Personal data processing in private preschools
This page explains how personal data is processed in private preschools in Reykjavík.
Application and enrollment in private preschools
To apply for and secure a place for their child in a private preschool in Reykjavík, parents must provide specific personal information, which is processed by both Reykjavík City and the private preschool selected during the application process. The information collected includes what you provide during the application process and basic information from Registers Iceland.
Under a service agreement, Reykjavík City provides funding to private preschools for children whose legal residence is in Reykjavík, subject to certain conditions.
What does this education cover?
This education covers the application and enrollment of children in private preschools in Reykjavík, as well as communication between those schools and Reykjavík City concerning enrolled children from the city.
In accordance with Reykjavík City preschool regulations and the service agreement between the City and private preschools, parents must submit their applications through the City's designated website, currently umsokn.vala.is.
Private preschools use the same system as Reykjavík City—the Vala preschool system—to manage applications, enrollment, waitlists, placement agreement modifications, parent discount requests, and other administrative tasks.
Reykjavík City has entered into a service and data processing agreement with InfoMentor, the operator of the Vala preschool system.
Reykjavík City and private preschools have entered into a joint controller agreement for processing personal data related to private preschools’ use of the Vala system.
Reykjavík City and each private preschool are independently responsible for their respective data processing and methods, except where otherwise jointly agreed.
This information also outlines Reykjavík City's legal obligations regarding private preschools, including child support services and operational oversight.
Private preschools provide their own privacy policies regarding the processing of personal data that falls outside the scope of joint responsibility.
Who is responsible for personal data processing?
Reykjavík City, located at Borgartún 12-14, and the relevant private preschool serve as joint controllers for personal data processing under their joint responsibility agreement. Info on all preschools in Reykjavík is available here, including contact details for each school.
Under its data processing agreement with InfoMentor ehf for the Vala system, Reykjavík City is responsible for central system decisions and general security measures to protect information within the system.
Each private preschool that processes personal data, including entering children’s and parents’ information into the Vala system, is responsible for ensuring the accuracy and proper maintenance of this data in the system.
The Department of Education & Youth and each private preschool are independently responsible for their own data processing methods, except where otherwise jointly agreed.
What is the purpose for processing and its basis?
Personal data processing is required for parents to apply for and secure a place in a private preschool. Both Reykjavík City and the selected preschool must process specific personal information about parents and children during this process.
Private preschools may also request additional funding from Reykjavík City to provide necessary support services for specific children in their care. Data processing also enables Reykjavík City to fulfill its oversight responsibilities regarding private preschools.
This data processing is based on Reykjavík City's statutory obligations as a municipality, as outlined in Arts. 4, 9, 16(2), 19, 22, 25, and 26 of the Preschool Act No. 90/2008, Art. 5.a of Regulation 896/2009 on the submission and communication of information between preschools and primary schools, and Reykjavík City's rules on preschool services. Reference is also made to Article 5 of Act No. 163/2007 on Statistics Iceland and official statistics.
The legal basis for processing is derived from Article 30.a of the Preschool Act No. 90/2008, Reykjavík City’s public authority, items 3 and 5 of the first paragraph of Article 9 of the Data Protection Act, and item 8 of the first paragraph of Article 11 of the same Act for sensitive personal data.
Failure to provide the requested information may result in an inability to process applications for preschool enrollment, financial contributions to private preschools, fee reductions, or additional support for children with special needs.
Additional contributions to private preschools for income-based discounts are granted based on parental consent, under item 1 of the first paragraph of Article 9. Parents may withdraw their consent at any time by emailing sfs@reykjavik.is.
Automatic decision-making
No automated decision-making occurs based on the information provided, except when parents apply for a preschool fee discount because their income is below the thresholds set in Reykjavík City's fee schedule.
Applications for an income-linked discount on preschool fees are processed using automated decision-making, which means they are handled without human intervention.
When a parent applies for an income-linked discount, the application is processed automatically to determine if their income meets the required thresholds. When automated decision-making takes place, you may ask a City employee to assess the enrollment, provide comments, ask for explanations of the decision taken, and dispute the decision. You also have the right to object to the automated processing of your application, and parents can always request a manual decision instead.
Where does the information come from?
When applying through the Vala system, parents provide basic information about themselves and their child, regardless of whether they are applying to a private or city-run preschool. Basic information comes from Registers Iceland.
Reykjavík City and the selected private preschools can access applications and necessary personal information for enrollment through the Vala system.
Reykjavík City may also access necessary information from its database to evaluate applications and process funding payments for private preschools.
As a requirement for preschool enrollment, parents must be up to date with their payments to the Department of Education & Youth. At the time of enrollment, Reykjavík City verifies outstanding balances by cross-checking data from its collection agency with the Vala system. Any outstanding payments are noted in the Vala system.
After enrollment, parents can request changes to placement agreements and apply for discounts through the Vala system. Both Reykjavík City and private preschools have access to this information.
The Vala system also handles communications between private preschools and Reykjavík City regarding funding for children legally residing in Reykjavík.
If a private preschool requests additional funding for children requiring special assistance or training, it must submit both general and sensitive personal information to Reykjavík City.
Personal data may also be processed for Reykjavík City's legally required support of private preschools and Department of Education & Youth oversight.
What data is processed?
The following general personal information is processed under a joint responsibility agreement between Reykjavík City and private preschools:
Basic information about the child:
- Name
- ID number
- Address - legal residence
- Language(s)
- Information about parents and immediate family
- Phone number
- Email address
- Hours of attendance and meals
- Processing of operational funding for the preschool
- Siblings of preschool age
- Custody according to Registers Iceland
- Placement agreement and any subsequent modifications
Basic information about parents:
- Name
- ID number
- Address - legal residence according to Registers Iceland
- Email address
- Phone number
- Status (such as marital status, studies, or disability. Discounts for this will expire on April 1, 2026). And discounts and fees
- Child custody according to Registers Iceland
- Outstanding preschool fees owed to Reykjavík City
- Names of all preschools requested by parents
- Placement agreement and any subsequent modifications
- IP addresses
- To apply for an income-based discount, parents must consent to provide information confirming their income is within the specified thresholds.
Basic information about private preschool staff with system access:
- Name
- ID number
- Address
- Email address
- Phone number
- Purpose
- Preschool name
- IP addresses
Usage recording
All user logins to Vala preschool are logged. The change history records all changes to actions in Vala. These include date of change, explanation, new value, previous value, and who made the change.
Event logging is done for security and property protection purposes and helps ensure that data in the system is protected against unauthorized access, changes, deletion, theft, or damage.
Sensitive personal information about the child and parents:
including diagnoses, medical conditions, allergies, special needs, medications and special education periods as defined by the Data Protection Act. Typically, this information is provided by parents in preschool applications, and sensitive data should be shared exclusively with the preschool that the child will attend.
When preschools request funding for children needing special assistance or training, both general and sensitive personal information is submitted to Reykjavík City.
How long is the personal data kept?
Personal information about parents and children is stored indefinitely as required by law for both Reykjavík City and private preschools.
After a specified period, all processed data must be transferred to the National Archives as required by Act No. 77/2014 on Public Archives.
How do we ensure the security of personal data?
Reykjavík City and private preschools must protect personal data through appropriate organizational and technical measures, including access controls and encryption. All personnel involved in the processing of personal data is subject to professional secrecy.
Reykjavík City has a data processing agreement with InfoMentor, the operator of the Vala system, to ensure the security of personal data.
Transfer of personal data
Reykjavík City uses data processors to host personal information processed by the city. Processors include Vala preschool. The same applies to other IT services. Such service providers may have access to personal data in connection with their operations. However, all access is regulated by written agreements with Reykjavík City, ensuring data security and confidentiality.
Reykjavík City and private preschools must submit documents as required by Act No. 77/2014 on Public Archives. This means the municipality and private preschools cannot destroy or dispose of any documents covered by the act without special permission from the National Archivist. Generally, personal data processed by the municipality is transferred to the National Archives after specified periods according to Reykjavík City's document retention schedules. In general, physical records are transferred to the National Archives after 30 years in accordance with the first paragraph of Article 15 on Public Archives, while digital records must be submitted after five years.
In all other cases, Reykjavík City does not share personal information with third parties unless legally required to do so by law, regulatory directive, or court order. Reykjavík City will not transfer personal data outside the European Economic Area without specific authorization, such as through a formal agreement, and will notify you of any such transfers.
Your rights
You have the right to access your personal information processed by Reykjavík City and private preschools. You have the right to object to data processing, request corrections, request deletion, restrict processing, and/or receive your information in a machine-readable format for yourself or a third party.
More information about these rights is available in Reykjavík City's privacy policy.
Complaints about processing
Note that if you are dissatisfied with Reykjavík City’s handling of your personal data, you may contact the City’s Data Protection Officer, submit a complaint to the relevant private preschool, or escalate your complaint to the Icelandic Data Protection Authority.
