Privacy Policy

1. Who We Are

Childcare Waitlist ("we", "us", "our") operates the website at childcarewaitlist.ie. We are the data controller responsible for your personal data. If you have questions about this policy or your data, contact us at hello@childcarewaitlist.ie.

2. What Data We Collect

Parents

• Full name, email address, phone number (optional)
• Street address and Eircode
• Child's name, date of birth (or expected due date), and desired creche start date
• Waitlist application notes (you should not include medical or health information in notes)

Creche Administrators

• Creche name, business address, Eircode, phone, email
• Opening hours, care types provided, pricing information, website
• Admin contact name and email

Automatically Collected

• We set a strictly necessary login cookie (auth_token) when you sign in. This expires after 1 hour and is required for the service to function.
• We store your theme preference (light/dark) in your browser's local storage.
• Our hosting provider (Cloudflare) processes standard web request logs (IP address, browser type, pages visited) for security and performance purposes.

3. Why We Collect It (Lawful Basis)

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contractual necessity (Art. 6(1)(b)) — To provide the waitlist management service you signed up for: matching parents with creches, managing applications, and communicating application status updates.
• Legitimate interest (Art. 6(1)(f)) — To maintain security, prevent fraud, and improve our service. You can object to processing based on legitimate interest by contacting us.

4. How We Use Your Data

• Create and manage your account
• Process waitlist applications between parents and creches
• Send transactional emails (application status updates, password resets)
• Match parents with nearby creches using Eircode/location data
• Enable creche administrators to manage their waitlists

5. Who We Share Data With

We share your data only with the following service providers ("processors") who act on our instructions. All processors are bound by data processing agreements:

When you apply to a creche waitlist, the creche administrator can see your name, email, phone, address, Eircode, and your child's details. This is necessary to manage your application.

6. Children's Data

We collect children's names and dates of birth solely to manage creche waitlist applications. This data is provided by parents/guardians and is only shared with creches where an application is made. We do not knowingly collect data directly from children. Please do not include sensitive information such as medical conditions or health data in application notes.

7. Cookies & Local Storage

We only use strictly necessary cookies and storage:

We do not use any analytics, advertising, or tracking cookies. All fonts are served from our own servers — no requests are made to third-party font services.

8. Data Retention

• Your account data is kept for as long as your account is active.
• If you delete your account, all personal data is permanently removed.
• Waitlist history records are retained in anonymised form for service improvement.
• Email logs are retained for up to 12 months for troubleshooting, then deleted.

9. Your Rights

Under GDPR and the Irish Data Protection Act 2018, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Ask us to correct inaccurate data
• Erasure — Ask us to delete your data ("right to be forgotten")
• Restriction — Ask us to limit how we process your data
• Portability — Receive your data in a portable format
• Object — Object to processing based on legitimate interest

To exercise any of these rights, email hello@childcarewaitlist.ie. We will respond within 30 days.

10. Data Security

• All data is transmitted over HTTPS (TLS encryption)
• Passwords are hashed and managed by Supabase Auth (never stored in plaintext)
• Database access is protected by Row Level Security — users can only access their own data
• Authentication cookies are HttpOnly and SameSite-protected
• Our database is hosted in the EU (Frankfurt, Germany)

11. International Transfers

Your data is primarily stored and processed within the European Union. Where our processors operate globally (e.g., Cloudflare's CDN), they do so under Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.

12. Complaints

If you're unhappy with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission:

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. The "Last updated" date at the top of this page will always reflect when it was last revised.