Privacy Policy

1. Introduction

At Minly, we take the protection of your personal data seriously. This privacy policy explains how we collect, use, store, and protect your personal information when you use our platform for waitlist management for childcare institutions.

Minly is the data controller for the personal data we receive about you. We process your personal data in accordance with applicable data protection legislation, including GDPR (EU General Data Protection Regulation).

2. What information do we collect?

We collect and process the following types of personal data:

2.1 Institution information

• Institution name and address
• Business registration number (CVR)
• Contact information (phone, email)
• Billing information

2.2 Staff information

• Name and contact information
• Email address
• Position and role in the institution
• Login credentials (encrypted password)

2.3 Parent information

• Name and contact information
• Email address and phone number
• Address
• Relationship to the child (mother, father, guardian)

2.4 Child information

• Child's name and date of birth
• Gender
• Any sibling relationships
• Waitlist status and desired start date
• Group placement in the institution

3. Purpose of processing

We process your personal data for the following purposes:

• Administration of waitlists and enrollment
• Communication between institution and parents
• Daily operations and planning in the institution
• Billing and customer administration
• Support and customer service
• Improvement of our platform

4. Legal basis for processing

Our processing of personal data is based on the following grounds:

• To fulfill our agreement: Processing necessary to deliver our service to the institution
• With consent: Where parents have given consent for their information to be processed
• Legitimate interest: For improving our service and preventing misuse
• Legal requirement: Where we are required by law to retain information

5. Storage and deletion

We store your personal data for as long as necessary to fulfill the purposes for which it was collected:

• Active user accounts: As long as the account is active
• Waitlist information: Up to 2 years after the child is enrolled or removed from the list
• Billing information: 5 years according to accounting law
• Upon termination: No later than 30 days after the subscription ends (unless legislation requires longer retention)

6. Sharing of information

We only share your personal data with the following:

• Institutions: Where parents have registered children on waitlists
• Data processors: Service providers that help us deliver our service (e.g., hosting, email)
• Authorities: Only where we are legally obligated

We never sell your personal data to third parties. All our data processors are subject to data processing agreements that ensure your data is processed securely and lawfully.

7. Security

We use industry-best technical and organizational security measures to protect your personal data against unauthorized access, modification, disclosure, or deletion:

• Encryption in transit: All communication is encrypted with TLS 1.3 - the newest and most secure transport standard
• AES-256 encryption of sensitive data: Health information such as allergies, medication, and illnesses is encrypted with AES-256-CBC - the same encryption standard used by banks and government agencies. Even with unauthorized database access, this data is unreadable
• Access control: Role-based access ensures users can only see relevant data
• Tenant isolation: Each institution's data is completely separated from other institutions
• Regular security updates: The system is continuously updated with the latest security patches
• Encrypted backups: Daily backups with full encryption and storage within the EU
• EU hosting: All data is hosted on secure servers in Germany

What is AES-256? AES-256 (Advanced Encryption Standard) is the world's most reliable encryption standard, approved by the US NSA for classified information. It would take billions of years for even the most powerful computers to break the encryption.

8. Your rights

You have the following rights under GDPR:

• Right of access: You can request to see the personal data we hold about you
• Right to rectification: You can request correction of inaccurate information
• Right to erasure: You can request deletion of your information (with certain exceptions)
• Right to restriction: You can request limitation of the processing of your information
• Right to data portability: You can request to receive your data in a machine-readable format
• Right to object: You can object to certain forms of processing
• Right to withdraw consent: Where processing is based on consent

To exercise your rights, please contact us at kontakt@minly.dk.

9. Cookies

We use cookies and similar technologies to improve your experience on our platform. These include:

• Necessary cookies: Required for the platform to function (e.g., login session)
• Functional cookies: Remember your preferences (e.g., dark/light mode)

We do not use tracking cookies or share data with advertising networks.

10. Changes to the privacy policy

We may update this privacy policy from time to time. For material changes, we will inform our customers via email or notification in the platform. The latest version will always be available on this page.

11. Contact and complaints

If you have questions about our processing of personal data or wish to exercise your rights, you can contact us:

Minly
Email: kontakt@minly.dk

You also have the right to file a complaint with the Danish Data Protection Agency if you believe we are not processing your personal data correctly:

Danish Data Protection Agency (Datatilsynet)
Carl Jacobsens Vej 35
2500 Valby, Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk