Data gathering for kindergartens and schools parties
Dear sirs,
I have a small seasonal business as organizing Santa Claus parties to kindergartens and schools. Thus, I get lists of personal data of the children (name, surname and age) to be able to personalize the gifts. Also I get personal data of the teachers for the same purposes.
I would appreciate your help with the following:
1. Are there any specific things that I need to include in the contract?
2. According to the GDPR what is my company a controller or a processor?
3. Do I need to register somewhere if I process personal data?
4. Are there any specific requirements for handling data of children?
5. During the events sometimes my crew takes pictures and posts it on social media. Are there any restrictions?
6. How much time do I need to keep the lists whit the children`s names and age?
Thank you
Assign topic to the user
EU GDPR DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more 
EU GDPR DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
EU GDPR DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
1. Are there any specific things that I need to include in the contract?
Yes, as long as you are processing personal data you should have some specific wording in the contract to cover the part where you are processing personal data. Usually, this is a separate addendum to the commercial contract called a Data Processing Agreement
2. According to the GDPR what is my company a controller or a processor?
Based on your description you seem to be acting as a data processor as you do not determine the means and purposes of the processing but rather the entities that contract you. If you want to find out more about controllers and processors check out this article EU GDPR controller vs. processor – What are the differences? (https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/)
3. Do I need to register somewhere if I process personal data?
The registration to local Supervisory Authorities is not required under the GDPR however, this can be regulated by local legislation. I would advise you to check the website of the Supervisory Authority where your company is registered.
4. Are there any specific requirements for handling data of children?
There are some specifics that involve the permission of the parents or legal guardians. However, since you are acting as a processor as long as you process the data on the instructions of the controllers you should not be concerned.
5. During the events sometimes my crew takes pictures and posts it on social media. Are there any restrictions?
I would advise blurring the faces of the children when posting pictures on social media. Alternatively, you could obtain consent from the parents of the children in the photo.
6. How much time do I need to keep the lists whit the children`s names and age?
I would delete the data right after using it during the show. You do not need it afterwards and keeping it would expose you to unnecessary risks.
If you want to find out more about the EU GDPR check out this EU GDPR Foundation Course (https://advisera.com/training/eu-gdpr-foundations-course//)
Comment as guest or Sign in
Dec 17, 2019