1. Introduction

Discover Me Academy (hereinafter: "DMA") is committed to protecting the privacy of children, parents, guardians, and all users of our services. We process personal data responsibly, lawfully, and solely for the purpose of providing our educational services and operating the parent portal.

By using our services and the parent portal, you confirm that you have read and understood this Privacy Policy.

2. What data we collect

We may collect the following categories of data:

Parent/guardian data

• first and last name
• address
• phone number
• e-mail address
• username
• encrypted password
• personal ID number or other identification data where required for legal obligations
• billing information

Child data

• first and last name
• date of birth
• kindergarten group
• photographs
• video recordings made during activities
• developmental notes
• attendance records
• dietary and allergy information
• health information voluntarily provided by the parent for the child's safety
• information about people authorized to pick up the child

Financial data

• payment history
• outstanding balance
• issued invoices
• approved discounts or subsidies
• refunds

System usage data

• IP address
• login time
• device type
• web browser
• activity logs for system security purposes

3. Photos and video content

Photographs and video recordings may be taken during children's time at the kindergarten for educational purposes.

Photos are made available exclusively to parents through the protected parent portal.

DMA will not publicly publish photos of children without the appropriate consent of a parent or guardian, except where permitted by applicable law.

Parents are responsible for not publicly sharing or otherwise using photos downloaded from the parent portal in a way that could infringe on the privacy of other children or families.

4. Communication through the parent portal

The parent portal enables:

• messaging with teachers
• viewing announcements
• viewing photos
• financial overview
• attendance records
• other functionality DMA may introduce over time

Communication is retained for record-keeping and service-quality purposes.

5. Purpose of processing

Data is processed for the purpose of:

• delivering the educational program
• communicating with parents
• maintaining legally required records
• issuing invoices
• calculating payments
• organizing activities
• protecting children's safety
• improving the kindergarten's operations
• protecting the information system from misuse

6. Legal basis for processing

Data is processed on the basis of:

• the kindergarten's legal obligations
• performance of the contractual relationship with parents
• DMA's legitimate interest in system security
• parental consent, where required

7. Data security

DMA applies technical and organizational security measures including:

• encrypted user passwords
• HTTPS encryption
• access control over data
• backups
• server protection
• system access logging
• access limited to staff according to their authorization level

All staff with access to data are required to keep it confidential.

8. Data sharing

DMA will not sell or transfer personal data to third parties.

Data may be disclosed to:

• competent government authorities where required by law
• accounting and IT partners who process data solely on behalf of DMA and under appropriate protective measures
• other parties only with a legal basis or prior parental consent

9. Data retention

Data is retained for as long as necessary to:

• fulfill legal obligations
• exercise parents' rights
• protect children's interests
• maintain financial records
• ensure information-system security

Once the legal retention period expires, data is deleted or anonymized.

10. Rights of parents and guardians

Parents have the right to:

• request access to their data
• correct inaccurate data
• complete incomplete data
• request a restriction on processing where possible
• lodge an objection to processing in accordance with the law
• request deletion of data where legal conditions allow

Requests may be submitted via DMA's official e-mail address.

11. User accounts

Parents are responsible for:

• keeping their username and password safe
• logging out on shared/public computers
• not sharing access with other people

DMA is not responsible for unauthorized access resulting from a parent sharing their login credentials.

12. Cookies

The website and parent portal use technical cookies necessary for user login, system security, and the application working properly. A detailed list is available in our Cookie Notice.

13. Changes to this Privacy Policy

DMA reserves the right to amend this Privacy Policy in order to comply with legal requirements or improve its services.

A new version will be published on the website and parent portal.

14. Contact

For any questions regarding personal data protection, you can contact us at office@dma.ba or at Discover Me Academy's registered address, Avde Smajlovića 7 i 9, 71000 Sarajevo.

Last updated: August 2026.