PERSONAL DATA PROTECTION POLICY

Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten

Public version | current as of 15 September 2026

1. Who we are

Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten is the data controller for the processing activities it carries out in connection with the admission and education of children, contractual relations with parents, health and organisational care, human resources, security, accounting, relations with suppliers and compliance with legal obligations.

Personal data protection contacts

Administrator: Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten

Address: 28 Chervena Stena St., Lozenets District, 1421 Sofia, Bulgaria

E-mail: tuti@tuti-bg.com | Tel.: +359 876 999 030

DPO: dpo@tuti-bg.com

Correspondence address: 28 Chervena Stena St., Sofia, Bulgaria

2. Core principles

We process personal data lawfully, fairly and transparently, only for specified purposes and to the extent necessary. We keep data accurate, limit retention periods and apply appropriate confidentiality and security measures. Children’s data and special categories of personal data, including health data, are subject to enhanced protection and access on a need-to-know basis.

3. What categories of data we process and for what purposes

  • data relating to enquiries and admission – names, contact details, age/date of birth and information necessary to organise the admission process;

  • data relating to enrolment and education – identification, contact and contractual data, declarations, attendance/absences, pedagogical observations and reports;

  • data necessary for the safe handover of the child and communication with parents/legal representatives;

  • financial and accounting data – fees, invoices, payments, compensation and statutory reporting;

  • health data – medical documents and necessary information concerning allergies, chronic conditions, special diets, medication, medical monitoring and infectious diseases;

  • data relating to a psychologist, speech therapist, special educational needs and developmental support, where applicable;

  • photographs and video outside the CCTV system – according to the specific purpose and applicable legal basis;

  • CCTV recordings for safety, security and clarification of specific incidents;

  • data relating to job applicants, employees, suppliers and contractors;

  • data relating to complaints, requests to exercise rights, incidents and correspondence with competent authorities.

4. Legal bases

Depending on the specific processing activity, we rely on the applicable legal bases under Article 6 GDPR – performance of a contract or steps taken prior to entering into a contract, compliance with a legal obligation, protection of vital interests, legitimate interests and, where necessary, consent. For special categories of personal data, including health data, we also apply the relevant legal basis under Article 9 GDPR. We do not request consent where the processing is necessary on another valid legal basis.

5. When we use consent

Where a specific optional activity is based on consent – for example, certain photographs, videos or public posts – consent is specific and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal and does not affect processing based on another valid legal basis.

6. Sources of data

We obtain data directly from a parent/legal representative, from the child depending on age and the specific activity, from applicants, employees, contractors, teachers and medical professionals in the performance of their duties, competent authorities and official systems, external specialists in accordance with the applicable procedure, and through CCTV in designated areas.

7. Recipients and data processors

Data are disclosed only where there is a legal basis and only to the extent necessary. Recipients may include the Ministry of Education and Science, Regional Education Department, National Electronic Information System for Preschool and School Education, municipality, Regional Health Inspectorate, National Revenue Agency, National Social Security Institute, banks, courts, Ministry of Interior, Prosecutor’s Office and other competent authorities; accounting/payroll service providers, external specialists and providers of IT, cloud, CCTV and other services. Where a service provider processes personal data on our behalf, the relationship is governed in accordance with GDPR requirements.

8. International transfers

Where a technology service used by us involves processing of data outside the European Economic Area, we apply the requirements of Chapter V GDPR and the relevant permitted transfer mechanism.

9. Retention periods

We do not apply one single retention period to all personal data. The period is determined according to the purpose, type of document, applicable statutory requirements and the need to establish, exercise or defend legal claims. Once the legal basis no longer applies, the data are securely erased or destroyed. CCTV recordings are generally retained for up to 30 days, unless a specific excerpt is required in connection with an incident, request, inspection, proceedings or legal defence.

10. Your rights

  • right to information and access;

  • right to rectification;

  • right to erasure where the statutory conditions are met;

  • right to restriction of processing;

  • right to data portability, where applicable;

  • right to object where the relevant legal grounds apply;

  • right to withdraw consent for processing based on consent;

  • rights relating to automated decision-making under Article 22 GDPR, where applicable.

These rights are not absolute. For example, a document that the kindergarten is legally required to retain, or that is necessary for the establishment, exercise or defence of legal claims, cannot be erased.

11. How to exercise your rights

You may submit a request to dpo@tuti-bg.com, to tuti@tuti-bg.com or by post to: 28 Chervena Stena St., Lozenets District, 1421 Sofia, Bulgaria. We may request only the information necessary to verify your identity or authority to act as a representative. As a rule, we respond without undue delay and within one month; under the conditions provided by the GDPR, this period may be extended by up to a further two months.

12. CCTV

CCTV without audio recording is operated in designated areas for the safety of children and staff, security of the premises and clarification of specific incidents. Parents do not have permanent or live access to the system. Detailed information is published in the separate “CCTV Policy / Information Notice”.

13. Automated decision-making

As of the date of this Policy, TUTI Private Kindergarten does not carry out solely automated individual decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects them.

14. Security

We apply appropriate technical and organisational measures, including role-based access, the need-to-know principle, protection of paper records, individual user accounts, supplier controls, backups, staff training and procedures for personal data breaches.

15. Right to lodge a complaint

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, e-mail: kzld@cpdp.bg, and to seek judicial remedy in accordance with applicable law.

16. Updates

This Policy is reviewed and updated whenever there is a material change in the processing activities, purposes, legal bases, recipients, retention periods or applicable legal requirements. The current public version is made available on the website of TUTI Private Kindergarten and/or by other appropriate means.