Privacy Policy | CrecheFlow
CrecheFlow Privacy Policy
Edita Petrauskaite, trading as CrecheFlow ("CrecheFlow", "we", "us", "our"), is a sole trader registered in Ireland (Business Name No. 785771), with registered address at Scartaglen, Co. Kerry, Ireland, V93 R886. This Privacy Policy explains how we collect, use, and protect personal data when you visit our website (the "Site") or engage us to provide our Financial Administration Services under the CrecheFlow Services Agreement.
Two roles, two sections. CrecheFlow processes personal data in two distinct capacities, and this policy is split accordingly:
- As Data Controller - for data collected directly through this website (e.g. contact forms, enquiries, newsletter sign-ups).
- As Data Processor - for Client Data processed on behalf of childcare providers ("Clients") within the AcornCloud Platform, under the terms of our Services Agreement and Data Processing Agreement (DPA).
1. Who We Are
| Trading name | CrecheFlow |
|---|---|
| Legal status | Sole trader (Edita Petrauskaite), Business Name No. 785771 |
| Registered address | Scartaglen, Co. Kerry, Ireland, V93 R886 |
| Contact email | [email protected] |
2. Section A - Website Visitors (CrecheFlow as Data Controller)
2.1 What data we collect
The Site is an informational and marketing website only - it does not host client logins, portals, or online payments. When you visit or interact with the Site (for example, by submitting an enquiry form), we collect:
- Your name;
- Your email address;
- Your phone number;
- The CrecheFlow service you are enquiring about;
- Any correspondence you send us directly (e.g. by email).
2.2 Cookies
The Site does not use cookies or other tracking technologies, and no analytics, advertising, or similar tools are deployed.
2.3 Why we process this data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to enquiries submitted via the Site, including about the service named in your enquiry | Legitimate interests / steps prior to a contract |
| Providing information about our Services to prospective Clients | Legitimate interests |
| Maintaining Site security and preventing misuse | Legitimate interests |
2.4 Who we share it with
We do not sell personal data collected via the Site, and we do not share it with third parties except in the limited circumstances below:
- Microsoft 365, which hosts our email ([email protected]) and receives any enquiries sent through the Contact Us page;
- GoDaddy, our domain registrar;
- Cloudflare, which provides security and infrastructure services for the Site;
- Professional advisers (e.g. legal, accountancy) where necessary;
- Regulators or law enforcement, where required by law.
2.5 International transfers
The Site is directed at visitors in Ireland. However, the third-party providers listed in Section 2.4 - Microsoft 365, GoDaddy, and Cloudflare - are US-headquartered and may process data outside the European Economic Area (EEA) as part of providing their services. Where this occurs, each provider relies on the following GDPR transfer safeguards, as published in their own data protection documentation:
- Microsoft 365: relies on the Standard Contractual Clauses, incorporated into Microsoft's Online Services Terms as the basis for transferring data outside the European Economic Area.
- GoDaddy: for transfers to the United States, relies on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions); where DPF coverage is unavailable, transfers are instead made under a data protection addendum incorporating Standard Contractual Clauses.
- Cloudflare: relies on its certification under the EU-U.S. Data Privacy Framework (and the Swiss-U.S. and UK extensions) for transfers to the United States, with Standard Contractual Clauses incorporated into its standard Data Processing Addendum as an additional safeguard.
These mechanisms are each provider's own published safeguards as of the date of this policy and are subject to change; we recommend periodically checking each provider's current data protection documentation to confirm this remains accurate.
2.6 How long we keep it
We retain enquiry data (name, email, phone number, and service enquired about) for 12 months from the date of your enquiry, unless it becomes part of an ongoing Client relationship, in which case it is retained as part of that relationship's records. After 12 months, if no engagement has followed, we delete the data.
3. Section B - Client Data (CrecheFlow as Data Processor)
Where CrecheFlow provides Financial Administration Services to a childcare provider ("Client") under the CrecheFlow Services Agreement, CrecheFlow acts solely as a Data Processor. The Client is and remains the Data Controller of all personal data relating to children, parents, guardians, and staff processed via the AcornCloud Platform ("Client Data").
3.1 What this means in practice
- CrecheFlow only processes Client Data on the Client's documented Written Instructions, and solely for the purpose of providing the Services described in the Services Agreement (invoice generation, payment allocation, funding reconciliation, etc.), all performed exclusively within the AcornCloud Platform.
- CrecheFlow does not determine the purposes or means of processing this data - that responsibility, including establishing a lawful basis, providing privacy notices to parents/guardians, and handling data subject rights requests, sits with the Client.
- CrecheFlow's detailed obligations as Data Processor are set out in our Data Processing Agreement (DPA), available at crecheflow.ie/legal/dpa, which forms part of the Services Agreement.
3.2 If you are a parent, guardian, or staff member of a CrecheFlow Client
If your personal data has been processed via the AcornCloud Platform in connection with your child's childcare provider, please direct any privacy queries, access requests, or objections to your childcare provider directly, as they are the Data Controller responsible for your data. CrecheFlow is not able to action data subject requests independently, as it has no direct relationship with you and acts only on the Client's instructions.
4. Section C - Client Billing Data (Payment Collection)
To collect Service Fees under the CrecheFlow Services Agreement, CrecheFlow uses GoCardless as its payment provider. This involves sharing the Client's (or Authorised Representative's) name, contact details, and bank account details with GoCardless, so that a Direct Debit mandate can be set up and Service Fees collected under the Agreement.
GoCardless acts as an independent Data Controller for this payment data, not as a processor on CrecheFlow's behalf - this is consistent with GoCardless's own published position on its regulatory role as a payments provider (in the same category as providers such as PayPal, Stripe, and Visa). This means GoCardless is directly responsible for how it handles this data, and you may need to contact GoCardless directly for certain requests relating to your payment data. GoCardless's own privacy information is available at gocardless.com/legal/privacy.
Legal basis: performance of the CrecheFlow Services Agreement (necessary to collect payment for Services provided).
International transfers: GoCardless processes European payments primarily on servers within the EEA, with its EU services provided by GoCardless SAS (France) under a French financial services licence, and its UK headquarters in London. Where data is transferred outside the EEA, GoCardless applies its own safeguards, as set out in its own privacy documentation.
5. Data Security
CrecheFlow implements industry-standard technical and organisational security measures to protect personal data we process, in both our Controller and Processor capacities. However, no system can be guaranteed 100% secure, and we encourage you to take appropriate precautions when sharing information online.
6. Your Rights
Where CrecheFlow acts as Data Controller (Section A above), you have the right, subject to certain conditions, to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request erasure of your data;
- Object to or restrict certain processing;
- Request data portability;
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with the Irish Data Protection Commission (DPC) - see Section 8.
To exercise any of these rights, contact us at [email protected].
If your data has been processed as Client Data under Section B, please see Section 3.2 above - these requests should be directed to the relevant childcare provider, not CrecheFlow.
7. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be highlighted where appropriate.
8. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve the issue.
You also have the right to lodge a complaint with the Irish Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
9. Contact Us
CrecheFlow
Scartaglen, Co. Kerry, Ireland, V93 R886
Email: [email protected]