Personal data processing in private preschools

Application and enrollment in private preschools

To apply for and secure a place for their child in a private preschool in Reykjavík, parents must provide specific personal information, which is processed by both Reykjavík City and the private preschool selected during the application process. The information collected includes what you provide during the application process and basic information from Registers Iceland.

Under a service agreement, Reykjavík City provides funding to private preschools for children whose legal residence is in Reykjavík, subject to certain conditions.

• More about personal data processing in Reykjavík City preschools

In accordance with Reykjavík City preschool regulations and the service agreement between the city and private preschools, parents must submit their applications through the city's designated website, currently umsokn.vala.is. Private preschools in Reykjavík are now listed alongside city-operated preschools on the Vala system’s application portal.

Private preschools use the same system as Reykjavík City—the Vala preschool system—to manage applications, enrollment, waitlists, placement agreement modifications, parent discount requests, and other administrative tasks.

Reykjavík City has established a service and processing agreement with InfoMentor ehf, the operator of the Vala preschool system.

• Vala Preschool Privacy Policy

Reykjavík City and private preschools have a joint data processing agreement governing the use of the Vala system by private preschools.

Reykjavík City and each private preschool are independently responsible for their respective data processing activities and determine their methods, except where they have agreed upon joint procedures.

This information also outlines Reykjavík City's legal obligations regarding private preschools, including child support services and operational oversight.

Private preschools provide their own privacy policies regarding the processing of personal data that falls outside the scope of joint responsibility.

Who is responsible for personal data processing?

Reykjavík City, located at Borgartún 12-14, and the relevant private preschool serve as joint controllers for personal data processing under their joint responsibility agreement. Information for all Reykjavík preschools , and contact information, can be found on the Reykjavík City website.

Under its data processing agreement with InfoMentor ehf for the Vala system, Reykjavík City is responsible for central system decisions and general security measures to protect information within the system.

Each private preschool that processes personal data, including entering children’s and parents’ information into the Vala system, is responsible for ensuring the accuracy and proper maintenance of this data in the system.

The Department of Education & Youth and each private preschool are independently responsible for their own data processing methods, except where otherwise jointly agreed.

What is the purpose for processing and its basis?

Personal data processing is required for parents to apply for and secure a place in a private preschool. Both Reykjavík City and the selected preschool must process specific personal information about parents and children during this process.

Private preschools may also request additional funding from Reykjavík City to provide necessary support services for specific children in their care. Data processing also enables Reykjavík City to fulfill its oversight responsibilities regarding private preschools.

The processing is based on Reykjavík City's legal obligations as a municipality under Articles 4, 9, 16.2, 19, 22, 25, and 26 of the Preschool Act No. 90/2008, as well as Article 5.a of Regulation 896/2009 on information sharing between preschools and primary schools. It also follows Reykjavík City's preschool service regulations. Reference is also made to Article 5 of Act No. 163/2007 on Statistics Iceland and official statistics.

The legal basis for processing is derived from Article 30.a of the Preschool Act No. 90/2008, Reykjavík City’s public authority, items 3 and 5 of the first paragraph of Article 9 of the Data Protection Act, and item 8 of the first paragraph of Article 11 of the same Act for sensitive personal data.

Failure to provide the requested information may result in an inability to process applications for preschool enrollment, financial contributions to private preschools, fee reductions, or additional support for children with special needs.

Where does the information come from?

When applying through the Vala system, parents provide basic information about themselves and their child, regardless of whether they are applying to a private or city-run preschool. Basic information comes from Registers Iceland.

Reykjavík City and the selected private preschools can access applications and necessary personal information for enrollment through the Vala system.

Reykjavík City may also access necessary information from its database to evaluate applications and process funding payments for private preschools.

As a requirement for preschool enrollment, parents must be up to date with their payments to the Department of Education & Youth. At the time of enrollment, Reykjavík City verifies outstanding balances by cross-checking data from its collection agency with the Vala system. Any outstanding payments are noted in the Vala system.

After enrollment, parents can request changes to placement agreements and apply for discounts through the Vala system. Both Reykjavík City and private preschools have access to this information.

The Vala system also handles communications between private preschools and Reykjavík City regarding funding for children legally residing in Reykjavík.

If a private preschool requests additional funding for children requiring special assistance or training, it must submit both general and sensitive personal information to Reykjavík City.

Personal data may also be processed for Reykjavík City's legally required support of private preschools and Department of Education & Youth oversight.
 

What data is processed?

The following general personal information is processed under a joint responsibility agreement between Reykjavík City and private preschools:

Basic information about the child:

• Name
• ID number
• Address - legal residence
• Language(s)
• Information about parents and immediate family
• Phone number
• Email address
• Hours of attendance and meals
• Processing of operational funding for the preschool
• Siblings of preschool age
• Custody according to Registers Iceland
• Placement agreement and any subsequent modifications

Basic information about parents:

• Name
• ID number
• Address - legal residence according to Registers Iceland
• Email address
• Phone number
• Status (such as marital status, education, or disability) and discounts and fees
• Child custody according to Registers Iceland
• Outstanding preschool fees owed to Reykjavík City
• Names of all preschools requested by parents
• Placement agreement and any subsequent modifications
• IP addresses

Basic information about private preschool staff with system access:

• Name
• ID number
• Address
• Email address
• Phone number
• Purpose
• Preschool name
• IP addresses

Usage recording

All user logins to Vala preschool are logged. The change history records all changes to actions in Vala. These include date of change, explanation, new value, previous value, and who made the change.

Event logging is done for security and property protection purposes and helps ensure that data in the system is protected against unauthorized access, changes, deletion, theft, or damage.
 

Sensitive personal information about the child and parents:

including diagnoses, medical conditions, allergies, special needs, medications and special education periods as defined by the Data Protection Act. Typically, this information is provided by parents in preschool applications, and sensitive data should be shared exclusively with the preschool that the child will attend.

When preschools request funding for children needing special assistance or training, both general and sensitive personal information is submitted to Reykjavík City.
 

Transfer of personal data

Reykjavík City uses data processors to host personal information processed by the city. Processors include Vala preschool. The same applies to other IT services. Such service providers may have access to personal data in connection with their operations. However, all access is regulated by written agreements with Reykjavík City, ensuring data security and confidentiality.

Reykjavík City and private preschools must submit documents as required by Act No. 77/2014 on Public Archives. This means the municipality and private preschools cannot destroy or dispose of any documents covered by the act without special permission from the National Archivist. Generally, personal data processed by the municipality is transferred to the National Archives after specified periods according to Reykjavík City's document retention schedules. In general, physical records are transferred to the National Archives after 30 years in accordance with the first paragraph of Article 15 on Public Archives, while digital records must be submitted after five years.

Personal information is not shared with third parties unless the city is legally required to do so by law, administrative directive, or court order. Reykjavík City will not transfer personal data outside the European Economic Area without specific authorization, such as through a formal agreement, and will notify you of any such transfers.