Privacy Policy

FlutraBlue is a cloud-based kindergarten and childcare management platform developed and operated by Marseco SH.P.K., a company registered in Kosovo, with its registered address at Rr. Shaqir Igrishta, Ndërtesa Naki Trade 2, 10000 Prishtinë, Kosovo (referred to in this policy as "FlutraBlue", "we", "us", or "our").

FlutraBlue is designed to help kindergartens and childcare providers in Kosovo, Albania, and North Macedonia manage daily operations — including child attendance, staff scheduling, parent communications, meal planning, activity timelines, and invoicing — through a secure web dashboard and mobile application.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, with whom we share it, how long we keep it, and what rights you have in relation to it. It applies to all users of the FlutraBlue platform: kindergarten administrators and staff, parents and guardians, and visitors to our marketing website.

If you have any questions about this policy or about how we handle your personal data, please contact us using the details in the Contact section at the end of this document.

Data-protection law — including Kosovo Law No. 06/L-082 on the Protection of Personal Data, Albania Law No. 124/2024 on Personal Data Protection, and the North Macedonia Law on Personal Data Protection (Official Gazette No. 42/2020) (together, the "applicable laws", all of which are substantially aligned with the EU General Data Protection Regulation) — distinguishes between two categories of entity: the **data controller**, which determines the purposes and means of processing, and the **data processor**, which processes data solely on the controller's instructions.

**FlutraBlue acts as a data controller** in relation to: (a) the personal data of kindergarten administrators and staff who create FlutraBlue accounts; (b) billing and payment data associated with the kindergarten's subscription; and (c) website-visitor data collected when you browse our marketing site.

**FlutraBlue acts as a data processor** in relation to the personal data that a kindergarten (which is the **data controller** for its own community) enters into the platform — including child profiles, attendance records, family details, staff records, timeline media, and in-app messages. When acting as processor, we process that data exclusively on the documented instructions of the kindergarten and do not use it for any independent purpose of our own.

This distinction is important: if you are a parent or guardian and wish to exercise data-protection rights over your child's or your own data held within a kindergarten's FlutraBlue workspace, your request should in the first instance be directed to the kindergarten, as it is the controller of that data. We will support the kindergarten in responding to such requests.

The following table summarises the categories of personal data for which FlutraBlue acts as data controller, together with the examples of data within each category and the purpose for which we process it.

When a kindergarten uses FlutraBlue to manage its community, it enters personal data about children, parents, guardians, and staff into the platform. For all such data, the kindergarten is the data controller and FlutraBlue is the data processor acting on the kindergarten's instructions. The table below summarises the categories of data processed in this capacity. FlutraBlue does not access, use, or disclose this data except as necessary to provide, maintain, and support the platform, or as required by law.

FlutraBlue processes personal data relating to children exclusively in its capacity as a **data processor** acting on the documented instructions of the kindergarten, which is the data controller for its enrolled children.

FlutraBlue does not directly collect personal data from children, and does not make independent decisions about how children's data is used. All decisions about the purposes and means of processing children's data — including what information to collect, how long to retain it, and with whom to share it — rest with the kindergarten as controller.

**Parental consent and age of digital consent.** Under the applicable laws, processing personal data of children in the context of information-society services requires particular care:

- **Kosovo (Law No. 06/L-082, Art. 8):** The minimum age for a child to consent independently to processing of their data in the context of information-society services is **16 years**. Below that age, processing requires consent given or authorised by the holder of parental responsibility. - **Albania (Law No. 124/2024):** The minimum age is similarly **16 years**. Below that age, parental or guardian consent is required. - **North Macedonia (Law on PDP, Art. 8, Off. Gazette 42/2020):** The minimum age is **14 years**. Below that age, the holder of parental responsibility must give or authorise consent. *Note: a 2025 amendment (Official Gazette No. 101/2025) to this law has not yet been fully reviewed; this age should be confirmed against the current consolidated text.*

It is the kindergarten's responsibility, as data controller, to obtain any required parental or guardian consent before entering a child's personal data into FlutraBlue, and to maintain records of such consent. FlutraBlue provides tools (including consent-record fields within the platform) to assist kindergartens in meeting this obligation, but FlutraBlue is not itself the entity obtaining consent from parents.

All data relating to children is processed with strict access controls: only authenticated staff of the relevant kindergarten and authorised parents may access data relating to a specific child, through role-based access controls enforced at the application level.

We process personal data only where we have a valid legal basis to do so under the applicable laws. The legal bases we rely on, and the processing activities they cover, are set out below.

• Contract (Article 6(1)(b)): processing your account registration details, credentials, and billing information to perform the subscription contract between FlutraBlue and the kindergarten.
• Legal obligation (Article 6(1)(c)): retaining financial records and invoices to comply with applicable accounting and tax laws.
• Legitimate interests (Article 6(1)(f)): fraud prevention, platform security monitoring, abuse detection, aggregated and anonymised product-improvement analytics, and communicating service-related updates. We have balanced these interests against your rights and concluded they do not override them.
• Consent (Article 6(1)(a)): where we rely on your freely given, specific, informed, and unambiguous consent, for example for optional marketing communications. You may withdraw consent at any time without affecting prior processing.

We use the personal data we control (see the Data We Control section) for the following purposes:

**Providing and operating the service.** We use your account and contact details to create and maintain your FlutraBlue account, authenticate your identity, enable access to the platform features your subscription covers, and provide customer support.

**Billing and payments.** We use billing and payment data to process subscription fees, generate invoices, handle payment disputes, and maintain financial records required by applicable accounting and tax laws. Card payment processing is handled by Stripe; we do not store raw card numbers.

**Security and fraud prevention.** We use technical data (including IP addresses and session logs) to monitor for unauthorised access, detect abuse, investigate security incidents, and enforce our Terms of Service.

**Product improvement.** We may use aggregated and fully anonymised usage data — which does not identify individual users — to understand how features are used and to improve the platform. We do not use identifiable data for advertising or profiling.

**Communications.** We use your email address to send transactional communications (account verification, password reset, invoices, service notices) and, where you have given consent, optional marketing communications. You may opt out of marketing emails at any time.

**We do not sell, rent, or trade personal data to any third party for commercial purposes.** Personal data is shared only as described in the Sub-Processors section below, or where required by law.

As a data processor for kindergartens, and in operating our own platform, we engage the following sub-processors. All sub-processors are bound by data-processing agreements that require them to protect personal data to a standard equivalent to this policy and applicable law.

FlutraBlue is operated by a Kosovo-registered company and primarily serves users in Kosovo, Albania, and North Macedonia. None of these three countries is a member of the EU/EEA, and none has received a formal adequacy decision from the European Commission (though all three have enacted legislation substantially aligned with the GDPR).

Personal data processed by FlutraBlue may be transferred to, or accessed from, countries outside Kosovo, Albania, and North Macedonia — in particular to the locations where our sub-processors operate (see the Sub-Processors section). The primary relevant transfer is to Stripe, Inc., which is established in the United States. That transfer is governed by Standard Contractual Clauses (SCCs) approved under GDPR Article 46(2)(c), which Stripe makes available in its data-processing agreement.

For infrastructure hosted in the European Union (specifically Germany and Ireland), personal data is stored and processed in those locations. Where those locations are outside the three jurisdictions above, we rely on the sub-processor's data-processing agreement and, where applicable, SCCs or equivalent transfer mechanisms under the relevant national law.

If you require further information about the specific transfer mechanisms in place for any sub-processor, please contact us at info@flutra-blue.com.

*Note: the cross-border transfer rules under Kosovo Law No. 06/L-082, Albania Law No. 124/2024, and the North Macedonia Law on PDP mirror GDPR Articles 44–49. Legal counsel should confirm the current state of adequacy decisions or approved transfer mechanisms under each national law, as this area continues to develop.*

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

**Account and billing data (controller).** We retain account data for the duration of your subscription and for a period thereafter sufficient to comply with legal obligations (including accounting and tax record-keeping requirements, which typically range from 5 to 10 years under applicable law). After the retention period, account data is deleted or anonymised.

**Tenant/kindergarten data (processor).** When a kindergarten terminates its FlutraBlue subscription, its workspace data enters a suspension window and is then subject to a configurable archive and purge schedule. The platform's tenant-purge job permanently deletes all workspace data — including child profiles, attendance records, and media — after the configured retention window expires (the default is 730 days, configurable by the super-administrator via platform settings). Kindergartens are responsible for exporting any data they need to retain beyond that window before deletion.

**Media and timeline files.** User-uploaded media (photos, videos, documents) stored in DigitalOcean Spaces is subject to the same retention schedule as the workspace to which it belongs. Media-retention auto-deletion is triggered by the tenant-purge job.

**Account deletion (erasure).** Users may delete their FlutraBlue account at any time using the in-app account-deletion feature. Upon deletion, account data is removed from our active systems. Residual copies in backups are overwritten as part of the normal backup rotation cycle.

**Backups.** Encrypted database backups are retained for a short period for disaster-recovery purposes and are not accessible for operational queries. They are purged on a rolling schedule.

We take the security of personal data seriously and implement technical and organisational measures appropriate to the risk, including:

**Encryption in transit.** All data transmitted between your browser or mobile app and the FlutraBlue servers is encrypted using TLS (Transport Layer Security). API endpoints are served exclusively over HTTPS.

**Encryption at rest.** Database volumes and object-storage buckets are encrypted at rest by the infrastructure provider.

**Access controls.** Access to personal data within the platform is governed by a role-based access control (RBAC) system. Kindergarten staff may only access data within their own tenant workspace. Super-administrators have access to platform-level configuration only and do not have routine access to kindergarten community data.

**Signed-URL media access.** Files stored in DigitalOcean Spaces (child photos, timeline media, documents) are never publicly accessible. Access is granted only via short-lived, cryptographically signed URLs generated by the server on authenticated request.

**Authentication security.** Passwords are stored using a strong one-way hashing algorithm. The platform supports multi-factor authentication.

**Monitoring and incident response.** We use application-level monitoring and error tracking to detect anomalies and respond to potential security incidents. In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by applicable law.

**Sub-processor security.** All sub-processors are required by contract to maintain appropriate technical and organisational security measures.

Despite these measures, no system is completely secure. If you believe your account has been compromised, please contact us immediately at info@flutra-blue.com.

Depending on your jurisdiction and the legal basis for processing, you may have the following rights in relation to your personal data. These rights apply to personal data for which FlutraBlue is the **data controller**. For data held within a kindergarten's workspace (where the kindergarten is the controller), please direct your request to the kindergarten in the first instance.

You may exercise your rights by contacting us at info@flutra-blue.com. We will respond within 30 days (or such shorter period as may be required by applicable law). We may need to verify your identity before processing your request.

• Right of access (Art. 15): you may request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16): you may ask us to correct inaccurate or incomplete personal data without undue delay.
• Right to erasure / 'right to be forgotten' (Art. 17): you may request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful. The in-app account-deletion feature exercises this right for your FlutraBlue account.
• Right to restriction of processing (Art. 18): you may ask us to suspend processing while accuracy is contested or an objection is pending.
• Right to data portability (Art. 20): where processing is based on contract or consent and carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format. The in-app data-export feature exercises this right.
• Right to object (Art. 21): you may object at any time to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint (Art. 77): you have the right to complain to the supervisory authority in your jurisdiction — see the Supervisory-Authority Complaints section below.

FlutraBlue uses only strictly necessary cookies. We do not use advertising cookies, social-media tracking pixels, or any other non-essential tracking technology.

**Authentication and session cookies.** When you log in to the FlutraBlue web dashboard, we set a session cookie that keeps you authenticated for the duration of your session. This cookie is essential for the platform to function and cannot be disabled while you are using the service.

**Locale preference cookie.** We set a small cookie to remember your preferred interface language. This cookie contains no personal data beyond your locale choice and expires after a short period.

No cookies are used for advertising, retargeting, or cross-site tracking. We do not use Google Analytics, Facebook Pixel, or similar third-party analytics or advertising services.

You can manage or delete cookies through your browser settings. Disabling session cookies will prevent you from logging in to the platform. Deleting the locale cookie will reset your language preference to the default.

You have the right to lodge a complaint with the data-protection supervisory authority in your jurisdiction if you believe we have processed your personal data unlawfully. We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority — please contact us first at info@flutra-blue.com.

The supervisory authorities for the jurisdictions in which FlutraBlue operates are listed in the table below.

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable legal requirements. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending an email notice to the address associated with your account or by displaying a prominent notice on the platform.

We encourage you to review this policy periodically. Your continued use of FlutraBlue after the effective date of any changes constitutes your acceptance of the updated policy to the extent permitted by applicable law. If you do not agree with the changes, you should stop using the platform and may request deletion of your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

**Marseco SH.P.K.** Rr. Shaqir Igrishta, Ndërtesa Naki Trade 2, 10000 Prishtinë, Kosovo Data-protection enquiries: info@flutra-blue.com

We will acknowledge your enquiry promptly and aim to respond fully within 30 days. If your enquiry relates to personal data held within a specific kindergarten's workspace, we may need to redirect you to the kindergarten as the data controller for that data.

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority — please see the Supervisory-Authority Complaints section above.