I have a small seasonal business as organizing Santa Claus parties to kindergartens and schools. Thus, I get lists of personal data of the children (name, surname and age) to be able to personalize the gifts. Also I get personal data of the teachers for the same purposes.
I would appreciate your help with the following:
1. Are there any specific things that I need to include in the contract?
2. According to the GDPR what is my company a controller or a processor?
3. Do I need to register somewhere if I process personal data?
4. Are there any specific requirements for handling data of children?
5. During the events sometimes my crew takes pictures and posts it on social media. Are there any restrictions?
6. How much time do I need to keep the lists whit the children`s names and age?