Legal documents

1. Data controller information

KIDS LIFE SKILLS a.s.b.l. ("we", "us", "our") is the data controller for personal data processed via https://www.kidslifeskills.org/.

• Entity: KIDS LIFE SKILLS a.s.b.l. (R.C.S. Luxembourg F12048)
• Registered address: 31, Rue de Remich, L-5331 Contern (Moutfort), Luxembourg
• Contact email: info@kidslifeskills.org | privacy@kidslifeskills.org

2. Personal data we collect

• Parent data: name, email, phone, secondary phone, billing address, preferred language, IP address, payment transaction logs.
• Child data: name, date of birth, gender, language levels, school year, internal identification photo (mandatory for safety rosters), attendance records.
• Health & allergy data (Art. 9 GDPR): medical conditions, allergies or special needs declared by the parent.
• Media consent data: the granular double-consent media array (capture, internal publication, print publication, social media publication), audit timestamps and actor IDs.

3. Legal bases for processing & GDPR Art. 9 health consent

• Account & booking delivery: Art. 6(1)(b) contractual necessity.
• Child health & allergy notes (Art. 9(2)(a) explicit consent): submitting allergy or medical notes requires an explicit, un-prechecked consent checkbox — "I explicitly consent to Kids Life Skills processing and retaining my child's medical/allergy information for health safety and emergency protection during activities, pursuant to Art. 9(2)(a) GDPR."
• Internal child photos: Art. 6(1)(f) legitimate interest in operational safety and identity verification.
• Marketing media (photos/videos): Art. 6(1)(a) freely revocable explicit double consent.
• Invoicing & tax records: Art. 6(1)(c) legal obligation under Luxembourg commercial law.

4. Data security, storage architecture & GDPR 72-hour breach management

All primary database records and child photo attachments are stored securely on Google Cloud Platform (GCP) infrastructure in EU regions (europe-west1 / europe-west3). Child photos are protected via short-lived V4 Signed URLs and JWT GraphQL role-based access controls.

• GDPR 72-hour data breach incident management: in the unlikely event of a personal data breach impacting user accounts or child profiles, KLS will notify the Luxembourg Data Protection Authority (CNPD) within 72 hours of discovery pursuant to Art. 33 GDPR, and inform affected account holders without undue delay where high risk is identified.

5. Data retention periods & annual health re-validation (31 July)

• Annual health data expiration (Art. 9 GDPR): to ensure medical accuracy and comply with GDPR data minimization (Art. 5(1)(c)/(d)), declared health and allergy data automatically expires at the conclusion of each academic year (31 July). Parents re-enrolling for autumn programs are presented with a mandatory digital prompt to re-validate or update medical profiles before booking. Summer camp threshold exception: if a child is enrolled in an ongoing summer camp spanning 31 July (e.g. 28 July – 2 August), their declared health profile remains active until that specific event completes before requiring re-validation.
• Active account & child data: retained continuously while the account is active, and automatically archived after 3 consecutive years of inactivity.
• Financial & invoice records: kept for 10 years as required by Luxembourg commercial tax law.

6. Email communication preferences & GDPR rights

• Operational transactional communications: mandatory operational alerts (booking receipts, emergency venue changes, password resets) are sent under Art. 6(1)(b) contractual necessity.
• Marketing communications: educational newsletters and upcoming course announcements are sent under soft opt-in (GDPR Art. 6(1)(f)) and include an instant 1-click unsubscribe link in every footer.
• Your rights under GDPR: you have the right to access, rectify, erase or port your data, as well as the right to withdraw consent. You can update or delete child health profiles at any time via your account dashboard (provided the child is not currently in an ongoing course).
• You also have the right to lodge a complaint with the Luxembourg Data Protection Authority: CNPD — Commission Nationale pour la Protection des Données, 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg (https://cnpd.public.lu/).