized unless we are legally required to keep it longer.

8. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you or your child
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request your data in a commonly used electronic format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where consent is the legal basis
• Right to Lodge a Complaint: File a complaint with the Spanish Data Protection Authority (AEPD)

To exercise any of these rights, please contact us at hello@elpetitpanda.com. We will respond within one month of your request.

Please note that some rights may be limited if we have a legal obligation to retain data (e.g., safeguarding records, financial records).

9. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organizational measures to protect it:

• Secure encrypted servers for digital data storage
• Password-protected systems with restricted staff access
• Secure paper records stored in locked cabinets
• Regular staff training on data protection
• Secure disposal of data (shredding paper records, secure deletion of digital files)
• Regular security audits and updates

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Spanish Data Protection Authority (AEPD) within 72 hours.

10. International Data Transfers

Some of our service providers (e.g., website hosting) may process data outside the European Economic Area (EEA). When this occurs, we ensure that:

• The transfer is to a country with an adequacy decision from the European Commission, or
• Appropriate safeguards are in place (e.g., Standard Contractual Clauses)

11. Cookies and Website Analytics

Our website uses cookies to improve user experience. Cookies are small text files stored on your device. We use:

• Essential Cookies: Required for the website to function properly
• Analytics Cookies: To understand how visitors use our website (anonymized data)

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

12. Children's Personal Data

We process children's personal data only with parental consent and in accordance with our childcare obligations. We take extra care to ensure children's data is protected and only used for legitimate educational and safeguarding purposes. Parents/guardians have the right to access, rectify, or request deletion of their child's data at any time (subject to legal retention requirements).

13. Photography and Video Consent

We may take photographs and videos of children for the following purposes:

• Documenting your child's learning and development
• Internal displays within the nursery
• Marketing materials (website, social media) - requires explicit separate consent

You can withdraw consent for photography at any time. We will not use your child's full name alongside photographs on public platforms.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated "Last Updated" date. We will notify you of significant changes via email or notice at the nursery.