Privacy Statement
Version 1.0 · Effective date: 26 October 2026
We collect only what we need to look after children safely at events, and we delete children's details shortly after each event. This statement explains what we collect, why, how long we keep it and what your rights are under the GDPR (AVG).
1. Who we are
Event Childcare is a trade name of Davis Tech Transfer Consultancy, KvK 42052686. We are the controller for the personal data described here.
- Privacy contact: Raissa Davis, info@eventchildcare.nl
- We have not appointed a Data Protection Officer, as the law does not require one for an organisation of our size and type.
2. Whose data we process
- Children who attend our childcare at an event.
- Parents, guardians and Authorised adults who register, drop off or collect a child.
- Contact persons at Client organisations that book us.
- Website visitors and people who contact us.
We register children and parents ourselves, independently of the event organiser. Our sitters' data is covered by a separate staff privacy notice.
3. What we collect
About children: first and last name, age (not date of birth), languages spoken, allergies, dietary needs, medical conditions or support needs relevant to safe care, check-in and check-out times, and incident notes if something happens.
About parents and Authorised adults: name, mobile number, email address, relationship to the child, a second emergency contact, names of Authorised adults, and your consent choices.
About Client contacts: name, job title, organisation, work email and phone, booking and invoicing details.
From the website: what you type in our contact or registration forms, and basic technical data needed to run the site securely.
We never ask for a citizen service number (BSN), copies of identity documents or bank details from parents.
4. Why we use your data, on what legal basis, and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering enquiries and preparing quotations | Client contact details | Steps before a contract (art. 6(1)(b)) | 12 months after last contact if no booking follows |
| Performing bookings and invoicing Clients | Client contact and booking details | Contract (6(1)(b)); legal obligation (6(1)(c)) | 7 years (Dutch tax retention rules) |
| Registering children, check-in, collection and contacting parents during the event | Child and parent details, Authorised adults, attendance times | Legitimate interest in providing safe care on the Client's behalf (6(1)(f)) | Deleted within 30 days after the event |
| Allergies, medical and support needs | Child's health information | Parent's explicit consent (6(1)(a) and 9(2)(a)); in an emergency, vital interests (6(1)(d) and 9(2)(c)) | Deleted within 7 days after the event |
| Recording and handling incidents and safeguarding concerns | Incident notes, child and parent details | Legitimate interest (6(1)(f)); legal claims (9(2)(f)); legal obligation where the reporting code applies | As long as needed to handle the matter and possible claims, reviewed yearly |
| Feedback after an event | Survey answers | Legitimate interest (6(1)(f)) | 2 years, then deleted or anonymised |
| Photos or testimonials for our website and social media | Images, first name, quote | Consent (6(1)(a)) | Until consent is withdrawn; reviewed every 2 years |
| Service updates to Client contacts | Work email | Legitimate interest for existing Clients, with an opt-out in every message; consent for others | Until you unsubscribe |
| Running a secure website | Technical data | Legitimate interest (6(1)(f)) | The period set by our hosting provider |
We never use children's data for marketing, profiling or advertising, and we never sell personal data.
5. Children's data
- Parents or guardians give children's data and consents on their behalf. For children under 16, only a parent or guardian can give or withdraw consent.
- Health information is optional. We ask for it with a separate consent box, not by accepting our terms. Without it, we may be unable to care for a child with serious medical needs safely.
- Only the sitters working at that event see a child's details, and only during the event.
6. Who we share data with
- Our sitters, on a need-to-know basis and under a duty of confidentiality.
- The event organiser (Client): normally only the number and age groups of children. Names or details are shared only if needed in an incident at their venue.
- Service providers who process data for us under a data processing agreement: our registration and form provider, email provider, website host and bookkeeping provider.
- Emergency services, doctors or Veilig Thuis, when needed to protect a child or required by law.
- Our insurer or legal adviser, if needed for a claim.
7. Transfers outside the EU
We prefer providers that store data in the EU. Where a provider transfers data outside the European Economic Area, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.
8. How we protect data
- Registration data is stored in a locked excel file and access limited to the owner and the lead sitter of each event.
- Paper lists used on the day stay with the lead sitter, are never left unattended and are shredded after the event.
- Sitters do not store children's details or photos on personal devices. Messages to parents during an event contain no medical details.
9. Photos
We do not photograph children unless a parent has given separate written consent for a stated purpose. Consent can be withdrawn at any time by emailing us; we then remove the images from our website and channels within 14 days. Material already printed or shared by others cannot always be recalled.
10. Cookies
Our website uses only cookies needed for it to work. We do not use advertising or tracking cookies. If this changes, we will ask for your consent first.
11. Your rights
You can ask us to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. You can withdraw consent at any time; this does not affect earlier use. Parents can exercise these rights for their child.
Email info@eventchildcare.nl. We may ask you to confirm your identity and reply within one month.
You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).
12. Data breaches
If a data breach occurs, we act immediately to contain it. Where the law requires, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform the people affected without delay.
13. Automated decisions
We do not make automated decisions or create profiles about anyone.
14. Changes
We may update this statement. The current version and its effective date are always on our website.
15. Contact
Event Childcare · info@eventchildcare.nl · eventchildcare.nl