Privacy policy

1. Data controller

For website enquiries and general service contact, Ilum Kids also uses info@ilumkids.com.

2. Information we collect

From parents, guardians and clients we may collect name, telephone/WhatsApp, email, address or area, preferred language, contact preferences and booking information. For Kids English we may collect a child’s name, date of birth, sex, languages and class selection.

Where a parent or guardian chooses to provide it, we may also process allergies, medical conditions, medication, dietary requirements and additional or SEN needs. These are special categories of personal data and receive enhanced protection.

For staff applicants we may collect identity and contact details, nationality, address, languages, experience, qualifications, availability and safeguarding information, including the Sexual Offences Certificate where required.

3. Purposes and legal bases

• Providing childcare, tutoring, Kids English classes and events: performance of a contract or steps requested before a contract.
• Managing enquiries, bookings, availability, quotes and payments: contract and legal obligations.
• Keeping a child safe using health, allergy and SEN information: explicit consent and, where legally applicable, protection of vital interests.
• Service communications through email, telephone or WhatsApp: performance of the service or consent where required.
• Marketing or social-media images: separate, explicit consent. Booking consent never implies image consent.

4. Recipients and processors

We share only the information needed to provide the requested service with assigned collaborators who are bound by confidentiality. Our website is hosted through Vercel and booking/CRM records are stored in Notion. WhatsApp or email providers may process messages when you choose to contact us through those channels. Payment providers will be identified at the point a payment service is activated.

We do not sell personal data and may disclose information to public authorities where legally required.

5. International transfers

Some technology providers may process information outside the European Economic Area. Where this happens, appropriate safeguards such as an adequacy decision or Standard Contractual Clauses should be verified for the specific provider before publication.

6. Retention

We retain information for the duration of the family or service relationship and for the periods required by accounting, tax, safeguarding and legal obligations. Marketing consent is retained until withdrawn. Afterwards, information is securely deleted or anonymised.

7. Your rights

You may request access, rectification, erasure, restriction, objection and portability, and withdraw consent at any time without affecting earlier lawful processing. Contact info@ilumkids.com and include enough information to identify your request. You may also complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Children and image rights

We only process a child’s information when provided by a parent or legal guardian who confirms parental authority. Photos and videos are used only with separate consent, and consent can be withdrawn at any time.

9. Health data about a child (Art. 9)

What we collect: allergies, medical conditions, medication, dietary requirements and additional or SEN needs, only for the child the service is for, and only what a parent or guardian chooses to enter in the form.

Lawful basis: your explicit consent under Article 9.2.a GDPR, given through a separate checkbox that is specific to health data. It is never bundled with the privacy policy, the terms or the image-rights consent, and it is never pre-ticked. Where a life is at immediate risk, Article 9.2.c (vital interests) may also apply.

Purpose: keeping the child safe during the service, and nothing else. We do not use it for marketing, profiling or any automated decision-making.

Who can access it: only the members of staff assigned to that child — the teacher, carer or monitor attending them — plus the person who administers the booking records. It is not shared with other families, with other staff, or with anyone outside Ilum Kids, except where an emergency service needs it to treat the child.

How long we keep it: for as long as the child attends the service, and afterwards only for the period required to answer a safeguarding, insurance or legal claim. It is then deleted from our records. For the exact period that applies to your child, please email Adonia at info@ilumkids.com and she will confirm it for you.

How to withdraw consent: write to info@ilumkids.com at any time, or tell the member of staff attending your child. Withdrawal takes effect immediately, we delete the health data we hold, and it does not affect the lawfulness of what we did before. Please note that without this information we may not be able to guarantee your child's safety during the service, and we may need to discuss with you whether the service can continue.

This consent is required to book. We cannot look after a child whose allergies, medical conditions and medication we are not allowed to know, so a booking cannot be completed without it. If you would rather not enter this information into a form, contact us on WhatsApp or at info@ilumkids.com and we will arrange another way to give it to us.

10. Security and cookies

We apply access controls, confidentiality measures and reputable technology providers. This website uses necessary cookies and displays a consent notice before any non-essential analytics are activated. See the Cookie Policy for more information.

11. Changes

We may update this policy. The current version is published on www.ilumkids.com with its last-updated date.