MigoCare privacy policy
Last updated: 30 October 2026
MigoCare is software for childcare: the web application MigoCare Office for the director, the app MigoCare Kiosk for the group's tablet, MigoCare Staff for staff members and MigoCare Family for parents. This policy explains which personal data is processed along the way, by whom, why and for how long.
1. Who we are
MigoCare is a trade name of David Gormez (sole trader), Belgium. The address and company number will be added here as soon as the registration with the Crossroads Bank for Enterprises is complete. Privacy contact: contact@migocare.be.
2. Two roles: your daycare decides, MigoCare processes
Your daycare is responsible for the data it keeps in MigoCare. The daycare centre or organisation that gave you an account decides which data about children, parents and staff is recorded and for what purpose. For that data the daycare is the controller and MigoCare the processor: we process it only on the daycare's instructions, under a data processing agreement, and never for our own purposes. If you have a question about that data, or want to access, correct or erase it, contact your daycare first; we help them do so.
MigoCare is itself responsible for a small part: the data needed to secure accounts, keep the apps working and provide support (section 4).
3. What data your daycare keeps in MigoCare
Depending on how your daycare uses MigoCare:
- Children: name, date of birth, group, attendance, the day (sleep, feeding, care, mood, activities), photos of activities, development, and health data such as allergies, diet, medication with the parent's consent, vaccinations and incidents.
- Parents and contacts: name, e-mail address, phone number, language, who may pick up a child, messages, requests (absence, extra day), contracts, invoices and payment details (IBAN, direct debit).
- Staff: name, contact details, schedule, clock-in and clock-out, leave, and the personnel file the daycare keeps.
The daycare processes this data to run the childcare and to meet the rules of Opgroeien, ONE and tax law. Children have no account of their own.
4. Data MigoCare is responsible for
| What | Why | How long |
|---|---|---|
| Your account: e-mail address, name, password (only as an unreadable hash), sign-in sessions | to let you sign in safely | as long as your account exists; a session expires after 30 days without use and is deleted 7 days after it expires or you sign out |
| The link between a tablet or phone and a group | to run the kiosk on the right device | until the device is unlinked |
| Your device's push token (through Apple, Google and Expo) | to send you notifications, such as a message from the daycare | until you sign out or turn notifications off |
| Crash reports from the apps: what went wrong, device type, version, an internal user and organisation number; never names or content | to find and fix errors | 30 days (Sentry, stored in the EU) |
| Technical server logs: time, requested function, result, IP address and internal user and organisation numbers; no names, no medical or message content | to detect outages and abuse | 30 days; the access logs of the file storage up to 1 year |
| E-mails to contact@migocare.be | to answer your question | until the question is handled, then at most 2 years |
Legal basis: the performance of the contract with your daycare and our legitimate interest in a secure, working service (Article 6(1)(b) and (f) GDPR).
5. Where the data is and who sees it
The data is stored in the European Union, at Google Cloud in Belgium (region europe-west1), with backups in the EU. Only the people your daycare gives access see it, according to their role: a parent sees only their own children. Every access to sensitive data (health, identity documents, incidents) is logged; the daycare can request that log.
MigoCare itself can look at your daycare's data only when a director of the daycare explicitly allows it, for a limited period (at most 90 days, revocable at any time), read-only, in sessions of at most 2 hours and without sensitive data unless the director includes it. Every session is reported to the directors and every access is logged.
MigoCare works with a small number of sub-processors:
| Sub-processor | For what | Where |
|---|---|---|
| Google Cloud (Google Ireland Ltd.) | hosting, database, file storage and backups | Belgium (europe-west1) |
| Amazon Web Services (AWS EMEA SARL) | sending the apps' e-mails (invitations, notifications) | Ireland (eu-west-1) |
| DeepL SE | translating messages between parents and the daycare, only when the daycare turns it on | Germany |
| Expo (650 Industries, Inc.), Apple and Google | delivering push notifications | United States |
| Mollie B.V. | online payments, only when the daycare offers them | Netherlands |
| Sentry (Functional Software, Inc.) | crash reports from the apps | EU (Frankfurt) |
The current list, with exactly what each sub-processor processes, is in MigoCare Office under Sub-processors; every change is announced to the daycare in advance. A data processing agreement is in place with each sub-processor.
We hand data to authorities only when the law obliges us to, or at your daycare's request (for example the mandatory reports to Opgroeien).
6. How long
The daycare sets the retention period of its data within the legal limits. MigoCare applies it automatically, among other things: a child's data is anonymised 5 years after leaving, tax data is kept 10 years, and photos are deleted 6 months after the (last) child leaves; parents are warned beforehand and can download the photos. When a daycare stops using MigoCare, it receives all its data and we delete it after 30 days, with a certificate of deletion.
7. Security
Connections are encrypted (HTTPS). Data is stored encrypted, including on the group's tablet, which can work offline. Passwords and access keys are kept only as hashes. MigoCare's access to a daycare's data happens only at its request, is limited in time and is logged (section 5).
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. For the data your daycare keeps (section 3), contact your daycare. For the data in section 4, or if you don't know whom to ask, e-mail contact@migocare.be; we answer within a month.
To have your account deleted: ask your daycare, or e-mail us.
If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
9. Cookies on this website
migocare.be uses no cookies, no analytics and no third-party content. The web server keeps technical access logs (IP address, time, requested page) for at most 30 days to detect outages and abuse.
10. Changes
If this policy changes materially, we announce it in the apps or through your daycare. The date at the top shows the latest version.