Privacy Policy

1. Introduction

At Minly we take the protection of your personal data seriously. This privacy policy explains how we collect, use, store and protect your personal data when you use our platform for waitlist management in kindergartens and nurseries.

The data controller is Adrian Dudek, conducting sole proprietorship business under the name "Weblix Adrian Dudek", ul. Pęckowskiego 2 lok. 2, 32-500 Chrzanów, Poland, NIP 6282213418, REGON 384695065, e-mail: kontakt@minly.pl, phone +48 791 748 958 (the "Minly"). We process your personal data in accordance with applicable data protection law, including the GDPR (EU General Data Protection Regulation).

Roles: controller and processor

Minly is the controller of institution account data, billing data, data of companies in the marketplace and data of users of the minly.pl website. However, for the data of children, parents and guardians and of staff, entered into the platform by the institution, the controller is the institution and Minly acts as a processor within the meaning of Article 28 GDPR, solely on the institution instructions. In that scope, direct requests to exercise data subject rights to your institution; this policy serves an informational function for such data.

We do not transfer data outside the European Economic Area. Should this become necessary, it will take place solely on the basis of the mechanisms provided in Chapter V of the GDPR (e.g. standard contractual clauses).

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

2. What information do we collect?

We collect and process the following types of personal data:

2.1 Institution information

• Institution name and address
• Tax identification number (NIP)
• Contact information (phone, e-mail)
• Billing information

2.2 Staff information

• Name and contact information
• E-mail address
• Position and role in the institution
• Login credentials (encrypted password)

2.3 Parent information

• Name and contact information
• E-mail address and phone number
• Address
• Relationship to the child (mother, father, guardian)

2.4 Child information

• Child name and date of birth
• Gender
• Any sibling relationships
• Waitlist status and desired start date
• Group placement in the institution

2.5 Marketplace company data

• Company registration data (name, NIP, REGON)
• Contact information (e-mail, phone)
• Billing and transaction data (payments for paid services)
• Content of correspondence conducted through the Marketplace inbox

2.6 Contacting a company without an account (guest inquiries)

When you send an inquiry to a company without creating an account, we process: the facility name, NIP, email address, the inquiry content and optionally the contact person, phone, city and voivodeship, and preferred date. The basis is taking steps at your request before entering into a contract and our legitimate interest in enabling contact with the company and preventing abuse (art. 6(1)(b) and (f) GDPR). We use the data to pass the inquiry to the chosen company, run the conversation within Minly, confirm the inquiry is genuine (email verification, moderation) and prevent spam and impersonation.

If you later create a facility account on the same confirmed email address, your existing conversations will be linked to it so the history stays continuous.

2.7 Administrator access to conversations

For security and moderation (including reviewing first-time guest inquiries and responding to abuse reports), authorised Minly administrators may access the content of conversations to the extent necessary for those purposes. Every such access is logged. We do not conduct constant, mass monitoring of private conversations.

3. Purpose of processing

We process your personal data for the following purposes:

• Administration of waitlists and enrolment
• Communication between institution and parents
• Daily operations and planning in the institution
• Billing and customer administration
• Support and customer service
• Improvement of our platform

4. Legal basis for processing

Our processing of personal data is based on the following grounds:

• To perform our agreement: Processing necessary to deliver our service to the institution
• With consent: Where parents have given consent for their data to be processed
• Legitimate interest: To improve our service and prevent misuse
• Legal obligation: Where we are required by law to retain information

5. Storage and deletion

We store your personal data for as long as necessary to fulfil the purposes for which it was collected:

• Active user accounts: as long as the account is active
• Waitlist information: up to 2 years after the child is enrolled or removed from the list
• Billing information: 5 years in accordance with accounting law
• Upon termination: no later than 30 days after the subscription ends (unless the law requires longer retention)

6. Sharing of information

We only share your personal data with the following:

• Institutions: Where parents have registered children on waitlists
• Data processors: Service providers that help us deliver our service (e.g. hosting, e-mail)
• Authorities: Only where we are legally obliged
• Payment operator: Krajowy Integrator Płatności S.A. (Tpay), plac Andersa 3, 61-894 Poznań, to the extent necessary to process payments for paid marketplace services. Tpay is a separate controller of the transaction data.

We never sell your personal data to third parties. All our processors are bound by data processing agreements that ensure your data is processed securely and lawfully.

7. Security

We use industry-best technical and organisational security measures to protect your personal data against unauthorised access, modification, disclosure or deletion:

• Encryption in transit: All communication is encrypted with TLS 1.3, the newest and most secure transport standard
• AES-256 encryption of sensitive data: Health information such as allergies, medication and illnesses is encrypted with AES-256-CBC, the same encryption standard used by banks and government agencies. Even with unauthorised database access, this data is unreadable
• Access control: Role-based access ensures users can only see relevant data
• Tenant isolation: Each institution data is completely separated from other institutions
• Regular security updates: The system is continuously updated with the latest security patches
• Encrypted backups: Daily backups with full encryption and storage within the EU
• EU hosting: All data is hosted on secure servers in Germany

What is AES-256? AES-256 (Advanced Encryption Standard) is the world most reliable encryption standard, approved by the US NSA for classified information. It would take billions of years for even the most powerful computers to break the encryption.

8. Your rights

You have the following rights under the GDPR:

• Right of access: You can request to see the personal data we hold about you
• Right to rectification: You can request correction of inaccurate data
• Right to erasure: You can request deletion of your data (with certain exceptions)
• Right to restriction: You can request limitation of the processing of your data
• Right to data portability: You can request to receive your data in a machine-readable format
• Right to object: You can object to certain forms of processing
• Right to withdraw consent: Where processing is based on consent

To exercise your rights, please contact us at kontakt@minly.pl.

9. Cookies

We use cookies and similar technologies to improve your experience on our platform. These include:

• Necessary cookies: Required for the platform to function (e.g. login session)
• Functional cookies: Remember your preferences (e.g. dark/light mode). You can manage cookies in your browser settings
• Analytics cookies (with consent): We use Matomo to analyse traffic and improve the service. By default analytics runs without cookies; Matomo cookies are used only after you consent in the cookie banner, and you can withdraw consent at any time
• Marketing cookies (with consent): We use the Meta Pixel (Facebook/Instagram) to measure the effectiveness of our activity and reach the right audiences with information about Minly. The pixel only starts after you consent in the cookie banner and collects no data before that; you can withdraw consent at any time

Analytics and marketing cookies are optional and off by default: they only start after you consent in the cookie banner. Through the Meta Pixel, data about on-site events (e.g. visits, company sign-ups) may be shared with Meta Platforms Ireland Ltd., solely after your consent and for measurement and ad targeting. You can withdraw consent at any time in the cookie settings or by clearing the site data in your browser.

10. Changes to the privacy policy

We may update this privacy policy from time to time. For material changes, we will inform our customers by e-mail or notification in the platform. The latest version is always available on this page.

11. Contact and complaints

If you have questions about our processing of personal data or wish to exercise your rights, you can contact us:

Minly
Email: kontakt@minly.pl

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe we do not process your personal data correctly:

Personal Data Protection Office (UODO)
ul. Stawki 2
00-193 Warsaw, Poland
Phone: 22 531 03 00
E-mail: kancelaria@uodo.gov.pl
Website: www.uodo.gov.pl