Account and Data Deletion

Send a deletion request by e-mail to contact@kidy.pro, from the e-mail address with which you registered in the application.

So that we can identify and process the request, include in your message:

• the subject line “Kidy account deletion request”;
• the first and last name from your Kidy account;
• the e-mail address associated with the account;
• the name of the institution (the kindergarten, school or after-school programme) through which you use the application, if you know it.

We do not ask you for your password and we will never ask you for it. If we cannot confirm that the request comes from the account holder, we will ask you for additional confirmation before deleting any data.

Kidy is a platform used by kindergartens, schools and after-school programmes. For children's data and for the attendance, invoicing and communication data relating to the institution's activity, the institution is the data controller and Kidy acts as a processor, on the institution's instructions.

In practice, this means:

• We can delete your personal user account and the data that belongs directly to you, upon your simple request.
• The data of the child enrolled at the institution (attendance, group, documents, history) cannot be deleted unilaterally by Kidy, because it does not belong to us. The request must be addressed to the institution, which sends us the deletion instruction. We can forward your request to the institution if you ask us to do so.

If you are an administrator of an institution and you wish to delete the entire organisation account, state this explicitly in the request.

When processing the request, we delete or anonymise:

• account data: first name, last name, e-mail address, telephone number, profile photo;
• authentication credentials and all active sessions;
• push notification tokens (Firebase Cloud Messaging) associated with your devices;
• usage preferences and in-app settings;
• messages sent through the platform, to the extent that they are not part of an institution conversation that the institution is required to retain;
• time-clock records and check-in coordinates, if you are a member of staff and the institution has no legal obligation to retain them as a record of working time.

Once deleted, this data can no longer be recovered.

Certain data cannot be deleted immediately, because we have a legal obligation to retain it:

• Financial documents (invoices, receipts, payment records) — 10 years from the end of the financial year, in accordance with Romanian accounting and tax legislation (Romanian Accounting Law no. 82/1991). Basis: legal obligation, art. 6(1)(c) GDPR.
• Security and access logs (IP address, time of authentication) — 12 months, for fraud prevention and the investigation of security incidents. Basis: legitimate interest, art. 6(1)(f) GDPR.
• The record of your deletion request — so that we can demonstrate that we acted upon the request, in accordance with the accountability obligation under art. 5(2) GDPR.
• Data that the institution has a legal obligation to archive (for example school attendance records) — in accordance with the periods established by the legislation applicable to the institution.

Data retained on these grounds is restricted: it is no longer used for providing the service, but only for fulfilling the obligation that justifies it, and it is deleted when the period expires.

• Confirmation of receipt of the request: within a maximum of 72 working hours.
• Actual processing: within a maximum of 30 days from receipt of the request, in accordance with art. 12(3) GDPR. In complex cases, the period may be extended by a further two months, in which case we will inform you of the reason for the delay within the first 30 days.
• Deletion from backup copies: up to 90 days, as the encrypted backups are rotated in accordance with the retention policy. During this interval the data in the backups is not operationally accessible.

We will send you a written confirmation once the deletion has been completed.

Before permanently deleting your account, consider the following options:

• Disabling notifications — you can turn off push notifications and e-mails from Settings → Notifications, while keeping the account active.
• Data export — you can request your data in a structured, commonly used and machine-readable format (the right to portability, art. 20 GDPR), before deletion.
• Rectification of data — if the problem is incorrect information, you can correct it from Settings → Profile or you can ask us to correct it.

In addition to the right to erasure (art. 17 GDPR), you have the right of access, rectification, restriction of processing, portability and objection. Full details can be found in the Privacy Policy.

If you consider that we have not properly acted upon your request, you have the right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the Romanian National Supervisory Authority for Personal Data Processing) — www.dataprotection.ro.

Controller: 2Lines Sistem SRL, CUI RO16807695, Reg. Com. J2004001481239, Str. Fizicienilor nr. 19/1, 077125 Măgurele, Ilfov County, Romania.

E-mail for requests concerning personal data: contact@kidy.pro