Moje Školka
Privacy policy
Effective from: 8. 10. 2026
1. Who we are
The controller of personal data processed in connection with the website mojeskolka.eu, orders and communication with prospects and customers is Jitka Hořavová, Company ID (IČO): 88201856, VAT ID: CZ9059046150, with its registered office at Jiráskova 436/8, 789 85 Mohelnice, Czech Republic (the "controller", "we"). Contact for personal data matters: support@mojeskolka.eu. We have not appointed a data protection officer because we have no legal duty to do so.
These principles do not cover the personal data of children, legal representatives and employees that nurseries enter into the Moje Školka service – for that data we are only a processor (see section 9).
2. What data we process, why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling enquiries and requests (contact form, e-mail, booking a demo) | name, e-mail, telephone, nursery name, message, selected time slot, language, IP address and browser identification (form protection) | performance of a contract or steps prior to it – Art. 6(1)(b) GDPR; legitimate interest in protecting the form from misuse – point (f) | for the duration of handling and then up to 3 years from the last contact (limitation period), unless a contract is concluded |
| Concluding and performing a contract with a customer (order, user accounts, support) | customer's identification and billing data, contact persons, e-mail, telephone, communication | performance of a contract – point (b) | for the duration of the contract and then as in the following rows |
| Invoicing, accounting and taxes | billing data, amounts, payments | legal obligation – point (c) | 10 years from the end of the year to which the document relates (accounting and VAT acts) |
| Security and operation of the service (security and operational logs, protection against misuse) | IP address, access time, browser type, login records, error reports | legitimate interest – point (f) | 12 months (login-attempt records 90 days), longer in justified cases (incident handling); deletion is automatic |
| Audit records of sensitive actions in the service (permission changes, deletion, platform administrator entering a nursery) | user identifier, type of action, time, IP address | legitimate interest in security and in proving the correctness of processing – point (f) | 3 years |
| Error reports and operational notices to the operator | technical data without message content; for a new enquiry the name and contact of the prospect in an internal channel | legitimate interest – point (f) | as long as necessary (internal-channel messages are deleted, at the latest within 12 months) |
| Traffic and advertising measurement (Google Analytics 4 – analytics cookies; Google Ads and Meta Pixel – marketing cookies) | online identifiers, data about the website visit | consent (cookie bar) – point (a) | depending on the tool, max. 26 months; consent can be withdrawn at any time |
| Commercial communications (news about the service to customers) | e-mail, name | legitimate interest towards customers (Section 7(3) of Act No. 480/2004 Coll.) or consent | until unsubscribed; you can unsubscribe in every message or by e-mail |
| Establishing and defending legal claims | data necessary to prove a claim | legitimate interest – point (f) | for the limitation period |
Providing data is voluntary, but without it we cannot handle an enquiry or conclude a contract. We do not carry out automated decision-making or profiling with legal effects.
3. Where we get the data
We obtain data directly from you (forms, e-mail, order, telephone) and from the technical operation of the website (cookies, server logs). We may obtain data about a customer's representatives from the customer.
4. To whom we disclose data
We disclose data only to providers that run the service for us, on the basis of a data processing agreement:
- DigitalOcean LLC – hosting of servers and databases in a data centre in Frankfurt (EU) and encrypted backups in the EU;
- Resend – sending e-mails (invitations, password reset, invoices, confirmations);
- Cloudflare, Inc. (Turnstile) – protecting forms against automated misuse (processes the IP address and technical data of the browser);
- Google Ireland Ltd. / Google LLC – Google Analytics 4 and Google Ads (only on mojeskolka.eu and only after consent to analytics or marketing cookies, respectively);
- Meta Platforms Ireland Ltd. – Meta Pixel for measuring advertising (only after consent to marketing cookies);
- Discord Inc. – an internal operations channel to which a notice of a new enquiry (name, contact, message text) is sent;
- Pexels / OpenAI – tools for creating blog content; we do not pass personal data of prospects or customers to them;
- and also accountants, tax and legal advisers and public authorities where the law requires.
Data may be transferred to the USA to providers established in the USA (Resend, Cloudflare, Discord and the parent companies of Google and Meta). This takes place only on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses under Article 46 GDPR.
5. Cookies
The use of cookies and similar technologies is described on the separate Cookies page (mojeskolka.eu/cookies). Non-essential (analytics and advertising) cookies are stored only with your consent.
6. How we protect data
Communication is encrypted (HTTPS), access is controlled by roles, administrators can use two-factor authentication, we store passwords only as a one-way hash, we back up data (backups are encrypted) and only authorised persons have access to the server. Details are in the Data Processing Agreement (technical and organisational measures).
7. Your rights
Under GDPR you have the right to:
- access your data (Art. 15) and a copy of it,
- rectification of inaccurate data (Art. 16),
- erasure ("right to be forgotten", Art. 17) unless a duty to retain the data prevails,
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interest and to direct marketing (Art. 21),
- withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal,
- lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
You can exercise your rights by e-mail at support@mojeskolka.eu. We will reply within 1 month (in complex cases the period can be extended by two months; we will always inform you). We may verify your identity before handling the request.
8. Children
The website mojeskolka.eu is intended for adults (operators of nurseries). We do not knowingly process the personal data of children outside the Moje Školka service.
9. Moje Školka as a processor of nurseries' personal data
The nurseries that use the service are controllers of the personal data of children, their legal representatives, persons authorised to collect children and their own employees. We are only the processor: we process the data solely on behalf of the nursery and according to its instructions, we do not use it for our own purposes (e.g. marketing), and the relationship is governed by a Data Processing Agreement under Article 28 GDPR.
- Where data is stored: on servers in Frankfurt am Main (EU); backups in the EU.
- After the service ends: the nursery receives an export of its data on request, we then delete the data within 30 days and copies in backups expire within a further 30 days.
- Security incident: we inform the nursery without undue delay and no later than 48 hours after we become aware of it.
- Are you a parent or an employee of a nursery? Please exercise your rights (access, rectification, erasure and others) directly with your nursery, which is the controller of your data. If you contact us, we will pass your request on to the nursery without undue delay.
10. Changes to these principles
We may update these principles. The current version is always at mojeskolka.eu/gdpr; the effective date is stated at the top. We inform customers of material changes by e-mail.