Your info is safe
We keep your name, class, and school information protected.
St. Stephen's Daycare
Effective April 15, 2026
Privacy.
Clear by design. Protective by default.
A clear view of how we handle family data
India-first compliance, with global rights where they apply.
Designed for the world, applied for India.
St. Stephen's Daycare collects and uses personal data only to deliver childcare and education services, protect children, communicate with parents, and meet legal obligations. We do not sell personal data, profile children for advertising, or trade family information.
Our baseline legal framework is India law (including the Digital Personal Data Protection Act, 2023 and applicable Information Technology rules). Where context requires, we operationalize additional protections aligned to GDPR and Quebec Law 25 (formerly Bill 64).
Privacy decisions for child data are parent-governed, safety-led, and documented with clear retention timelines and request-handling workflows.
0. For Young Learners (Ages 4–7)
A SIMPLE PRIVACY PROMISE
Grown-ups decide
Parents or guardians choose what can be shared.
No ad tracking
We do not use your data to follow you around the internet with ads.
Ask for help
If anything online feels confusing, ask your parent, guardian, or teacher.
1. Data We Collect
Only what is needed for childcare operations and legal compliance.
- Identity and contact data: Parent/guardian name, mobile number, email address, address, emergency contacts, and child identity details required for admission and pickup authorization.
- Childcare and safety data: Attendance, allergy and medical alerts, vaccination declarations provided by parents, authorized pickup records, and incident logs.
- Financial and transaction data: Fee plans, invoices, payment references, and reconciliation metadata (we do not store raw card credentials on school systems).
- Portal and device data: Authentication logs, security events, device/browser metadata, and limited diagnostics to keep parent/admin access secure.
- Premises security data: CCTV footage in controlled zones for child safety and facility security, retained for a limited period unless required for an active investigation.
2. Why We Use Data
Purpose limitation applies to every category.
- Service delivery: To process admission requests, run classes, communicate schedules, and operate the parent portal.
- Child protection and health: To manage emergency contacts, medical alerts, pickup controls, and campus safety.
- Contract and billing: To issue invoices, confirm payments, and manage account status.
- Regulatory obligations: To maintain records required by competent education, health, taxation, or law-enforcement authorities.
- Security and abuse prevention: To detect unauthorized access, fraud, and operational misuse.
3. How We Protect Data
Technical, organizational, and contractual controls.
- Access control: Role-based access with least-privilege enforcement for teaching, admin, and operations functions.
- Encryption: Sensitive records are encrypted in transit and at rest. Confidential child/parent fields are protected with additional application-level controls.
- Authentication safeguards: Admin and parent flows use hardened session controls, cookie protections, OTP/passkey flows where enabled, and audit logging.
- Vendor controls: Service providers are bound by contractual data-protection obligations and are reviewed for security posture.
- Incident response: Security events are triaged with documented escalation, containment, and remediation procedures.
5. Retention and Deletion
Retention schedules follow legal and operational need.
- Enrollment lifecycle: Core student records are retained through active enrollment and for post-exit periods required by law or dispute-management needs.
- Security logs and CCTV: Retained for defined windows unless a legal hold or incident investigation requires longer preservation.
- Deletion standard: Once retention obligations expire, records are securely deleted, anonymized, or irreversibly de-identified.
6. Children's Data and Parent Controls
PARENT-GOVERNED DATA MANAGEMENT
- Parent authority model: We process child-related data based on parent/guardian authority and school safety obligations.
- Sensitive handling: Child identifiers, health notes, and pickup controls are handled with heightened access restrictions.
- Media controls: Photo/video processing for non-essential uses is governed by school consent settings and can be revised by parents where policy permits.
- No behavioral advertising: We do not run child-targeted ad profiling or cross-context behavioral advertising.
7. Data Location and Cross-Border Handling
TRANSFER GOVERNANCE
- Primary operational posture: Data is managed in controlled environments with access and processing governance defined by the school.
- Processor infrastructure: Some technology providers may process or store data in multiple jurisdictions under contractual safeguards.
- Transfer controls: Where cross-border handling is relevant, we apply contractual and technical controls aligned with applicable legal requirements.
- Lawful requests: Government or authority disclosures are limited to valid legal process and documented necessity.
8. Lawful Basis, Consent, and Notice Controls
LEGAL BASIS DISCIPLINE
- Purpose-specific notices: We provide clear notices at collection points for admissions, portal access, payments, and support channels.
- Consent discipline: Consent is requested where required and can be withdrawn for non-essential processing without affecting core safety operations.
- Contract and legal basis: Core childcare, billing, and compliance activities are processed on lawful grounds tied to service delivery and statutory obligations.
- Change management: If processing purpose materially changes, we update notice content, consent controls (where relevant), and effective-date versioning.
9. Privacy Rights and Request Handling
Parents and guardians can request access, correction, deletion, consent withdrawal (where applicable), and complaint review. We verify identity before processing requests.
Contact the Compliance Office
compliance@ststephensdaycare.comIndia (DPDP)
Access and correction requests, withdrawal of consent where consent is the legal basis, grievance escalation, and nomination rights as applicable.
GDPR-aligned controls (where required)
Access, rectification, erasure, restriction, portability, objection, and complaint to a competent supervisory authority.
Quebec Law 25-aligned controls (where required)
Information rights, de-indexation request handling, and transparent explanation of automated decision use (if any).
Response standards
We acknowledge requests promptly, verify identity, and respond within applicable legal timelines or a communicated extension period.