Last updated: 22 October 2026

Little Bunny ChildCare Centre (“Little Bunny”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal data of the parents, guardians, children and visitors who use our website littlebunnychildcare.com and our childcare services. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

Little Bunny ChildCare Centre
72, Triq F. S. Caruana, Birkirkara BKR 1235, Malta
Email: info@littlebunnychildcare.com
Phone: +356 9908 3266

If you have any questions about this policy or about how we handle your data, please contact us using the details above.

2. Personal data we collect

2.1 Data you give us

  • Contact form: your first and last name, email address and the content of your message.
  • Registration form: the child’s name, date of birth and gender; the parent or guardian’s name, email address and mobile number; the hours and days of childcare required; and any other comments you choose to share.
  • WhatsApp, phone, email and social media: your name, phone number, profile information and the content of the messages you send us.
  • Job applications (Careers): your CV, contact details, qualifications and work history, if you apply for a position with us.
  • Enrolment and childcare records: once a child is enrolled, we may collect additional information needed to provide safe care, such as emergency contacts, persons authorised to collect the child, and health information (for example allergies, dietary needs, medical conditions or vaccination records). Health data is a special category of personal data and is treated with extra care, as explained in section 4.

Please do not send us sensitive information about your child (such as health details) through the website forms. We will request it securely at the enrolment stage.

2.2 Data collected automatically

  • Technical and security data: IP address, browser type, device information, pages visited and the date and time of your visit. Our security tools record login attempts and suspicious activity to protect the website against attacks.
  • Cookies and similar technologies: see section 9 below.

3. Why we use your personal data and our legal basis

Under the GDPR we must have a lawful basis for each use of your personal data. We rely on the following:

  • To reply to your enquiries and messages (contact form, WhatsApp, phone, email): our legitimate interest in answering you and, where you are asking about a place, taking steps at your request before entering into a contract (Art. 6(1)(b) and 6(1)(f) GDPR).
  • To process registration requests, manage enrolment and provide childcare services: performance of a contract with you or steps taken at your request before entering into one (Art. 6(1)(b) GDPR).
  • To comply with our legal and regulatory obligations, including childcare regulations, the Free Childcare Scheme and other government schemes, accounting, tax and child safeguarding requirements: legal obligation (Art. 6(1)(c) GDPR).
  • To protect the vital interests of a child in an emergency (Art. 6(1)(d) GDPR).
  • To keep our website secure, prevent fraud and improve our services: our legitimate interests (Art. 6(1)(f) GDPR).
  • To send you news, updates or promotional communications, and to use analytics or marketing cookies: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • To assess job applications: steps taken at your request before entering into an employment contract (Art. 6(1)(b) GDPR).

4. Children’s data and health data

Our services are for children aged 3 months to 3 years, so we process children’s personal data only as provided by their parents or legal guardians and only for the purpose of providing safe, high quality childcare. We do not knowingly collect personal data directly from children through this website.

Health information about a child (such as allergies, medical conditions or medication) is processed only where it is necessary to protect the child’s health and safety, to comply with our legal obligations in the field of childcare and social protection, or with the explicit consent of the parent or guardian (Art. 9(2)(a), 9(2)(b), 9(2)(c) and 9(2)(h) GDPR, as applicable). Access to this information is restricted to staff who need it to care for the child.

Photographs and videos: we will only take, use or publish photographs or videos of children (for example on our website or social media) with the prior written consent of the parent or guardian. This consent can be withdrawn at any time.

5. Who we share your data with

We do not sell your personal data. We only share it when necessary, with:

  • Service providers who help us run our website and business, such as our website hosting provider, IT, security and email providers, and our digital marketing agency, all acting under a written agreement and only on our instructions.
  • Communication platforms you choose to use to contact us, such as WhatsApp, Facebook and Instagram (Meta Platforms).
  • Public authorities and regulators in Malta where required by law, for example in connection with childcare registration, the Free Childcare Scheme, tax obligations or child protection.
  • Medical or emergency services when necessary to protect a child’s vital interests.
  • Professional advisers such as accountants, auditors and lawyers, under a duty of confidentiality.

6. International data transfers

Some of our service providers (for example Google, Meta or WhatsApp) may process personal data outside the European Economic Area (EEA). When this happens we make sure an adequate level of protection is in place, such as an EU adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses. You can contact us for more information about these safeguards.

7. How long we keep your data

  • Enquiries via the contact form, WhatsApp or email that do not lead to enrolment: up to 12 months after our last contact.
  • Registration requests that do not lead to enrolment: up to 12 months, unless you ask us to keep you on a waiting list for longer.
  • Records of enrolled children and their parents or guardians: for the duration of the childcare contract and afterwards for the period required by Maltese law, including childcare, accounting and tax rules (generally up to 10 years for financial records).
  • Job applications: up to 12 months after the recruitment process ends, unless you are hired.
  • Website security logs: for a limited period, normally not more than 12 months.

When data is no longer needed, it is securely deleted or anonymised.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include an encrypted connection (HTTPS) on our website, security software, access controls, regular backups and staff confidentiality obligations. No method of transmission over the internet is completely secure, but we work to protect your information and review our measures regularly.

9. Cookies

Cookies are small text files stored on your device when you visit a website. We use:

  • Strictly necessary cookies, which are required for the website to work and to keep it secure. These do not require your consent.
  • Analytics cookies (for example Google Analytics, if enabled), which help us understand how visitors use the website so we can improve it.
  • Marketing cookies (for example the Meta Pixel or Google Ads tags, if enabled), which help us measure and show relevant advertising on platforms such as Facebook, Instagram and Google.

Analytics and marketing cookies are only placed with your consent, in line with the ePrivacy rules applicable in Malta (Subsidiary Legislation 586.01). You can accept, refuse or change your cookie preferences at any time through the cookie banner on our website or through your browser settings. Refusing non-essential cookies will not stop you from using the website.

Embedded content and links from other websites (such as WhatsApp, Facebook, Instagram or Google Maps) behave as if you had visited those websites, and are subject to their own privacy policies.

10. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy of it;
  • Rectification of inaccurate or incomplete data;
  • Erasure of your data (“right to be forgotten”), where there is no legal reason for us to keep it;
  • Restriction of processing in certain circumstances;
  • Data portability, to receive your data in a structured, commonly used format or have it transferred to another controller;
  • Object to processing based on our legitimate interests, and to object at any time to direct marketing;
  • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • Not be subject to decisions based solely on automated processing. We do not use automated decision making or profiling that produces legal effects.

Parents and legal guardians may exercise these rights on behalf of their children. To exercise any of your rights, please email info@littlebunnychildcare.com. We will reply within one month, as required by the GDPR. We may ask you to confirm your identity before acting on your request.

11. Right to complain

If you believe that we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority in Malta:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta
Phone: +356 2328 7100
Email: idpc.info@idpc.org.mt
Website: idpc.org.mt

We would, however, appreciate the chance to address your concerns first, so please contact us beforehand.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law or in our services. The latest version will always be available on this page, with the date of the last update shown at the top.