Last Updated: September 10, 2026 

ChildDiary (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal data processed through our digital platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, as well as your rights under the General Data Protection Regulation (GDPR). 

1. Data Roles: Controller vs. Processor 

Under the GDPR: 

● The Childcare Provider (the "Customer" or "Setting"): Acts as the Data Controller for personal data and sensitive content related to registered children, guardians, and staff. The Controller determines the purposes and legal bases for processing this data. 

● ChildDiary: Acts as the Data Processor. We process personal data solely on behalf of, and in accordance with the documented instructions of, the Data Controller, or as required by applicable EU/Member State law. 

● Direct Platform Users / Website Visitors: For account creation, direct customer support, and website navigation, ChildDiary acts as a Data Controller for basic contact and usage details. 

2. Nature and Purpose of Processing 

● Nature: Provision of a digital platform for childcare management, enabling the digital capture of learning journals, daily routines, and pedagogical documentation. ● Purpose: 

● To enable childcare providers to document children’s progress, record daily routines, and conduct pedagogical assessments. 

● To facilitate parent-teacher communication and increase parental involvement securely. 

● To manage attendance and maintain operational readiness for regulatory inspections. 

● To respond to technical support requests and deliver platform services.

3. Categories of Data Subjects & Personal Data Processed A. 

Data Subjects

● Staff / Employees of the childcare provider. 

● Guardians and Parents. 

● Children enrolled at the childcare center. 

B. Categories of Personal Data 

● Standard Personal Data: Names, addresses, emails, phone numbers, and childcare provider details. 

● Technical & Usage Data: Referring/exit URLs, browser types, operating systems, date/time stamps, and platform navigation metrics. 

C. Special Category (Sensitive) Data 

Due to the nature of early childhood care, the platform processes special categories of personal data relating to children, including: 

● Photographs and videos. 

● Daily routine observations (e.g., meals, rest times, activity logs). 

● Pedagogical assessments and learning journals. 

Note: In accordance with our terms and platform design, all child-related content is treated as highly sensitive data and protected with heightened security controls. 

4. Cookie Policy & Web Tracking 

ChildDiary uses cookies and similar technologies to maintain platform security and analyze usage. 

● Authentication Cookies (Strictly Necessary): Functional session cookies required to authenticate active users, keep sessions secure, and enable core system operations. These cookies do not store personal data for tracking purposes and do not require prior user consent under applicable law. 

● Google Analytics (Performance & Analytics): We utilize Google Analytics integrated with Google Consent Mode v2 to evaluate platform interaction, system performance, and aggregate user engagement. 

○ Default Consent State: All non-essential analytics signals (analytics_storage) are set to denied by default. No tracking cookies or non-essential analytics data are stored on your device prior to your explicit consent.

5. Lawful Bases for Processing (Articles 6 & 9 GDPR) 

● Contract Performance (Art. 6(1)(b)): Processing necessary to fulfill our service agreement with the childcare provider or respond to technical support inquiries. ● Legitimate Interests (Art. 6(1)(f)): Improving application stability, optimizing platform user experience, and preventing unauthorized system access. 

● Explicit Consent / Legal Mandate (Art. 6(1)(a) & Art. 9(2)(a)): For special category child data (assessments, observations, photos/videos), the Data Controller (Childcare Provider) is responsible for securing explicit consent from parents/guardians prior to uploading content to ChildDiary. 

6. Sub-Processors and Data Transfers (Article 28(2) GDPR) 

ChildDiary engages trusted third-party vendors (sub-processors) to deliver platform services. In compliance with Article 28(2) of the GDPR, ChildDiary confirms that appropriate Data Processing Agreements (DPAs) are in place with all sub-processors. These agreements bind our vendors to data protection obligations equivalent to those set out in our agreement with Data Controllers, specifically providing sufficient guarantees to implement appropriate technical and organizational measures. 

Our primary sub-processors and their processing locations are: 

1. Microsoft Azure: Core application hosting and data storage. Location: Europe-based data centers (ensuring strict EU data residency compliance). 

2. Amazon Web Services (AWS): Communication infrastructure vendor used to manage and securely transmit platform email communications. Location: Processed and hosted within EU data centers ensuring strict compliance with EU data residency rules.. 

3. Freshdesk: Customer support and ticketing tool used to manage technical support requests efficiently. Location: Stored and processed within EU data centers ensuring strict compliance with EU data residency rules.. 

4. Moloni: Utilized as our integrated billing and invoicing engine to allow childcare providers to issue invoices and manage billing statements for parents/guardians. Location: Stored and processed within EU-based data centers ensuring strict compliance with EU data residency rules. 

International Transfer Safeguards: Core sub-processors process data within the European Economic Area (EEA). Should emergency vendor support require secondary access outside the EEA, transfers are governed by EU Standard Contractual Clauses (SCCs) to maintain

GDPR-equivalent protection. 

Sub-Processor Modifications: In accordance with Article 28(2) GDPR, ChildDiary will notify Data Controllers (Childcare Providers) at least thirty (30) days in advance of any intended additions or replacements of sub-processors. Data Controllers have the right to object to such changes on reasonable data protection grounds prior to vendor deployment. 

7. Technical and Organisational Security Measures & Assumption of Risk 

We implement robust technical and organizational protections designed to safeguard data against unauthorized access, loss, or disclosure: 

● Encryption: Secure Socket Layer (SSL) technology for data in transit and encryption for data at rest. 

● Access Control: Role-based access controls (RBAC), secure password-protected accounts, and internal access protocols. 

● Infrastructure Security: Secure server environments protected by firewalls and hosted within certified, industry-leading cloud centers. 

8. Automated Decision-Making & Profiling 

ChildDiary does not employ automated decision-making or profiling algorithms to evaluate users, process child data, or make decisions that produce legal or significantly impactful effects on data subjects. 

9. Marketing & Promotional Communications 

We may occasionally use personal information provided directly by registered account administrators to communicate news, updates, or promotional offers regarding ChildDiary services. 

● Opt-Out Mechanism: Users can opt out of receiving promotional communications at any time by clicking the "unsubscribe" link provided in promotional emails or by contacting support. Service-related system notifications (e.g., password resets, security alerts) are mandatory and exempt from promotional opt-out rules. 

10. Data Retention, Archiving & Backup Lifecycle 

● Duration: Personal data is processed and retained for the duration of the service agreement with the Data Controller. 

● Inactive Accounts: Accounts are deemed inactive after 12 months of continuous non-activity, at which point ChildDiary will contact the account holder. 

● Archiving & Deletion Tools: Childcare Providers (Controllers) are provided with built-in

tools within the platform to archive or delete child profiles and associated records in accordance with their own specific data retention policies. 

● Backup Persistence: When an account or record is deleted by the Data Controller, residual encrypted copies persist in access-restricted system backups for a maximum lifecycle of 90 days, after which they are permanently overwritten and purged. 

11. Third-Party Links 

This Privacy Policy applies solely to information processed by ChildDiary. The platform or website may contain links to third-party sites not owned or controlled by ChildDiary. We are not responsible for the privacy practices of external websites and encourage users to review their respective policies. 

12. Your Data Protection Rights & Age of Consent 

Under the GDPR, individual users, staff, parents, and legal guardians have the right to: 

1. Access: Request confirmation as to whether personal data is being processed and obtain a copy. 

2. Rectification: Request correction of inaccurate or incomplete personal data. 3. Erasure ("Right to be Forgotten"): Request deletion of personal data where processing is no longer necessary or lawful. 

4. Restriction of Processing: Request temporary restriction of data processing in specified circumstances. 

5. Data Portability: Receive personal data in a structured, commonly used, machine-readable format. 

6. Object: Object to processing based on legitimate interests or direct marketing.

7. Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. 

Age of Consent: Digital consent for children under the legal age of digital consent (ranging from 13 to 16 years across EU Member States) must be granted or authorized by a holder of parental responsibility. 

Response Timelines: In accordance with Article 12(3) GDPR, ChildDiary will acknowledge and address all valid data subject requests without undue delay and at the latest within one (1) month of receipt. This period may be extended by two additional months where necessary, taking into account request complexity and volume, provided you are notified of the extension within the initial month. 

Note for Parents & Guardians: Because child profiles and related activity are managed under the direction of your childcare provider (Data Controller), requests regarding child records

should be directed to your childcare center first. ChildDiary will assist the provider in fulfilling these requests. 

13. Corporate Transactions & Business Transfers 

In the event that ChildDiary undergoes a business transition, such as a merger, acquisition, or sale of all or a portion of its assets, personal data may be among the transferred assets, subject to the acquiring entity adhering to privacy protections equivalent to those set forth in this policy. 

14. Contact Information & Regulatory Authorities 

If you have questions, concerns, or requests regarding this Privacy Policy or ChildDiary's data handling practices, please contact us: 

● Data Processor Contact: 

○ Email: dpo@childdiary.net 

○ Legal Entity: ChildDiary Portugal Lda 

○ VAT/Fiscal ID: 515 355 054 

Supervisory Authority: You have the right to lodge a complaint with the primary Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados - CNPD, www.cnpd.pt) or your local EU Member State supervisory authority if you believe our processing breaches applicable law.