GDPR Compliance and Data Privacy

At Enrollio, we're committed to protecting your privacy and the privacy of the families you serve. We're certified under the EU Data Privacy Framework, which demonstrates our dedication to securing your personal data when you use our platform.

The documents below explain our role as a data processor, your role as a data controller, and the steps we take to keep your data secure. Review these documents alongside our Privacy Policy, and consult with a legal specialist if you need specific advice.

Important Documents

  • Enrollio's Privacy Guide for Customers
  • Enrollio's Security and Compliance Overview
  • Privacy Policy
  • Data Processing Agreement
  • Sub-Processors
  • Data Deletion Requests
IMPORTANT: Review these guidelines carefully. We follow strict standards to ensure compliance and protect your data. If you have questions or need to discuss your specific needs, contact us through our customer support portal.

Introduction

Enrollio is committed to protecting the privacy of childcare providers and the families they serve. We stay current with developments in data protection laws so you can feel confident about your data security while using our platform.

This guide explains what the rules are, how they apply to your use of Enrollio, and the steps we've taken to comply. Review this document alongside our Privacy Policy and contact a legal professional if you need more information or advice.

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is an EU regulation that harmonizes data protection and privacy laws across the EU. The GDPR applies wherever personal data of an EU data subject is involved.

The GDPR gives individuals more control over how their data is used by companies, and makes data collection and processing more transparent. Following Brexit, the GDPR was incorporated directly into UK law as the 'UK GDPR', meaning UK childcare businesses still need to comply with its provisions.

Basic GDPR Concepts

Controller and Processor

The GDPR imposes different obligations depending on whether you're a controller or a processor of personal data.

A controller is an entity that decides to process personal data and makes decisions about how and why that processing happens. Controllers have specific obligations regarding personal data that you should understand before collecting information from parents and families.

A processor is an entity that processes data on behalf of a controller. Processors don't make independent decisions about the data — they only process it according to the controller's instructions.

Your Role: When you use Enrollio, you are a controller. You control what data you upload to Enrollio, what you do with that data, and why. You're responsible for ensuring you have a legal basis to process the data and that you don't retain it longer than necessary.

Enrollio's Role: Enrollio is a data processor. We store and manage the data you've collected, following your instructions. We never use any personal data you've uploaded to Enrollio for our own purposes or without your instruction.

Before using Enrollio, make sure you understand your obligations as a controller. Update your own systems and policies to allow the lawful transfer of personal data to Enrollio.

Legal Basis for Processing

You can only collect and process personal data if you have a legal basis for doing so. The allowable legal bases are set out in the GDPR.

As a processor, Enrollio relies on you to select the correct basis under which you'll collect and process personal data, and to put the appropriate notices and consents in place.

Before You Start: Take time to identify which legal bases are available to you. Only collect and retain personal data to the extent necessary to carry out that basis. You shouldn't change the basis under which you've collected personal data without very good reason, so it's important to select the right one from the start.

Data Subject Access Rights

The GDPR grants data subjects (the parents and families in your system) certain rights relating to their personal data, including the right to access, correct, and/or delete any data relating to them.

Enrollio has easy systems in place for you to inform us if you receive such a request from a parent or family member. We'll ensure that these requests are promptly complied with, following your instructions.

You should familiarize yourself with the obligations imposed on you, including those relating to any personal data you hold in your own systems or in services other than Enrollio.

Transfers of Data to the USA

Personal data may not be transferred outside the EEA except under specific circumstances. We utilize the Standard Contractual Clauses as part of our Data Processing Agreement, which we sign with all of our customers.

Data Security

We've put strong security safeguards and measures in place to ensure that any personal data we hold is stored securely:

  • We regularly test our platform for bugs and vulnerabilities
  • We maintain regular back-up systems
  • We have data recovery and data integrity systems and processes to minimize risk of corruption or loss of personal data

Steps We've Taken to Ensure GDPR Compliance

We take our duties as a processor very seriously. We've put in place numerous procedures and taken steps to ensure that we remain compliant with the GDPR and that you can lawfully send personal data to us:

  • Our data processing agreement utilizes the Standard Contractual Clauses to ensure you can lawfully send personal data to us in the USA
  • We can detect personal data breaches and inform our customers as soon as possible
  • We can handle subject access requests and rights of erasure requests, and we inform you when a data subject makes such a request to us
  • We've assessed and documented the personal data we process on your behalf
  • We've assessed our security and upgraded where necessary to ensure it's appropriate for the level of risk we face in relation to a data breach

Pro Tip: As a childcare provider, you likely collect sensitive information about children and families. Make sure you understand your obligations under GDPR before collecting enrollment information, scheduling tours, or communicating with prospective families.

Need More Help?

If you have questions about GDPR compliance or how it applies to your childcare business, contact us through the support portal. For legal advice specific to your situation, consult with a qualified legal professional.