PLENUA
+48 81 526 27 70

Privacy policy

Effective date: 16 October 2026

1. General information

Thank you for visiting the m.Kids website. We care about the privacy of parents and children, so in this document we explain in simple terms what personal data we process, for what purpose and on what legal basis, who we share it with, how long we keep it and what rights you have.

m.Kids is a network of private preschools (przedszkola) and nurseries (żłobki) in Poland. Our facilities are located in Lublin, Pruszków, Konstancin-Jeziorna and Warsaw (the Warsaw facility operates under the name Primrose). The m-kids.pl website is available in Polish, English and Ukrainian and is intended for parents and legal guardians.

This privacy policy covers personal data processed in connection with:

  • your use of the m-kids.pl website and its forms,
  • booking a visit through the Calendly tool,
  • contacting us by phone, email and messaging apps,
  • forms in our ads on Facebook and Instagram,
  • running the m.Kids profiles on Facebook and Instagram,
  • enrolling a child in a facility and concluding and performing a preschool or nursery agreement,
  • sending marketing information,
  • the use of cookies and similar technologies.

We do not run an online shop on the website, we do not create user accounts and we do not accept online payments.

This document fulfils the information obligation set out in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR). References to PKE mean the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej, PKE).

2. Data controller and contact details

The controller of your personal data is M KIDS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Lublin, ul. Agatowa 21, 20-571 Lublin, entered in the Register of Entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under KRS number 0001003264, NIP 5252932088, REGON 523708116 (hereinafter: M Kids sp. z o.o. or we).

For any matters relating to personal data, including exercising your rights, please contact us:

  • by email: a.kornienko@m-kids.pl,
  • by phone: +48 81 526 27 70,
  • by post: M Kids sp. z o.o., ul. Agatowa 21, 20-571 Lublin.

Please write “Personal data” in the subject line of your message, as this will help us reply quickly.

3. What data we process and why

Below we describe separately each situation in which we receive your data. We process only the data needed for the given purpose.

Where the data comes from. We receive most of the data directly from you. Data about the child and other persons (e.g. the other parent or legal guardian) is provided to us by the person who contacts us or concludes the agreement. We receive data from Calendly bookings and from forms in ads through those tools, and we collect information about how the website is used automatically by means of cookies.

Special categories of data. Please do not provide information about your child’s health or other specially protected data in forms and messages. The only exception is the question in the child enrolment form as to whether the child has a disability certificate or a certificate of special educational needs (section 3.6).

3.1. Contact form and arranging a visit

Using a short form on the website, you can arrange a visit to a facility or a meeting with the director, or ask us to call you back.

  • Data: the selected facility, the parent’s first name and surname, phone number, the child’s age and the content of your message, if you choose to add one.
  • Purpose: responding to your enquiry, contacting you by phone, presenting the offer of the selected facility and arranging a visit or meeting.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into an agreement) and Article 6(1)(f) GDPR (our legitimate interest, namely responding to your enquiry and handling the contact).

3.2. Registration for events and open days

On the website you can sign up for events and open days that we organise.

  • Data: the parent’s first name and surname, phone number, the child’s first name and age, and address.
  • Purpose: registering you for the event, organising it and contacting you about matters related to it, e.g. confirming attendance or informing you of a change of time.
  • Legal basis: Article 6(1)(b) GDPR (handling your registration for the event) and Article 6(1)(f) GDPR (our legitimate interest, namely organising the event, contacting participants and ensuring order and safety during the event).

3.3. Booking a visit through Calendly

You can book a visit yourself using Calendly, a tool provided by an external provider.

  • Data: first name and surname, email address, the selected date and time of the visit, and any information you enter in the booking form.
  • Purpose: booking and confirming the visit and contacting you about it, including if the visit is rescheduled or cancelled.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into an agreement) and Article 6(1)(f) GDPR (our legitimate interest, namely the efficient organisation of visits to our facilities).

3.4. Contact by phone, email and messaging apps

You can contact us by phone, email and messaging apps, e.g. WhatsApp, Telegram, Facebook Messenger or Instagram.

  • Data: the data you provide to us, e.g. first name and surname, phone number, email address, your profile name in the messaging app and the content of the correspondence. During phone calls we also process the number you are calling from and, if the call is recorded, the recording.
  • Purpose: answering questions, handling enquiries, arranging visits and ongoing communication.
  • Legal basis: Article 6(1)(f) GDPR (our legitimate interest, namely responding and communicating with you) and, where the contact concerns concluding or performing an agreement, also Article 6(1)(b) GDPR.

Call recording. Phone calls may be recorded, and we inform you of this at the start of the call. Recordings are used to document arrangements, maintain the quality of our service and establish, pursue or defend claims. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in achieving these purposes). If you do not want the call to be recorded, you can end the call and contact us by email or through a messaging app.

Messaging apps. When you use a messaging app, you also provide data to its provider, which processes it in accordance with its own terms of service and privacy policy.

3.5. Forms in ads on Facebook and Instagram

In our ads on Facebook and Instagram you can fill in a contact form provided by Meta Platforms Ireland Limited.

  • Data: most often first name and surname, phone number, email address, the selected facility and your answers to the questions in the form.
  • Purpose: contacting you in response to your submission, presenting the offer of the selected facility and arranging a visit.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into an agreement) and Article 6(1)(f) GDPR (our legitimate interest, namely responding to your submission). If you consent in the form to receiving marketing information, the basis for sending it is that consent: Article 6(1)(a) GDPR in conjunction with Article 398 PKE (section 3.7).

Meta also processes the data of people using its services for its own purposes, as a separate controller, in accordance with the Meta privacy policy.

3.6. Enrolling a child and concluding and performing a preschool or nursery agreement

You can pre-register your child using the enrolment form on the website. The agreement is concluded at the facility. We receive the data needed at both stages directly from parents or legal guardians.

Child enrolment form on the website

  • Data: the selected facility; first name and surname, phone number and email address of the parent or legal guardian (and of the other parent, if you provide them); the child’s first name and surname, home address, date of birth and PESEL number; information on whether the child has a disability certificate (orzeczenie o niepełnosprawności) or a certificate of special educational needs (orzeczenie o potrzebie kształcenia specjalnego).
  • Purpose: accepting the enrolment application, reserving a place at the selected facility, contacting you about the enrolment and preparing the agreement.
  • Legal basis: Article 6(1)(b) GDPR with regard to the data of the parents or legal guardians (steps taken at your request prior to entering into an agreement) and Article 6(1)(f) GDPR with regard to the child’s data (our legitimate interest, namely preparing the child’s admission to the facility). We process the information about a certificate on the basis of your explicit consent (Article 9(2)(a) GDPR), given by ticking this information in the form; providing it is voluntary.

Concluding and performing the agreement

  • Data: data of the parents or legal guardians and data of the child needed to conclude and perform the agreement, to keep the documentation required by law and for billing.
  • Purpose and legal basis:
    • concluding and performing the agreement: Article 6(1)(b) GDPR with regard to the data of the parents or legal guardians and Article 6(1)(f) GDPR with regard to the child’s data (our legitimate interest, namely providing the child with care, upbringing and education in accordance with the agreement),
    • keeping the documentation required by education law and by the regulations on the care of children under the age of 3, submitting data to the Educational Information System (SIO) and settling subsidies from the municipality: Article 6(1)(c) GDPR,
    • keeping accounting records and handling tax settlements: Article 6(1)(c) GDPR,
    • establishing, pursuing or defending claims: Article 6(1)(f) GDPR.

Data on health and special educational needs. We process information about the child’s health or special educational needs (e.g. official certificates, known in Poland as orzeczenia) only at the enrolment stage and during performance of the agreement, and only when it is necessary to ensure proper care for the child. The basis is your explicit consent (Article 9(2)(a) GDPR) or, where required by law, Article 9(2)(g) GDPR in conjunction with Article 6(1)(c) GDPR and the provisions of education law. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

3.7. Marketing

We send information about our offer, events and open days by email or text message (SMS), or share it by phone, only if you have given your prior consent.

  • Data: first name and surname, email address or phone number, and information about the facility you are interested in.
  • Purpose: sending information about the m.Kids offer, events and open days.
  • Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 398 PKE.

You can withdraw your consent at any time by writing to a.kornienko@m-kids.pl or by letting us know by phone. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

m.Kids ads shown to people who have visited our website (remarketing) use cookies only with your consent (Article 399 PKE in conjunction with Article 6(1)(a) GDPR). Details are described in sections 3.8 and 11.

3.8. Cookies and analytics

When you use the website, we use cookies and similar technologies.

  • Data: cookie and device identifiers, IP address, information about your browser and device, the subpages visited, the source of your visit to the website, how you use the website (e.g. clicks, scrolling and cursor movements), the selected language and your consent settings.
  • Purpose and legal basis:
    • ensuring the proper and secure operation of the website and remembering the selected language and consent settings (necessary cookies): storing these cookies does not require consent (Article 399 PKE), and we process the data on the basis of Article 6(1)(f) GDPR (our legitimate interest, namely keeping the website running and remembering your choices),
    • additional website features, visit statistics, website usability analysis (heatmaps and session recordings), measuring ad effectiveness and remarketing: only with your consent, on the basis of Article 399 PKE in conjunction with Article 6(1)(a) GDPR.

A description of the cookie categories, the tools we use and how to change your consent is provided in section 11.

3.9. Social media profiles

We run m.Kids profiles on Facebook and Instagram.

  • Data: profile name, profile picture, the content of comments, reactions and messages, and other data you make publicly available on your profile or provide to us when contacting us through these services.
  • Purpose: running the profiles, responding to comments and messages, informing you about the activities of our facilities and analysing profile statistics.
  • Legal basis: Article 6(1)(f) GDPR (our legitimate interest, namely running the profiles, communicating and promoting the activities of m.Kids).

With regard to profile statistics, we are joint controllers together with Meta Platforms Ireland Limited (Article 26 GDPR). At your request, we will provide information on the essence of the arrangement between the joint controllers. You can exercise your rights both with us and with Meta. More information on how Meta processes data can be found in the Meta privacy policy.

4. Children’s data

The m-kids.pl website is intended for adults, i.e. parents and legal guardians. We receive children’s data, such as first name or age, from their parents or legal guardians.

We do not knowingly collect data directly from children. If we learn that a child has provided us with their data without the involvement of a parent or legal guardian, we will delete it.

On the website, only the enrolment form asks about the child’s health or special educational needs: in it you can voluntarily indicate whether the child has a certificate. We process such data only in connection with enrolling the child and performing the agreement, in accordance with the rules described in section 3.6.

5. Data recipients

Your data may be received only by entities to which the transfer of data is necessary to achieve the purposes described:

  • entities operating m.Kids facilities, where the enquiry or submission concerns a given facility,
  • IT service providers, including the hosting and email provider and entities maintaining the website,
  • Google (Google Analytics, Google Tag Manager, office tools),
  • Microsoft (Microsoft Clarity),
  • Meta Platforms Ireland Limited (Meta Pixel, ads, forms in ads),
  • Calendly (booking visits),
  • providers of the messaging apps through which we communicate, e.g. Telegram and WhatsApp,
  • our accounting office and legal advisers,
  • public authorities, e.g. the municipality for the settlement of subsidies, and education authorities, including through the Educational Information System (SIO), only where required by law.

Some of these entities process data on our behalf and according to our instructions. Providers of advertising platforms and messaging apps also process data for their own purposes, as separate controllers, in accordance with their privacy policies.

6. Transfer of data outside the European Economic Area

Some of our providers, e.g. Google, Microsoft, Meta and Calendly, may process data in the United States or in other countries outside the European Economic Area (EEA).

In such cases, the data is transferred on the basis of the mechanisms provided for in Chapter V GDPR, in particular:

  • a European Commission decision finding an adequate level of data protection (Article 45 GDPR), including the decision on the EU-US Data Privacy Framework with regard to companies certified under this programme,
  • standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

At your request, we will provide information about the safeguards applied and how to obtain a copy of them.

7. Data retention period

We keep data only for as long as it is needed for the given purpose:

  • enquiries that did not result in an agreement (contact form, child enrolment form, Calendly, phone, email, messaging apps, forms in ads): 12 months from the last contact,
  • registrations for events and open days: 12 months after the event,
  • preschool or nursery agreement: for the duration of the agreement and, after it ends, until the limitation period for claims expires,
  • accounting and tax documents: 5 years from the end of the calendar year to which they relate, as required by law,
  • documentation required by education law and by the regulations on the care of children under the age of 3: for the period specified in those regulations,
  • marketing: until you withdraw your consent,
  • processing based on legitimate interest: until an objection is effectively raised or the purpose of processing is achieved,
  • phone call recordings: up to 12 months,
  • cookies: according to the validity period of the given cookie, up to 2 years, or until you withdraw your consent.

After these periods, we delete or anonymise the data.

8. Your rights

Under the terms set out in the GDPR, you have the right to:

  • access your data and receive a copy of it (Article 15 GDPR),
  • have your data rectified (Article 16 GDPR),
  • have your data erased (Article 17 GDPR),
  • restrict processing (Article 18 GDPR),
  • data portability with regard to data we process on the basis of consent or an agreement (Article 20 GDPR),
  • object to processing based on our legitimate interest, including direct marketing (Article 21 GDPR),
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR),
  • lodge a complaint with a supervisory authority (Article 77 GDPR).

Objection. If we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation. We always respect an objection to processing for direct marketing purposes.

Withdrawing consent. You can withdraw your consent to marketing by writing to a.kornienko@m-kids.pl or by letting us know by phone. You can change your cookie consent at any time using the cookie settings button on the website. You can withdraw other consents by contacting us as described in section 2.

How to exercise your rights. Simply contact us as described in section 2. We respond without undue delay and no later than one month after receiving the request. Due to the complexity or number of requests, this period may be extended by a further two months, in which case we will inform you within one month of receiving the request. To protect your data, we may ask for information that allows us to confirm the identity of the person making the request.

Complaint. If you believe that we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

9. Voluntary provision of data

Providing data on the website and when contacting us is voluntary. However, without contact details we will not be able to respond to your enquiry or arrange a visit.

Providing the data needed to conclude an agreement is a condition for concluding it. To the extent required by law (e.g. regarding preschool and nursery documentation), providing data is mandatory when a child is admitted to a facility.

Giving consent to marketing and to cookies other than necessary cookies is voluntary.

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

The advertising platforms we use (e.g. Meta) may tailor the ads displayed based on cookie data only if you have consented to this in the cookie banner. Such tailoring does not produce legal effects for you.

11. Cookies

Cookies are small text files stored on your device when you use the website. Other technologies, such as pixels and tracking scripts, work in a similar way. On your first visit to the website, we display a cookie banner (CookieYes) in which you can decide which categories of cookies you consent to.

Cookie categories:

  • necessary: ensure the proper and secure operation of the website and remember the selected language (Polylang) and your consent settings (CookieYes); they are always active and do not require consent,
  • functional: enable additional website features and remember your preferences,
  • analytics: help us understand how visitors use the website, e.g. how many people visit it and from which sources,
  • performance: help us analyse how the website performs and make it more convenient to use,
  • advertising: are used to measure the effectiveness of ads and to display m.Kids ads to people who have visited the website.

We store cookies other than necessary cookies only with your consent (Article 399 PKE in conjunction with Article 6(1)(a) GDPR).

Tools we use:

  • Google Tag Manager: a script management tool we use to run the other tools on the website,
  • Google Analytics 4: visit statistics and analysis of how the website is used,
  • Microsoft Clarity: heatmaps and session recordings, which we use to analyse and improve the usability of the website,
  • Meta Pixel: measuring the effectiveness of ads and displaying m.Kids ads on Facebook and Instagram to people who have visited the website (remarketing).

Retention period. Cookies may be session cookies (deleted when you close your browser) or persistent cookies. Persistent cookies are stored according to the validity period of the given cookie, for a maximum of 2 years, or until you delete them or withdraw your consent.

Changing your consent. You can change or withdraw your choices at any time using the cookie settings button available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Browser settings. You can also block or delete cookies in your web browser settings. Blocking necessary cookies may make it difficult to use some website features.

12. Data security

We take care of the security of your data and apply technical and organisational measures appropriate to the risk, in particular:

  • an encrypted connection to the website (SSL/HTTPS),
  • access to data only for authorised members of our team, to the extent necessary to perform their duties,
  • the use of services from reputable IT providers.

13. Changes to the privacy policy and language versions

This privacy policy may be updated, e.g. due to changes in legislation, the tools we use or the way the website operates. The current version is always available on this page together with its effective date.

This version is effective from 16 October 2026 and replaces the previous version of the privacy policy.

In the event of any discrepancies between the language versions of this privacy policy, the Polish version prevails.