Data privacy policy

Data Controller
The University of Malta (the ‘University’), established under the Education Act (CAP. 586 Laws of Malta) and acting through its Childcare Centres, is the data controller of all personal information it processes for the provision of its childcare services. This information is processed in accordance with all applicable data protection legislation, including the General Data Protection Regulation (Regulation (EU) 2016/679, the ‘GDPR’) and the Data Protection Act (CAP. 586 Laws of Malta)

Data Protection Officer
The University has appointed a Data Protection Officer (‘DPO’) to provide guidance on all matters related to the protection of personal data. The DPO may be contacted as follows: 
Address: Room 261, Gateway Building 
Contact No: +2340 3233
Email address: dpo@um.edu.mt

Processing of personal data
The University processes the following personal information to provide the childcare services: 
  • Personal and contact details of parents/legal guardians, including name, surname, home and email addresses, relevant contact numbers, and, where applicable, ID card number;
  • Contact details of an emergency contact;
  • Personal details, including pertinent medical information, of the child/children who will attend our services.  
The University may process additional personal data concerning children attending the Centre, in the form of photos and/or videos taken during our services themselves.  

Purpose for processing and legal basis
Personal and contact details concerning parents/legal guardians of children who will attend our services, as well as personal information concerning the children themselves, are processed for all purposes ancillary to providing the service, including for administrative, registration, communication, and health and safety purposes. The University will be unable to offer any service if relevant information in this regard is not provided. This processing is based on Article 6 (1) (b) GDPR. Processing of medical information is additionally based on Article 9 (2) (a) GDPR. 

ID card numbers are requested and collected from parents/legal guardians who opt to avail themselves of the tax rebate offered by the government in relation to this service. This processing is based on Article 6 (1) (f) GDPR, and is carried out in furtherance of the legitimate interests of parents/legal guardians to benefit from such rebate. 

The University’s Childcare Centres may take photos or videos during our services, for the benefit of the parents/legal guardians and the children themselves, and for the Centres’ promotional purposes. Photos and videos will only be taken and published in accordance with parents’ or legal guardians’ consent, which may be withdrawn at any time by informing staff members at the relevant Centre. This processing is based on Article 6 (1) (a) GDPR.

Recipients
Personal information collected and processed in relation to the provision of UM’s childcare services is accessible to University employees who are required to process it by virtue of their roles and responsibilities, including but not limited to staff members of the Childcare Centres and employees responsible for the University’s finances. Information is not disclosed to any third parties unless strictly required by law.

Children’s personal records, including medical information, may be made available to Assessors appointed by the Department for Social Welfare Standards in cases of accidents or suspicion of abuse. These records are otherwise strictly confidential. 

Where parents/legal guardians opt to avail themselves of the afore-mentioned tax rebate, select information (personal details including name, surname, ID number, name of child/children and fee paid) is shared with the Inland Revenue Department. 

Retention period
Personal information concerning parents/legal guardians who do not opt for the tax rebate, and personal information concerning their child/children, is retained for the duration of the service. Personal information concerning parents/legal guardians who opt to avail themselves of the afore-mentioned tax rebate, and personal information concerning their child/children, is retained for one (1) year from the end of the service. 

Children’s medical records are destroyed once the relevant childcare service is over, or if they stop attending the Centre. Information may nonetheless be retained for a longer period as may be required in the event of a complaint, or for the establishment, exercise or defence of legal claims. 

Your rights
In terms of all applicable data protection law, and subject to the exceptions set out therein, parents/legal guardians have the following rights: 
  • To request a confirmation as to whether the University is processing your personal data or the personal data concerning your minor child/children, and to request access to any such data held by the University; 
  • To request that your data, or data concerning your minor child/children, held and processed by the University are corrected if they are inaccurate or incomplete; 
  • Where applicable, to request that your data or data concerning your minor child/children are erased; 
  • Where applicable, to request restriction of the processing of your data or data concerning your minor child/children;
  • To request that the University forwards your data or the data of your minor child/children to a third party. 
To exercise any of your rights listed above, or if you have any concerns regarding the University’s processing of your data or data concerning your minor child/children, you are invited to contact the DPO on the details provided above. If you consider that the processing of your personal data has been carried out unlawfully, you may lodge a complaint with the Office for the Information and Data Protection Commissioner, Malta. 


https://www.um.edu.mt/hrmd/childcare/privacy