• +36 30 231 81 81
Instagram
Facebook

Privacy Policy

1. INTRODUCTION AND BASIC INFORMATION

1.1 Data Controller Identification

Name: Under the Rainbow Kindergarten and Nursery
Operator: Feketerigó Foundation
Registered address: 3 Gesztenyés street, Tárnok, H-2461
Tax number: 18149526-1-13
Registration number: AM-3224
Phone: +36 30 231 81 81
Email: info@undertherainbow.hu
Website: www.undertherainbow.hu
Data Protection Contact: Parraginé Ébel Emese
Email: info@undertherainbow.hu

1.2 Locations

• Levél street: 1023 Budapest, Levél street [number] – Tel: +36 30 231 81 81
• Torockó street: 1026 Budapest, Torockó street [number] – Tel: +36 30 231 81 81
• Feketerigó street: 1029 Budapest, Feketerigó street 20. – Tel: +36 30 231 81 81

1.3 Legal Background

Our institutions are run by Feketerigó Foundation according to the Hungarian Educational Law.

This Privacy Policy has been developed in accordance with the following legislation:

  • EU Regulation 2016/679 (General Data Protection Regulation – GDPR)
  • Act CXII of 2011 on the right to informational self-determination and freedom of information (Hungarian Info Act)
  • Act CXC of 2011 on national public education
  • Government Decree 77/2025 (IV. 15.) on the National Core Programme for Kindergarten Education
  • EMMI Decree 20/2012 (VIII. 31.) on the operation of educational institutions

2. PERSONAL DATA PROCESSED AND PURPOSE OF DATA PROCESSING

2.1 Children’s Personal Data

A) Mandatory processed data (legal basis):

  • Identification data: full name, place and date of birth, mother’s name, address, place of residence
  • Social security number, ID card/passport number
  • Parents’/guardians’ names and contact details
  • Health data: vaccination records, chronic diseases, allergies, medication
  • Dietary requirements and dietary restrictions
  • Development diary and pedagogical observations
  • Attendance records

Legal basis: GDPR Article 6(1)(c) – compliance with legal obligation
Purpose: Legal provision of kindergarten education, protection of child safety and health

B) Data processing based on consent:

  • Photos and video recordings from kindergarten events
  • Social media content (website, Facebook, Instagram)
  • Marketing and communication purposes

Legal basis: GDPR Article 6(1)(a) – data subject’s consent
Purpose: Documentation of kindergarten life, parental information, institutional presentation

2.2 Parents’/Guardians’ Personal Data

Processed data:

  • Identification data: name, address, place of residence
  • Contact details: phone number, email address
  • Occupation, workplace contact details
  • Emergency contact details
  • Financial data: bank account number (for kindergarten fee payment)

Legal basis: GDPR Article 6(1)(b) – performance of contract and (c) – legal obligation
Purpose: Communication, information, kindergarten fee management, emergency contact

2.3 Employee Personal Data

Processed data: Data required by labor law and pedagogical legislation
Legal basis: Employment contract performance and legal obligations
Separate employee information applies to them

3. DATA RETENTION PERIOD

3.1 Children’s Data

  • Kindergarten documentation: 5 years following the termination of the child’s kindergarten relationship
  • Health documentation: Period determined by law
  • Photos/videos: Until consent is withdrawn, but maximum until the child reaches 18 years of age

3.2 Parents’ Data

  • Contact details: 3 years following the termination of the child’s kindergarten relationship
  • Financial records: 8 years according to law

3.3 Website Data Processing

  • Contact details: 30 days after providing information, 5 years in case of legal enforcement
  • Cookie data: 1-24 months depending on cookie type

4. DATA SECURITY AND STORAGE

4.1 Technical Measures

  • Physical protection: Lockable cabinets, alarm-protected buildings
  • IT protection: Password-protected devices, regular security backups
  • Encryption: Encryption of data stored on portable devices
  • Access control: Only authorized persons can access the data

4.2 Organizational Measures

  • Staff training: Regular data protection training
  • Internal regulations: Data processing procedures
  • Responsibility clarification: Clear definition of roles

5. DATA TRANSFER AND DATA PROCESSING

5.1 Mandatory Data Transfer
Recipients:

  • Educational Office – based on legal obligation
  • NÉBIH – food-related inspections
  • Health authorities – epidemiological measures
  • Child protection authority – in case of child protection notification
  • Law enforcement agencies – in case of suspected crime

5.2 Data Processors

  • Accounting service provider: [name] – financial records
  • IT service provider: Code and Soda Kft – technical maintenance
  • Website service provider: Code and Soda Kft – website operation
  • Health service provider: RMC – screening examinations

We conclude written contracts with all data processors in accordance with GDPR requirements.

6. RIGHTS OF DATA SUBJECTS

6.1 Right of Access

Entitled: Parents regarding their own and their child’s data
Exercise: Written request to info@undertherainbow.hu
Fulfillment: Within 1 month of receiving the request, free of charge

6.2 Right to Rectification

Purpose: Correction of inaccurate or incomplete data
Exercise: Verbal or written notification
Obligation: We correct incorrect data immediately

6.3 Right to Erasure (“Right to be forgotten”)

Conditions:

  • Withdrawal of consent
  • Unlawful data processing
  • Data no longer needed for the original purpose

Limitation: Not applicable in case of legal obligation

6.4 Right to Restriction of Processing

Application cases:

  • When accuracy of data is contested
  • Unlawful processing but no deletion requested
  • Data no longer needed but required by data subject for legal claims

6.5 Right to Data Portability

Condition: Data processing based on consent or contract
Format: Structured, machine-readable format

6.6 Right to Object

Exercise: In special situations, based on individual circumstances
Effect: Termination of data processing, except for compelling legitimate grounds

7. CONSENT MANAGEMENT

7.1 Giving Consent

  • Based on clear, voluntary, specific and informed decision
  • In writing with precise specification of data processing purposes
  • Separate consent for each different purpose

7.2 Withdrawal of Consent

Method:

  • Written notification to info@undertherainbow.hu
  • Verbal notification to location manager, confirmed in writing

Effect: Valid from the time of withdrawal, does not affect previous lawful data processing

7.3 Children’s Consent

Under 16 years: Parental consent required
Over 16 years: Own consent also possible

8. WEBSITE DATA PROCESSING

8.1 Automatic Data Collection

Technical data:

  • IP address, browser type, operating system
  • Visit time, viewed pages
  • Referrer page

Legal basis: Legitimate interest (website operation, security)
Retention: 12 months

8.2 Use of Cookies

A) Strictly necessary cookies:

  • Session identifier – maintaining login
  • Security cookies – protection against malicious activity
  • Load balancer cookie – optimal server selection

Legal basis: Legitimate interest
Consent: Not required

B) Functional cookies:

  • Language settings memory
  • User preferences storage

Legal basis: Consent
Retention: 12 months

C) Analytics cookies:

  • Google Analytics – visitor statistics
  • Anonymous data collection, IP address shortened

Legal basis: Consent
Retention: 26 months

8.3 Cookie Settings

Management: Can be modified in browser settings
Information: Cookie banner appears on first visit
Choice: Only strictly necessary cookies are mandatory

8.4 Contact Form

Processed data:

  • Name, email address, phone number (optional)
  • Message content, sending time

Purpose: Responding to inquiries, providing information
Retention: 30 days after providing response, or 5 years in case of legal enforcement

9. SOCIAL MEDIA AND MARKETING

9.1 Facebook Page

Operation: Closed Facebook group for parents
Data processing: According to Facebook’s privacy policy
UTR responsibility: Moderation of published content
Attention: Inquiries made on Facebook page do not constitute official complaints!

9.2 Instagram Page

Operation: Under the Rainbow Kindergarten and Nursery official Instagram account
Content: Presentation of kindergarten life, event documentation
Data processing: According to Instagram’s (Meta) privacy policy
UTR responsibility: Moderation and management of published content
Attention: Inquiries made on Instagram page do not constitute official complaints!

9.3 Photos and Videos

Purpose of creation:

  • Documentation of kindergarten life
  • Parental information
  • Institutional promotion

Places of use:

  • UTR website
  • Facebook page
  • Instagram page
  • Promotional materials
  • Media appearances

Legal basis: Parental consent
Revocability: Anytime, free of charge

9.4 Newsletter (if relevant)

Content: Kindergarten news, events, useful information
Frequency: Monthly or event-related
Unsubscribe: Link available in every email

10. DATA PROTECTION INCIDENTS

10.1 Types of Incidents

  • Unauthorized access to personal data
  • Data loss or data breach
  • Unauthorized modification of data
  • Unauthorized access to systems

10.2 Action Protocol

Within 72 hours:

  • Notification to NAIH (National Authority for Data Protection and Freedom of Information)
  • Documentation of incident and cause investigation

Immediately:

  • Notification of affected persons (if high risk)
  • Implementation of damage mitigation measures
  • Introduction of preventive measures

11. COMPLAINT HANDLING AND REMEDIES

11.1 Internal Complaint Handling

Complaint addressee: info@undertherainbow.hu or location manager
Response time: 15 working days
Form of complaint: Written or verbal (subsequently recorded in writing)

11.2 External Remedies

Supervisory authority: National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa street 9-11.
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Court proceedings: Possibility to turn to administrative court

12. DATA PROTECTION OFFICER

Based on Under the Rainbow Kindergarten and Nursery’s size and activities, it is not required to appoint a data protection officer, however we have appointed a data protection contact:
Contact: Parraginé Ébel Emese
Email: info@undertherainbow.hu
Tasks: Coordination of data protection issues, information provision

13. OTHER PROVISIONS

13.1 Modification of Information

Right: UTR reserves the right to modify the information
Notification: We inform about significant changes by email and on the website
Entry into force: 15 days after publication

13.2 Applicable Law

Governing law: Hungarian law and EU legislation
Legal disputes: Fall under the jurisdiction of Hungarian courts

13.3 Languages

Original version: English language
Translations: In case of discrepancy, the English text shall prevail

14. CONTACT

All data protection questions:
Email: info@undertherainbow.hu
Phone: +36 30 231 81 81
Location contacts:

  • Levél street: [name], +36 30 231 81 81
  • Torockó street: [name], +36 30 231 81 81
  • Feketerigó street: [name], +36 30 231 81 81

15. ENTRY INTO FORCE

This Privacy Policy enters into force: January 1, 2025
Previous version expires: December 31, 2024
Review: Annually or upon legal changes

Last modification: January 1, 2025
Next review due: January 1, 2026

This privacy policy is available on the Under the Rainbow Kindergarten and Nursery website (www.undertherainbow.hu) and at all locations. A printed version can be requested from location managers.

Under the Rainbow Kindergarten and Nursery – Where learning happens through play