Data Processing Agreement

1. Definitions

Controller: the nursery that determines the purposes and means of processing personal data entered into Waslink. Processor: Waslink, which processes data on behalf of the Controller. Data Subjects: children, parents/guardians, and staff whose data is entered.

2. Subject Matter & Nature of Processing

Waslink processes personal data to provide the nursery management services described in the Terms of Service, including: storing children's profiles, daily reports, attendance records, photos, invoices, messages, and incident records.

Processing operations include: storing, retrieving, displaying, transmitting (to authorised users), and deleting data.

3. Categories of Data & Data Subjects

Categories of personal data processed:

• Identity data: names, dates of birth, gender
• Contact data: email addresses, phone numbers
• Health / special category data: allergies, medical notes
• Biometric-adjacent data: photos of children (consent-gated)
• Financial data: invoice amounts and payment status (no card data)
• Behavioural data: daily reports, attendance, mood records

Categories of data subjects: children enrolled at the nursery; their parents and guardians; nursery staff.

4. Processor Obligations (Waslink)

Waslink agrees to:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures (Article 32)
• Assist the Controller in responding to data subject rights requests
• Delete or return all personal data upon termination of the agreement
• Make available all information necessary to demonstrate compliance with Article 28
• Not engage a new sub-processor without giving the Controller prior written notice

5. Approved Sub-processors

The Controller authorises Waslink to engage the following categories of sub-processor. The current list is maintained at kindernest.app/legal/sub-processors:

• Cloud infrastructure provider (hosting, database, object storage)
• Transactional email provider
• Payment processor (receives billing data only — no child or health data)

6. Security Measures

Waslink implements the following technical and organisational measures:

• Encryption in transit: TLS 1.2 or higher on all connections
• Encryption at rest: AES-256 for stored data and backups
• Access controls: role-based permissions; staff can only see their own tenant
• Audit logging: material data access and changes are logged
• Vulnerability management: regular dependency updates and security patches
• Incident response: documented procedure with 72-hour Controller notification

7. Personal Data Breaches

In the event of a personal data breach affecting Controller data, Waslink will notify the Controller without undue delay and no later than 72 hours after becoming aware. Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken.

8. International Transfers

Waslink processes data in the UK and EEA by default. Any transfer outside these regions will be subject to appropriate safeguards (Standard Contractual Clauses or equivalent) as required by applicable law.

9. Deletion on Termination

Upon termination of the service agreement, Waslink will, at the Controller's choice, delete or return all personal data within 30 days and delete existing copies unless retention is required by applicable law.

10. Contact

Data protection queries: dpa@kindernest.app