Colors — Privacy policy

1. Who the controller is

Depending on the centre your child is enrolled in, the data controller is one of these two companies:

Colors SCP

Tax ID: J62953609
Address: RIERA DE LA VALL,9, 08392 SANT ANDREU DE LLAVANERES

Colors SL

Tax ID: B66618281
Address: PASSEIG JOAQUIM MATAS,11, 08392 SANT ANDREU DE LLAVANERES

Contact for any data protection matter

You can write to info@colorsscp.com or call +34 937 95 20 73. Please tell us the student's name so we can find the record.

2. What data we handle

We do not ask for anything we do not need in order to provide the service. These are the categories:

About the guardian: Name and surname, ID number, phone, email address and postal address.
About the student: Name and surname, date of birth, year group and centre, and the daily record of attendance to the service.
About the student's health: Allergies and intolerances, special diets, authorised medication, any medical prescriptions you attach, and the record of doses given by our staff.
Banking: IBAN and account holder, solely to collect the receipts by direct debit. The IBAN is stored encrypted.
App usage: Device identifier so we can send you notices, chosen language, and the date and time of any signature you make in the app (SEPA mandate and consents), with the IP address as evidence of the signature.

We do not build advertising profiles, we do not sell data to anyone, and we do not use student data for any commercial purpose.

3. What we use it for and on what legal basis

Purpose	Legal basis
Providing the dining hall, after-school and care services, and managing enrolments and attendance.	Performance of the contract between us and you as a family.
Issuing and collecting receipts, and managing SEPA direct debits.	Performance of the contract and compliance with tax and accounting obligations.
Catering for allergies and special diets, and administering medication.	Your explicit consent (GDPR art. 9.2.a), which you may withdraw at any time. It also protects the student's vital interests in an emergency.
Communicating with you: absence notices, messages, announcements and reports.	Performance of the contract.
Keeping issued receipts even after you delete your account.	Legal obligation (Spanish Commercial Code and tax legislation).

4. Health data and children's data

Health data is a specially protected category. We only handle it if you provide it and sign the corresponding consent inside the app or the portal, and solely to make sure your child eats safely and receives the medication you have authorised.

Only the staff who need it have access: the monitor of the group the student is assigned to, and the centre administration. Every dose of medication is recorded together with the person who gave it, the date and the time.

All data about students who are minors is handled on the basis of the consent and legal representation of the parent or guardian. Minors do not have their own account in the app: you are the one who signs in.

You may withdraw your consent at any time by deleting the medical instruction from the app or the portal, or by writing to us. Withdrawing it does not affect the validity of what was done beforehand, but it may prevent us from continuing to cater for a diet or a medication.

5. Who we share data with

We do not transfer data to third parties for their own purposes. Only the providers we need in order to run the service are involved, and all of them are bound by a data processing agreement:

The bank through which we submit the receipt batches.
The hosting provider for our servers, located in the European Union.
The push notification delivery service for the mobile app.
The SMS provider, for account activation links.
The tax authorities and other public bodies, where the law requires it.

Where a provider involves an international data transfer, it is covered by the standard contractual clauses approved by the European Commission.

6. How long we keep it

Account and contact data, for as long as you are a user of the service.
Health data, for as long as the instruction and the school year it was authorised for last.
Attendance records, for the duration of the relationship and the applicable claim periods.
Receipts and SEPA mandates, six years from the last financial year, as required by accounting and tax law. After that period they are deleted.

When you delete your account, your identifying data disappears immediately, but receipts already issued are kept blocked: they can only be used to respond to a request from the authorities or the courts, never to contact you.

7. Your rights

You may exercise the following rights at any time, free of charge:

Access: find out what data we hold about you and your child.
Rectification: correct anything that is inaccurate.
Erasure: ask us to delete data once it is no longer necessary.
Objection and restriction: ask us to stop processing it or to limit its use.
Portability: receive your data in a machine-readable format.
Withdraw any consent you have given, without affecting processing carried out beforehand.

To exercise them, write to info@colorsscp.com stating which right you wish to exercise and attaching a copy of your ID. We will reply within one month at the latest.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. How to delete your account

You can delete your account yourself, without calling or writing to anyone: in the app, go to More › Profile › Delete my account; on the web portal, go to Profile › Delete my account.

Before you confirm, the screen shows you exactly what will happen in your particular case: which children will stop being enrolled and from what date, what is erased for good, and which receipts are kept as required by tax law.

Irreversibly erased: your personal and contact details, your password, your messages, your direct debit details, and the health data of any child left without a guardian on the account.

Deleting your account does not cancel any amounts still outstanding.

9. Security

Communications travel encrypted, passwords are stored using irreversible hash functions, and the IBAN is stored encrypted in the database. Staff access is limited to the groups and centres assigned to them.

10. Changes to this policy

If we change this policy we will tell you through the app or by email before the changes take effect. The date of the last update is always at the top of this page.