Legal documents

1. Data controller information

KIDS LIFE SKILLS a.s.b.l. ("we", "us", "our") is the data controller for personal data processed via https://www.kidslifeskills.org/.

• Entity: KIDS LIFE SKILLS a.s.b.l. (R.C.S. Luxembourg F12048)
• Registered address: 31, Rue de Remich, L-5331 Contern (Moutfort), Luxembourg
• Contact email: info@kidslifeskills.org | privacy@kidslifeskills.org

2. Personal data we collect

• Parent data: name, email, phone, secondary phone, billing address, preferred language, IP address, payment transaction logs.
• Child data: name, date of birth, gender, language levels, school year, internal identification photo (mandatory for safety rosters), attendance records.
• Health & allergy data (Art. 9 GDPR): medical conditions, allergies or special needs declared by the parent.
• Media consent data: the granular double-consent media array (capture, internal publication, print publication, social media publication), audit timestamps and actor IDs.
• Financial-support application data (only if you apply): household size (adults and children under 18), the declared income band or FNS attestation type, the children and courses concerned, uploaded supporting documents (tax assessments, payslips, certificates, attestations), your declaration (typed name, date, text version) and any optional note — see section 7.
• Device rental data (only if you book one): the child, the school year, the price, the payment reference and the rental status — see section 7.

3. Legal bases for processing & GDPR Art. 9 health consent

• Account & booking delivery: Art. 6(1)(b) contractual necessity.
• Child health & allergy notes (Art. 9(2)(a) explicit consent): submitting allergy or medical notes requires an explicit, un-prechecked consent checkbox — "I explicitly consent to Kids Life Skills processing and retaining my child's medical/allergy information for health safety and emergency protection during activities, pursuant to Art. 9(2)(a) GDPR."
• Internal child photos: Art. 6(1)(f) legitimate interest in operational safety and identity verification.
• Marketing media (photos/videos): Art. 6(1)(a) freely revocable explicit double consent.
• Invoicing & tax records: Art. 6(1)(c) legal obligation under Luxembourg law (accounting rules for non-profit associations).
• Financial-support applications: Art. 6(1)(b) contractual necessity (a service you requested) and Art. 6(1)(f) legitimate interest in checking that financial support goes to households that qualify — not your consent (see section 7).
• Financial-support decisions, amounts paid and device-rental payments: Art. 6(1)(c) legal obligation — Luxembourg accounting rules for non-profit associations (10-year retention, see sections 5 and 7).

4. Data security, storage architecture & GDPR 72-hour breach management

All primary database records and child photo attachments are stored securely on Google Cloud Platform (GCP) infrastructure in EU regions (europe-west1 / europe-west3). Child photos are protected via short-lived V4 Signed URLs and JWT GraphQL role-based access controls.

• GDPR 72-hour data breach incident management: in the unlikely event of a personal data breach impacting user accounts or child profiles, Kids Life Skills will notify the Luxembourg Data Protection Authority (CNPD) within 72 hours of discovery pursuant to Art. 33 GDPR, and inform affected account holders without undue delay where high risk is identified.

5. Data retention periods & annual health re-validation (31 July)

• Annual health data expiration (Art. 9 GDPR): to ensure medical accuracy and comply with GDPR data minimization (Art. 5(1)(c)/(d)), declared health and allergy data automatically expires at the conclusion of each academic year (31 July). Parents re-enrolling for autumn programs are presented with a mandatory digital prompt to re-validate or update medical profiles before booking. Summer camp threshold exception: if a child is enrolled in an ongoing summer camp spanning 31 July (e.g. 28 July – 2 August), their declared health profile remains active until that specific event completes before requiring re-validation.
• Active account & child data: retained continuously while the account is active, and automatically archived after 3 consecutive years of inactivity.
• Financial & invoice records: kept for 10 years as Luxembourg law requires for a non-profit's accounts.
• Financial support & device rental: uploaded documents are deleted within 30 days of the final decision; the income band or FNS attestation type and any free-text notes are removed 12 months after the end of the school year concerned; the decision, the tier, the amounts paid and your declaration are kept for 10 years with our accounting records, as are device-rental payments — details in section 7.

6. Email communication preferences & GDPR rights

• Operational transactional communications: mandatory operational alerts (booking receipts, emergency venue changes, password resets) are sent under Art. 6(1)(b) contractual necessity.
• Marketing communications: educational newsletters and upcoming course announcements are sent under soft opt-in (GDPR Art. 6(1)(f)) and include an instant 1-click unsubscribe link in every footer.
• Your rights under GDPR: you have the right to access, rectify, erase or port your data, as well as the right to withdraw consent. You can update or delete child health profiles at any time via your account dashboard (provided the child is not currently in an ongoing course).
• You also have the right to lodge a complaint with the Luxembourg Data Protection Authority: CNPD — Commission Nationale pour la Protection des Données, 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg (https://cnpd.public.lu/).

7. Financial support & device rental

If you apply for financial support (towards course fees and, where offered, towards the device-rental price), we process additional information about your household. We use it to provide the service you asked for (assessing and administering your financial support), and because Kids Life Skills has a legitimate interest in checking that financial support goes to households that qualify — Art. 6(1)(b) and Art. 6(1)(f) GDPR. We do not rely on your consent for this processing.

• What we collect: the number of adults and children in your household; the income band you declare, or the type of FNS attestation you hold (e.g. REVIS or allocation de vie chère); the children and the courses or registrations your application concerns; the documents you upload (tax assessments, payslips, certificates, attestations); your declaration (the name you type, the date and the version of the declaration text); and any optional note you add. If you book a device rental, we also record the child, the school year, the price (including any financial support applied), how you paid and the rental's status.
• Who can see your information: only Kids Life Skills administrators handling financial-support applications. Every time someone views your documents, that is logged, and opening a document requires the administrator to re-confirm their password shortly beforehand. We do not share your application, your documents or your income details with anyone outside Kids Life Skills.
• Reporting to funders is aggregate only: public funders who support the programme receive anonymous statistics per school year — the number of supported households and registrations per tier, and the total amount of support granted — never names and never anything about an individual application. Any figure that would cover fewer than 3 households is withheld.
• Retention — documents: any documents you send us (tax assessments, payslips, certificates, attestations) are deleted within 30 days of your final decision, whatever that decision is (approved, declined, withdrawn or expired). Copies in our technical backups are erased on the backup system's normal rotation schedule.
• Retention — assessment details: the income band you were assessed in (or the type of FNS attestation you provided), and any free-text notes — including notes added by our staff — are removed 12 months after the end of that school year.
• Retention — the decision and payments: the decision itself (approved or declined, the tier, and the prices you paid) is kept for 10 years together with the accounting records of Kids Life Skills, as Luxembourg law requires for a non-profit's accounts, counted from the end of the financial year concerned. The same record keeps your household size, the children the decision covered and your declaration (name, date, text version). Device-rental bookings and payments are kept for the same 10 years as accounting records. If you delete your Kids Life Skills account, these records are kept for their legal term and anonymised where possible.
• Emails we send you about a financial-support application never contain your income details, your income band or the contents of your documents — at most the names of the document types we ask for.
• Your rights: you can ask to see, correct, or — where the law allows — delete your information at any time. Contact privacy@kidslifeskills.org to exercise your rights (see also section 6).