Kidzo Aquarium privacy policy

Effective from: [DATA] · draft pending legal review

This is a translation for convenience. The binding version is the Polish one.

1. Who is the data controller

The data controller is [IMIĘ I NAZWISKO], running a business under the name [NAZWA FIRMY], [ADRES], NIP (tax ID) [NIP] (“Kidzo”, “we”). Contact on personal data matters: kontakt@kidzo.pl.

2. What Kidzo Aquarium is

Kidzo Aquarium is a service for cafés, play centres and similar places (the “Venue”). A child colours a fish on a colouring sheet, and a parent or guardian takes a photo of the sheet with a phone and sends it to the aquarium shown on the screen at the Venue. We do not run user accounts and do not ask for a name, surname, e-mail or phone number.

3. What data we process

The drawing — the fish cut out of the colouring sheet (an image) and the type of fish. Please make sure there are no faces, names or other data in the photo — we only recognise the sheet.
Data of the device sending the drawing: IP address, browser and operating system name and version (User-Agent and so-called Client Hints, including — if the browser provides it — the phone model), browser languages, screen resolution, time zone, date and time of sending.
Device identifier — a random string stored in the kzd cookie. It contains no information about a person.
Technical data of the server (connection logs) — to the extent necessary for the service to work and be secure.

4. For what purpose and on what legal basis

Displaying the fish in the Venue's aquarium and providing the “My fish” page — Art. 6(1)(b) GDPR (providing the service requested by the sender) and (f) (legitimate interest of the Venue and Kidzo in running an attraction for guests).
Protection against abuse — e.g. against sending offensive or unlawful content to a screen in a public place, including establishing and pursuing claims and passing information to the competent authorities — Art. 6(1)(f) GDPR (legitimate interest). Device data and the kzd identifier serve this purpose.
Confirming that the sender is at the Venue (the number on the screen) and remembering the device for 2 hours — Art. 6(1)(f) GDPR.

5. How long we keep data

We keep the drawing, the device data and the “My fish” link for 90 days from sending, and then delete them automatically. A fish that did not reach the screen (e.g. the number was not entered) is deleted as soon as the waiting time runs out. The kzd cookie expires after 12 months. If the data is needed to report a breach of law to law enforcement, we may keep it until such proceedings end.

6. Who we share data with

The Venue where the fish was shown sees the drawing (on the screen and in the staff panel) — it does not see the device data.
Server provider: Contabo GmbH, Germany — processes data on our behalf on servers in the European Union.
Competent authorities (e.g. the Police, the prosecutor's office) — only when required by law or necessary to report a crime.

We do not transfer data outside the European Economic Area, do not sell it, do not profile and do not use it for advertising. There are no third-party analytics or advertising scripts on the pages.

7. Cookies

kzd — device identifier (security and the number on the screen), 12 months.
kzs_… — Venue staff panel session, 30 days (staff only).
kza — Kidzo administrator session, 12 hours.

In browser storage (localStorage) we also save the chosen page language and the aquarium screen identifier on the Venue's computer.

8. Children

Drawings are made by children, but they are sent by a parent or guardian from their own phone. We do not collect data identifying the child. If you want a drawing to be deleted earlier — write to us with the “My fish” link.

9. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing and to object to processing based on legitimate interest. Since we do not know your identity, we will need the “My fish” link or the date, time and Venue to handle a request. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. Contact form on kidzo.pl

If you run a venue and fill in the contact form, we process the data you enter: your name, the venue's name and city, phone, e-mail and message, as well as the IP address, browser and time of sending (spam protection). We do this to reply to your enquiry and present our offer — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and (f) (legitimate interest in correspondence). We also keep notes from our calls. Only Kidzo sees this data. If we do not sign a contract, we delete it 12 months after the last contact, or earlier at your request.

11. Changes

We announce changes to this policy on this page, giving the date of the new version.