Privacy Policy

Wonder Kids Academy respects the privacy of children, parents, guardians, visitors and users of our digital services. This policy explains what personal data we collect, why we use them, the legal basis, to whom we may disclose them, how long we keep them, how we protect them and what your rights are.

This policy applies to the website www.wonderkids.al, the online application, the parent app, communications with the Academy, the administration of the service, photographs and videos, security records and camera surveillance. Separate privacy notices and policies may also apply to employees.

• Lawfulness, fairness and transparency in all processing.
• Collection only for clear and lawful purposes.
• Data minimisation, especially where the data relate to children.
• Accuracy and keeping data up to date.
• Retention only for as long as necessary or required by law.
• Confidentiality, access control and appropriate technical and organisational security.
• Accountability and documentation of privacy decisions.
• The best interests of the child as a central consideration when assessing any processing that affects the child.

Where processing is based on consent, Wonder Kids Academy must be able to demonstrate that consent. The request for consent must be distinguishable, clear and understandable. Consent may be withdrawn at any time in a way that is as easy as giving it, without affecting the lawfulness of processing carried out before the withdrawal.

Consent to the publication of photographs or videos on the public website, in advertising or on social media must be separate from acceptance of the terms of service. A child must not be denied the basic service solely because the parent does not agree to the use of the image for marketing.

For information society services offered directly to a child, where the basis is consent, the specific legal requirements on age and parental authorisation apply. The parent app is intended for authorised adults and is not designed as an independent account for young children.

We make a clear distinction between materials used within the service and public materials used for marketing.

Materials in the app.

They may be used to document activities and to inform parents. Access must be limited to authorised accounts, and the materials must minimise unnecessary exposure of other children.

Public materials.

Publication on the website, on social media, in advertising or in promotional materials takes place only on the appropriate legal basis and with separate consent where required.

Withdrawal of consent.

After withdrawal, the Academy stops new uses that are based on consent and takes reasonable steps to remove the materials from the channels it controls. Deletion cannot be guaranteed for copies lawfully created earlier by third parties, or for caches or archives outside the Academy’s control.

Parents must not republish materials from the app that identify other children without proper authorisation.

Health data are considered a special category of personal data and receive additional protection. The Academy collects them only when they are necessary for safety, care, compliance with legal obligations or the provision of an appropriate service.

Access is limited on a need-to-know basis. Health information is not used for marketing, advertising profiling or purposes unrelated to care. When a health professional or specialist processes data in their professional capacity, the relevant professional and legal obligations also apply.

Wonder Kids Academy may use cameras for the safety of children, staff, visitors and property only when this is necessary and proportionate. Before installation or any material changes, the purpose, necessity, placement, responsible person and retention period must be documented, and visible information signs must be put in place.

• No cameras are placed in toilets, changing areas or other spaces where a particular degree of privacy is expected.
• Any camera in indoor care areas requires a specific justification of its necessity and proportionality, and compliance with the applicable sector-specific requirements.
• Under this version, the system does not record sound.
• Access to recordings is permitted only to authorised persons and only for the purpose for which the system was installed, or where the law permits another use.
• Indoor recordings are normally kept for 12 days and outdoor recordings for 15 days. These periods are within the maximum legal limit of one month. A specific clip may be kept longer only when it is necessary for handling a particular incident, legal request, procedure or claim.
• Employees are notified separately in writing about the system and their rights.
• A person who requests access to footage that also shows other persons may be given access only in a way that respects the rights of those other persons, for example by restricting copies, masking or another appropriate procedure, when this is technically and legally necessary.

We do not sell the personal data of children, parents or guardians. Data may be shared only as necessary with the following categories:

• Authorised employees and associates of Wonder Kids Academy, according to their role and need for access.
• Health professionals, psychologists, speech therapists, physiotherapists or other specialists, when the relevant service is lawfully provided and the data are necessary.
• Providers of hosting, databases, email, storage, backups, maintenance, communication and security, as contracted processors when they act on our behalf.
• Banks, payment processors, accountants, auditors, legal advisers and other professional providers, only to the extent necessary.
• Public authorities, courts, the police, child protection bodies, and educational or regulatory authorities, only where there is a legal basis or a lawful request.

When a third party acts as a processor on our behalf, the relationship must be governed by a written contract with appropriate requirements for confidentiality, security, documented instructions, subcontracting and the deletion or return of the data.

Some technical providers may store or process data outside Kosovo. Before such a transfer, Wonder Kids Academy must assess the destination and use a mechanism permitted by Law No. 06/L-082, including an adequacy decision, appropriate safeguards, an authorisation or another permitted basis, as the case may be. Information about the applicable safeguards can be requested at info@wonderkids.al.

Considering that the data concern children and may include health data, Wonder Kids Academy applies, or must apply, measures appropriate to the risk, including:

• Role-based access and the need-to-know principle.
• Strong passwords and additional authentication measures for highly privileged accounts, where feasible.
• Encryption in transit and, where appropriate, encryption or equivalent measures for stored data.
• Backups, recovery procedures and periodic testing of availability.
• Audit logs and monitoring of security events for administrative or sensitive access.
• Restricting the use of personal apps by staff for children’s data, and the use of official channels.
• Confidentiality obligations, staff training and procedures for removing or changing access when an employee’s role changes.
• Contracts with data processors and security assessment of the main providers.
• A regular process for testing and evaluating the effectiveness of the security measures.

No system can guarantee absolute security. If a data breach occurs, the Academy documents the incident, takes measures for containment and recovery, and notifies the Information and Privacy Agency within the legal deadline where required. Where the risk to individuals is high, the affected individuals are also notified without undue delay, in accordance with the law.

The website and the app may use cookies or similar mechanisms that are essential for authentication, security, maintaining the session and basic functionality. Non-essential cookies or technologies for analytics, marketing or tracking are used only where there is a legal basis and the required consent mechanism.

Wonder Kids Academy must not use advertising profiling of children or unnecessary tracking technologies in the parent app. It must be possible to change preferences for non-essential cookies at a later time.

Subject to the legal conditions and exceptions, the data subject has the right to request:

• Information about, and access to, the personal data.
• Correction of inaccurate data or completion of incomplete data.
• Erasure of the data when the legal conditions are met.
• Restriction of processing in the cases provided for by law.
• Objection to processing based on legitimate interest, and objection to direct marketing.
• Data portability when the legal conditions are met.
• Withdrawal of consent at any time for processing that is based on consent.
• Information about automated decision-making and the related rights, if such a mechanism is used.
• Lodging a complaint with the Information and Privacy Agency and using the judicial remedies provided for by law.

Requests can be sent to info@wonderkids.al. We may ask for reasonable information to verify identity and parental authority, especially when the request concerns a child’s data. We respond without undue delay and, in principle, within one month, with the possibility of an extension only where the law permits it and with a reasoned notice.

Children’s data are handled with an enhanced standard of protection. Processing must be necessary, limited and understandable for the parent or guardian. Where legitimate interest is used as the basis, the interests and rights of the child are given particular weight in the balancing test.

We do not sell children’s data, we do not use health data for marketing and we do not aim to build advertising profiles of children. Any new feature that could create a high risk to children’s privacy must be assessed before it is activated.

Where new processing, a new technology or a combination of data may create a high risk, Wonder Kids Academy must carry out a data protection impact assessment before the processing begins, where this is required by Law No. 06/L-082. This is particularly relevant for systematic monitoring, large-scale processing of health data, new features involving photographs or videos, behavioural analysis and systems that may significantly affect children.

New features must be designed with private settings by default, minimal access, limited retention and clear control for the parent or guardian.

As of the date of this version, the policy does not provide for fully automated decision-making that produces legal effects or a similarly significant impact on the child or the parent. If such a feature is introduced in the future, this policy will be updated before it is used and the information required by law will be provided.

This policy may be updated because of legal, technological or service changes. The date of the new version is published on the official website. Where a change materially affects the way data are processed or requires new consent, appropriate notice will be given and new consent will be obtained where the law requires it.

For questions, requests to exercise your rights, withdrawal of consent or to report a privacy concern, please contact:

If Wonder Kids Academy appoints a Data Protection Officer, whether under legal requirements or voluntarily, the contact details of that officer will be published and communicated in accordance with the law.