Privacy
What we hold about you, and why
A daycare cannot run without knowing a great deal about a family. This page says exactly what we keep, what we do with it, who else ever sees it, and how long we hold on to it.
Last updated 29 July 2026.
Who is responsible
Kidz R Os is the data controller. That means we decide what is collected and what happens to it, and we are the ones answerable for it.
Kidz R Os
Lyshøjgårdsvej 45, 2500 Valby, Denmark
CVR 35726039
contact@kidzros.dk · +45 27 34 65 39
For anything on this page, write to contact@kidzros.dk and it comes to Deepa directly.
What we collect
About the child
Name, date of birth, gender, nationality, languages spoken, whether they speak English, allergies and any notes you give us about their needs. The CPR number, where you have given it. Start date, leaving date and the monthly fee.
About you
Both parents' names, email addresses and mobile numbers, and the home address. Who submitted the registration and in what relationship to the child.
What happens while your child is with us
Messages between you and us on your family page, including any file you attach. Invoices and their payment status. Visits you book. If you write a testimonial when you leave, that and whether you allowed us to publish it.
Consents
Whether you agreed to photographs, to the newsletter, and to being contacted by email - each recorded separately, with the date and the IP address the registration came from, so we can show what was agreed and when.
The CPR number
The CPR number is needed for the kommune subsidy and for our own bookkeeping. It is treated differently from everything else here:
- It is encrypted in our database using AES-256-GCM. Someone who obtained a copy of the database would not be able to read it.
- It is never shown in full on screen except when you are correcting it yourself on your own family page.
- It is not used to identify you anywhere in the system - your child has a separate child ID for that.
Under Danish law we may hold it because it is necessary for the administration of your child's place. We do not use it for anything else.
Why we hold it, and on what basis
| What for | Legal basis |
|---|---|
| Running your child's place: the contract, the roster, the daily care | Performance of a contract |
| Allergies and health notes | Protecting the vital interests of your child |
| Invoicing, payment records and bookkeeping | Legal obligation (Danish bookkeeping law) |
| Photographs, the newsletter, publishing a testimonial | Your consent, which you may withdraw at any time |
| Answering enquiries and keeping a waiting list | Legitimate interest in running the daycare |
Where we rely on consent, saying no changes nothing else. Your child's place does not depend on agreeing to photographs or to a newsletter.
Who else sees it
We do not sell anything to anyone, and we do not use your details for advertising.
These are the only parties involved, and each only sees what it needs:
- Netsite A/S - hosts this website, the database and our email, in Denmark.
- Enable Banking - gives us read-only sight of our own business bank account so that payments can be matched to invoices. It can see transactions on our account, which includes the name on a transfer you make to us. It cannot move money, and it has no access to your bank.
- Your kommune - when you apply for the subsidy towards your fee, you make that claim yourself on the kommune's own website. The kommune then asks us to confirm it, and we tell them that your child has a place here, the date it starts and the monthly fee. Nothing else, and only after you have applied.
- Nothing else. Messages between you and us stay on your family page, on our own server - there is no third-party chat or messaging service involved.
- Our accountant and the Danish tax authorities - for invoices and bookkeeping, as the law requires.
Nothing is transferred outside the EU/EEA except where one of the above operates a service that does so under the safeguards required by GDPR.
Your rights
You can ask us to:
- show you everything we hold about you and your child;
- correct anything wrong - though for most of it you can do this yourself on your family page, at any time, without asking us;
- delete it, where we are not required to keep it;
- send you a copy in a form you can take elsewhere;
- stop using it for something you previously agreed to.
Write to contact@kidzros.dk. We will answer within a month, and there is no charge.
If you are not satisfied with how we have handled it, you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk. We would rather you came to us first, but it is your right either way.
Cookies
This website sets no advertising cookies, no tracking cookies and no third-party cookies at all. There is no analytics on it, and nothing on any page is loaded from another company.
The only cookie is the one that keeps you signed in to your family page while you are using it. It is ours, it holds nothing but a session identifier, and it disappears when you close the browser.
That is why there is no cookie banner on this site. There is nothing to consent to.
How it is kept safe
Specifics rather than reassurance, so you can judge it for yourself:
- Everything travels encrypted. The whole site, including your family page and the forms, is served over HTTPS. There is no unencrypted version.
- CPR numbers are encrypted in the database with AES-256-GCM, under a key held separately from the data. A stolen copy of the database would not yield a single CPR number.
- Your family page is reached by a private link containing a 48-character random token. It cannot be guessed. Asking for a new link immediately invalidates the old one.
- The admin side needs a password, and passwords are stored only as one-way hashes - not even we can read them.
- Database queries use prepared statements throughout, which is what prevents the most common way sites get broken into.
- Uploaded files and stored PDFs are not reachable from the web. Message attachments, invoices and database backups sit in folders the web server refuses to serve, and are only ever delivered through a page that checks who is asking.
- Session cookies are HttpOnly, Secure and SameSite, and every form that changes anything carries a one-time token, so a third-party site cannot act on your behalf.
- Error messages are logged, never displayed. A visitor is never shown the internals of the system.
- The private areas are closed to search engines, both by instruction and by response header, so a family page cannot end up in a search result.
What we would not claim: no system is perfect, and the private link to your family page is only as private as you keep it. If you think a link has gone astray, tell us and we will issue a new one, which kills the old one instantly.
How it is deleted
Most of this happens automatically, on a schedule, without anyone having to remember:
| What | When it goes |
|---|---|
| Your family page and every message on it | 30 days after your last billed month. The link stops working and the whole message thread, including attachments, is deleted. |
| Files attached to messages | Automatically after 45 days, whether or not you have left. |
| Enquiries and waiting-list entries that came to nothing | Automatically once the start date you asked about is more than 6 months past. The record is deleted outright, not archived. |
| Invoices and payment records | Kept 5 years plus the current year, because Danish bookkeeping law requires it. This is the one thing we cannot delete on request. |
| Your child's record | Removed once the notice period, the final settlement and the bookkeeping period are all complete. |
| Testimonials | Published until you ask us to take one down, then removed. |
Deletion means deletion - the row is removed from the database, not flagged as hidden.
One honest caveat: we take a nightly backup of the database so that a mistake or a failure does not lose a family's records. Backups are kept for a short period and then destroyed, so something you asked us to delete may persist in a backup for a little while after it has gone from the live system. CPR numbers stay encrypted inside those backups too.
Changes
If this notice changes in a way that matters, we will tell families by email rather than quietly editing the page.