Personal Data Protection Policy

Kiddobee, SAS au capital de €1,000 – RCS Nanterre 930 459 235 – 77 Rue Martre, 92110 CLICHY, France, collects and processes personal data in the course of its childcare matching and management activities. Personal data means any information relating to an identified or identifiable natural person, directly or indirectly.

1. Legal Framework

All processing by Kiddobee is governed by:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR)
• French Law n°78-17 of 6 January 1978 on data processing, files and freedoms, as amended
• French Law n°2018-493 of 20 June 2018 adapting French law to the GDPR
• The arrêté of 24 November 2023 fixing the cahier des charges for SAP agrément (Article R.7232-6 Labour Code), which imposes specific obligations regarding candidate recruitment, identity verification and service monitoring that require processing of personal data

This policy applies to all websites, applications and digital tools operated by Kiddobee. All Kiddobee contracts are concluded at a distance (online); this policy applies equally to all clients regardless of how they first made contact.

2. Data Controller

Mr. DEBBOUZ, President of Kiddobee – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com

3. Data Protection Officer (DPO)

DPO Kiddobee – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com

4. Data We Collect

4.1 Candidates and childcare providers

• Identity: name, date of birth, social security number, CAF/MSA number
• Contact details: postal address, email, phone
• Professional data: CV, qualifications and certifications, references
• Background check data: B3 criminal record extract and signed declaration on honour (current standard for childcare 3+). Once agrément for under-3s is obtained: B2 criminal record and FIJAIS register consultation will also apply, as required by Articles L.133-6 CASF, 776 and 706-53-7 CPP
• Interview records: video interview notes, signed interview summary
• Connection data: IP address, logs, account credentials
• Activity data: assignment history, quality evaluations

4.2 Prospects and clients

• Identity: name
• Contact details: postal address, email, phone
• Data relating to children in care: name, date of birth, school year, school and activity locations
• Connection data: IP address, logs, account credentials
• Contractual and financial data: booking history, payment methods and history
• Feedback and complaints
• Named référent: the name and contact details of the Kiddobee advisor (employee) assigned to the client's account are communicated to the client as required by the SAP regulatory framework

Data collected is strictly limited to what is necessary for the purposes below.

5. Purposes of Processing

5.1 For candidates and providers

• Processing applications and conducting video interviews
• Identity verification and document checks
• Criminal record verification (B3 + declaration on honour for 3+ activities; B2 + FIJAIS once agrément for under-3s is obtained)
• Qualification verification
• Drafting and managing employment contracts, tracking assignments
• Fulfilling employer obligations (URSSAF declarations, payslips, etc.)
• Providing and managing a secure personal online account
• Occasional phone call recording for training/quality purposes (max 21 days retention)
• Occasional communications about Kiddobee activities
• Satisfaction surveys and performance statistics

5.2 For prospects and clients

• Providing budget simulations and presenting Kiddobee offers
• Managing bookings, assignments and billing
• Providing and managing a secure personal online account
• Completing administrative formalities (CAF/PAJEMPLOI declarations)
• Personalised matching: ranking candidate profiles based on compatibility criteria including personality fit (see 5.3)
• Service monitoring: the assigned référent conducts periodic reviews of service adequacy
• Occasional phone call recording for training/quality purposes (max 21 days retention)
• Occasional communications about Kiddobee activities
• Satisfaction surveys and performance statistics

5.3 Algorithmic matching

Kiddobee uses a matching algorithm based on compatibility criteria including personality fit to rank candidate profiles for review by a Kiddobee advisor. This is a decision-support tool only. The final selection and assignment is always made by a human advisor. This processing does not constitute automated decision-making within the meaning of Article 22 GDPR.

6. Use of AI Tools

Kiddobee uses AI-powered tools to support certain internal operations (processing requests, automating administrative tasks, data analysis). Where such tools involve personal data, Kiddobee ensures:

• Only strictly necessary data is shared (data minimisation)
• Appropriate data processing agreements are in place with all third-party processors under Article 28 GDPR
• Personal data is not used to train third-party models
• All transfers outside the EU are governed by appropriate safeguards (see section 11)

For more information, contact our DPO.

7. Retention Periods

7.1 Candidates and providers

• Unsuccessful candidate: 2 years from interview date
• Successful candidate: 3 years from interview date
• Provider who has worked with Kiddobee: 5 years from end of relationship
• B3 / declaration on honour: not retained beyond verification; employer may note that verification was carried out

7.2 Prospects and clients

• Prospect: 3 years from last contact
• Client: 5 years from last activity

Beyond these periods, data may be anonymised for statistical purposes. Phone recordings are deleted within 21 days.

8. Recipients of Personal Data

• Authorised Kiddobee staff: recruitment, provider management, payroll, administrative declarations, client relations, marketing
• The named référent (Kiddobee employee) assigned to each client account: their name and contact details are shared with the client as required by the SAP regulatory framework
• Technical subcontractors providing services to Kiddobee (hosting, CRM, communication tools, AI tools – see section 6)
• Administrative, tax and judicial authorities where legally required (URSSAF, DREETS, etc.)

Kiddobee never sells personal data to third parties for commercial purposes.

9. Your Rights

Under the GDPR and French Data Protection Act, you have the right to:

• Access: obtain a copy of your data and information about how it is processed
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion where permitted by law
• Restriction: suspend use of your data in certain circumstances
• Object: object to specific processing, in particular for direct marketing
• Portability: receive your data in a structured, machine-readable format
• Not be subject to automated decision-making: Kiddobee's matching algorithm supports a human advisor's decision and does not constitute automated decision-making under Article 22 GDPR
• Withdraw consent: at any time, for processing based on consent
• Post-mortem instructions: specify what happens to your data after your death

To exercise any right, contact the DPO with proof of identity: hello@kiddobee.com or DPO Kiddobee – 77 Rue Martre, 92110 CLICHY. Response within one month (extendable by two months for complex requests).

You may also lodge a complaint with the CNIL – 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 – www.cnil.fr

10. Security Measures

• DPO appointed since July 2024
• Staff training on data protection and confidentiality
• Strict confidentiality obligations for all providers and advisors
• Regular security audits
• Access controls and authorisation management
• Data processing agreements with all subcontractors
• CNIL notification within 72 hours of any personal data breach

11. International Data Transfers

Some Kiddobee service providers may be established outside the EU. In such cases, Kiddobee ensures appropriate safeguards under Articles 46 et seq. GDPR, in particular Standard Contractual Clauses (SCCs) adopted by the European Commission. Details available from the DPO on request.

12. Changes to This Policy

Kiddobee may update this policy at any time to reflect regulatory, technical or organisational changes. Significant changes will be communicated by email or on our website. The date of last update appears at the top of this document.

Kiddobee SAS – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com – RCS Nanterre 930 459 235