Data processing agreement

1. Parties and subject

This agreement forms part of the terms of service between the kindergarten and Dinein group, LLC (registered Georgian name: შპს დაინინ გრუპ; identification code: 405877010; registered address: 26 Viktor Dolidze Street, Tbilisi, Georgia). The kindergarten is the controller; Dinein group, LLC is the processor. Contact [email protected]; +995 599 89 06 74.

The kindergarten instructs Dayboo to receive, store, organize, display, update and share data with authorized users for child care, daily records, communication and kindergarten billing. Processing on the kindergarten’s behalf continues during the service, including the period already paid for after cancellation of renewal. At the end of service, processing must stop and data must be returned or deleted under section 7; unresolved arrangements do not authorize indefinite continued processing.

2. People and data

Data concerns children, parents, other linked adults, staff and payers of incoming bank transfers. It includes identity and contact data, personal ID numbers, addresses, photos, uploaded documents and their details, relationships and permissions, groups, attendance, daily records, communication, consents, invoices, payments, incoming bank transfers and action history. Where live cameras are enabled, it also includes live video of children and staff, recorder/camera settings, camera consents and viewing logs with viewer identity, linked child, IP address, browser details and viewing times.

Special-category health data includes allergies, conditions, medication information, incidents, injury photos, body-map marks, first aid and uploaded medical/vaccination documents. Other uploaded files may include birth certificates, identity documents and contracts. The privacy policy lists the full categories. Dayboo’s own processing of owner account, subscription and service sign-in/security data as controller is outside this instruction.

Privacy policy — data categories

3. Instructions and confidentiality

Dayboo must process data only on the kindergarten’s documented instructions for the service described here, or as required by law. Authorized users’ actions in Dayboo are the kindergarten’s operational instructions; additional requests go to [email protected]. Dayboo will inform the kindergarten if it identifies an unlawful instruction.

Dayboo must ensure that people with access to the data maintain confidentiality and use access only for their assigned duties. Authorized Dayboo personnel can access stored records, including through an internal administration tool and the server, only to run the service, provide support and fix problems; these views are not logged in the kindergarten’s history.

4. Security measures

Implemented technical measures include external HTTPS connections; access scoped by role, branch, group and child relationship; Fernet encryption of personal ID numbers and connection secrets; PIN and shared-device token hashes; change audits; and logged reveals of personal ID numbers, full health profiles and incident details. Routine allergy summaries do not generate separate reveal logs.

Photos have no public storage URL: reads check access and, for shared photos, relevant current consent. Push messages do not carry photos, incident descriptions, injuries, first aid, health-profile details or parent-note text; they can say that an incident report exists (for owners and directors with its severity) and show an announcement’s title, so the kindergarten must keep health information out of announcement titles. This list does not claim full disk encryption, automated backups or certification.

Uploaded child and family-member documents are kept in private storage; owners and appropriately scoped directors can open them, and each file read is logged. Live camera viewing is limited by the group’s hours, open days, naps, attendance, parent access and counted live-camera consents; viewers receive a short-lived pass. Dayboo’s relay does not make permanent video recordings. The kindergarten’s own recorder may record separately, under the kindergarten’s notices and responsibilities.

5. Other providers and countries

By accepting this agreement, the kindergarten authorizes the listed providers for the stated functions. This agreement does not change a bank’s or payment provider’s independent legal duties. Before adding or replacing a sub-processor, Dayboo must inform the kindergarten and obtain its prior written authorization, unless Georgian law provides otherwise. Dayboo must impose appropriate data-protection and confidentiality obligations on its sub-processors and remains responsible for its own duties. Send questions or objections to [email protected].

Primary data is stored on servers in the European Union. Other providers may also process data in other countries. International transfers must use the grounds and safeguards required by Georgian law.

• Hetzner — servers that store and process Dayboo data.
• Cloudflare — network delivery, HTTPS and security; it can see traffic, including IP addresses and request contents.
• UBill — SMS delivery; receives the phone number and message text.
• Expo, Apple and Google — push delivery; receive device addresses, notification text and identifiers used to open the relevant record in the app.
• Flitt — card payments for the kindergarten’s Dayboo subscription; receives card details on its own page, the payment amount, order identifier and token for later payments. The full card number does not reach Dayboo’s code.
• TBC Bank — only when a kindergarten connects its own account: a read-only connection. Dayboo reads the account balance and all movements for the period, including outgoing ones, and keeps only incoming transfers; the bank receives credentials and requests identifying the account and time period.

6. Requests and security incidents

Dayboo will help the kindergarten handle people’s requests by providing relevant information and using the technical means available to it. Send requests, including copy/export requests, to [email protected]. There is no complete self-service export.

Dayboo must notify the kindergarten immediately upon identifying a security incident affecting its data and provide the available information about its nature, possible effects and measures taken. Further information must be provided as it becomes available; the first notification must not wait for a complete investigation. The kindergarten, as controller, determines and fulfills its own legal duties to notify the authority and affected people. Applicable statutory deadlines remain binding.

7. Return and deletion

When the service agreement ends, Dayboo must stop processing on the kindergarten’s behalf and immediately transfer the processed data to the kindergarten in full, in accordance with Georgian law. Dayboo must delete the data and its copies after return, or as lawfully instructed by the kindergarten, except where Georgian law requires retention. A data-processing dispute also requires the termination of processing and transfer to the kindergarten as required by law.

Send return or deletion instructions and the authorized recipient’s contact details to [email protected]. Dayboo and the kindergarten must arrange a secure transfer, the export format and recipient verification without postponing the legal obligations above. Data retained because of a legal requirement must be limited to the required categories and period, protected against unrelated use and deleted when the requirement ends.

Subscription cancellation and parent-account deletion do not themselves run a permanent-erasure operation. Dayboo currently has no general automatic erasure schedule or complete self-service export; return and final deletion require separate operational handling, including stored files and copies. These technical limitations do not authorize indefinite retention or remove the duties in this section.

8. Information and controller duties

Dayboo must provide available information about the processing and measures covered by this agreement and assist compliance checks. Audit scope and secure access arrangements will be agreed in advance so that other kindergartens’ data is not disclosed.

The kindergarten must ensure a lawful basis, necessary consents, notices to people, accurate data, authorized-user management and lawful instructions. It decides what data is necessary and must not enter excessive information.

9. Version and law

Georgian law applies, including the 2023 Law on Personal Data Protection as amended. The version and effective date appear at the top of this page. The version accepted at registration is retained in the kindergarten’s acceptance record. Changes are published here; existing acceptance records are not changed by publication.