Personal Data Protection Policy

Kiddobee, SAS au capital de €1,000 – RCS Nanterre 930 459 235 – 77 Rue Martre, 92110 CLICHY, France, collects and processes personal data in the course of its childcare matching and management activities. Personal data means any information relating to an identified or identifiable natural person, directly or indirectly.

1. Legal Framework

All processing by Kiddobee is governed by:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR)
• French Law n°78-17 of 6 January 1978 on data processing, files and freedoms, as amended
• French Law n°2018-493 of 20 June 2018 adapting French law to the GDPR
• The arrêté of 24 November 2023 fixing the cahier des charges for SAP agrément (Article R.7232-6 Labour Code), which imposes specific obligations regarding candidate recruitment, identity verification and service monitoring that require processing of personal data

This policy applies to all websites, applications and digital tools operated by Kiddobee. All Kiddobee contracts are concluded at a distance (online); this policy applies equally to all users regardless of how they first made contact.

2. Data Controller

Mr. DEBBOUZ, President of Kiddobee – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com

3. Data Protection Officer (DPO)

DPO Kiddobee – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com

4. Data We Collect

4.1 Candidates and childcare providers

• Identity: name, date of birth, social security number, CAF/MSA number
• Contact details: postal address, email, phone
• Professional data: CV, qualifications and certifications, references
• Work authorisation: work permit number, where applicable and required
• Employment administration: mutuelle (complementary health insurance) choice, where applicable
• Background check data: B3 criminal record extract and signed declaration on honour (current standard for childcare 3+). Once agrément for under-3s is obtained: B2 criminal record and FIJAIS register consultation will also apply, as required by Articles L.133-6 CASF, 776 and 706-53-7 CPP
• Interview records: video interview notes, signed interview summary
• Meeting recordings and transcripts: audio recordings and text transcripts of video interviews, generated via AI transcription software
• Connection data: IP address, logs, account credentials
• Activity data: assignment history, quality evaluations

4.2 Prospects and clients

• Identity: name; where applicable, details of a second parent or guardian
• Contact details: postal address, email, phone
• Financial assistance references: CAF allocataire number, where provided by the client for the purposes of CMG declarations
• Data relating to children in care: name, date of birth, school year, school and activity locations
• Connection data: IP address, logs, account credentials
• Contractual and financial data: booking history, payment methods and history
• Feedback and complaints
• Named référent: the name and contact details of the Kiddobee advisor (employee) assigned to the client’s account, communicated as required by the SAP regulatory framework
• Meeting recordings and transcripts: audio recordings and text transcripts of introduction meetings between clients and candidates, generated via AI transcription software

4.3 Data collected indirectly

In some cases, Kiddobee collects personal data about prospective clients from publicly available online sources (for example, public posts expressing a need for childcare). This occurs where Kiddobee initiates contact on the basis of information made public by the individual. The legal basis is Kiddobee’s legitimate interest in connecting families with childcare services. Individuals concerned may at any time ask us the source of their data and exercise the rights described in section 9 of this policy.

Data collected is strictly limited to what is necessary for the purposes below.

5. Purposes of Processing

5.1 For candidates and providers

• Processing applications and conducting video interviews
• Identity verification and document checks
• Criminal record verification (B3 + declaration on honour for 3+ activities; B2 + FIJAIS once agrément for under-3s is obtained)
• Qualification verification
• Drafting and managing employment contracts, tracking assignments
• Fulfilling employer obligations (URSSAF declarations, payslips, mutuelle enrolment, etc.)
• Providing and managing a secure personal online account
• Meetings are recorded via AI transcription software for the purposes of candidate evaluation, refining compatibility matching between candidates and families, and safeguarding — including ensuring candidates are suitable to work with children in private homes. Both the audio recording and the text transcript are retained for the duration of the active relationship and for 5 years thereafter.
• Occasional communications about Kiddobee activities
• Satisfaction surveys and performance statistics

5.2 For prospects and clients

• Providing budget simulations and presenting Kiddobee offers
• Managing bookings, assignments and billing
• Providing and managing a secure personal online account
• Completing administrative formalities, including CAF/PAJEMPLOI and CMG declarations on behalf of clients who have granted Kiddobee a mandate for this purpose
• Personalised matching: ranking candidate profiles based on compatibility criteria including personality fit (see 5.4)
• Service monitoring: the assigned référent conducts periodic reviews of service adequacy
• Introduction meetings between clients and candidates are recorded via AI transcription software for the purposes of refining compatibility matching and safeguarding — including ensuring the families our candidates enter are appropriate working environments. Both the audio recording and the text transcript are retained for the duration of the active relationship and for 5 years thereafter. Recordings are used internally only and are not shared with either party.
• With your consent only, Kiddobee measures how the website and platform are used (pages visited, features used, navigation patterns) through Google Analytics, in order to improve the service (see section 13).
• Occasional communications about Kiddobee activities
• Satisfaction surveys and performance statistics

5.3 For leads sourced from publicly available sources

Where Kiddobee identifies a prospective client through publicly available online sources, the data collected (typically name and contact details) is used solely to make initial contact and present Kiddobee’s services. It is kept in accordance with the retention periods for prospects set out in section 7.2. The legal basis for this processing is legitimate interest (Article 6(1)(f) GDPR).

5.4 Algorithmic matching

Kiddobee uses a matching algorithm based on compatibility criteria including personality fit to rank candidate profiles for review by a Kiddobee advisor. This is a decision-support tool only. The advisor selects which profiles to present to the client family, who retains full discretion to accept or decline any proposed provider before any assignment is confirmed. This processing does not constitute automated decision-making within the meaning of Article 22 GDPR.

6. Use of AI Tools

Kiddobee uses AI-powered tools to support certain internal operations. Where such tools involve personal data, Kiddobee ensures:

• Only strictly necessary data is shared (data minimisation)
• Data processing agreements (DPAs) are in place with all third-party processors under Article 28 GDPR
• Personal data is not used to train third-party models
• All transfers outside the EU are governed by appropriate safeguards (see section 11)
• A list of third-party tools used as data processors, including AI transcription software, is available on request from our DPO

For more information, contact our DPO.

7. Retention Periods

7.1 Candidates and providers

• Unsuccessful candidate: 2 years from interview date
• Successful candidate: 3 years from interview date
• Provider who has worked with Kiddobee: 5 years from end of relationship
• B3 / declaration on honour: not retained beyond verification; employer may note that verification was carried out
• Meeting audio recordings and transcripts: retained for the duration of the active relationship and for 5 years thereafter, in line with applicable civil liability limitation periods

7.2 Prospects and clients

• Prospect: 3 years from last contact
• Client: 5 years from last activity
• Meeting audio recordings and transcripts: retained for the duration of the active relationship and for 5 years thereafter

Beyond these periods, data may be anonymised for statistical purposes.

8. Recipients of Personal Data

• Authorised Kiddobee staff: recruitment, provider management, payroll, administrative declarations, client relations, marketing
• The named référent (Kiddobee employee) assigned to each client account: their name and contact details are shared with the client as required by the SAP regulatory framework
• Technical subcontractors providing services to Kiddobee under DPA (hosting, CRM, communication tools, AI transcription software)
• The CAF (Caisse d’Allocations Familiales): where Kiddobee files monthly CMG declarations on behalf of client families under a mandate, the relevant family and childcare data is transmitted to the CAF for the purpose of calculating and paying the aide
• Administrative, tax and judicial authorities where legally required (URSSAF, DREETS, etc.)

Kiddobee never sells personal data to third parties for commercial purposes.

9. Your Rights

Under the GDPR and French Data Protection Act, you have the right to:

• Access: obtain a copy of your data and information about how it is processed
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion where permitted by law
• Restriction: suspend use of your data in certain circumstances
• Object: object to specific processing, in particular for direct marketing or processing based on legitimate interest
• Portability: receive your data in a structured, machine-readable format
• Not be subject to automated decision-making: Kiddobee’s matching algorithm supports a human advisor’s decision; the client family makes the final choice. This does not constitute automated decision-making under Article 22 GDPR
• Withdraw consent: at any time, for processing based on consent (including analytics cookies)
• Post-mortem instructions: specify what happens to your data after your death

To exercise any right, contact the DPO with proof of identity: hello@kiddobee.com or DPO Kiddobee – 77 Rue Martre, 92110 CLICHY. Response within one month (extendable by two months for complex requests).

You may also lodge a complaint with the CNIL – 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 – www.cnil.fr

10. Security Measures

• DPO appointed since incorporation
• Staff training on data protection and confidentiality
• Strict confidentiality obligations for all providers and advisors
• Regular security audits
• Access controls and authorisation management
• Data processing agreements (DPAs) in place with all subcontractors processing data on Kiddobee’s behalf
• CNIL notification within 72 hours of any personal data breach

11. International Data Transfers

Some Kiddobee service providers may be established outside the EU, including Google LLC (Google Analytics) and providers of AI transcription and CRM tools. In such cases, Kiddobee ensures appropriate safeguards under Articles 46 et seq. GDPR, in particular Standard Contractual Clauses (SCCs) adopted by the European Commission. Details available from the DPO on request.

12. Changes to This Policy

Kiddobee may update this policy at any time to reflect regulatory, technical or organisational changes. Significant changes will be communicated by email or on our website. The date of last update appears at the top of this document.

13. Cookies and Analytics

Kiddobee’s website uses cookies and similar tracking technologies. Cookies are small files stored on your browser when you visit a website.

We use the following categories:

• Strictly necessary cookies (no consent required): a session cookie to keep you logged in, and a cookie storing your language preference. These are essential for the site to function and are set automatically.
• Analytics cookies (consent required): we use Google Analytics 4 (Google LLC, USA) to measure how visitors use our website. This sets two cookies (_ga and a site-specific variant) that remain in your browser for up to 13 months. Analytics cookies are only set after you have given your explicit consent via the cookie banner displayed on your first visit. You may withdraw consent at any time by clicking “Cookie settings” in the site footer.

Google Analytics transfers data to Google servers in the United States. This transfer is governed by Standard Contractual Clauses between Kiddobee and Google. For more information, see Google’s privacy policy at policies.google.com/privacy.

This measurement covers both visitors and logged-in users (pages visited, features used, navigation patterns). If you refuse analytics cookies, no usage data is sent to Google Analytics.

Kiddobee SAS – 77 Rue Martre, 92110 CLICHY – hello@kiddobee.com – RCS Nanterre 930 459 235