Privacy notice

1. Who we are

Mosaic Nursery DMCC operates a KHDA-permitted early childhood centre at First Floor, Fortune Executive Tower, Cluster T, Jumeirah Lake Towers, Dubai, United Arab Emirates. We are the controller of personal data relating to enrolled children, their parents and guardians, enquiring families, job applicants and staff. Questions about this notice, or any request relating to your data, should go to the nursery manager at operations@mosaicnursery.com.

2. The law we work to

We handle personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, together with the regulatory record-keeping obligations placed on us by the Knowledge and Human Development Authority, the Dubai Health Authority and Dubai Municipality. Where those obligations require us to hold or disclose information, that requirement takes precedence over consent — for example, we cannot delete attendance or safeguarding records on request.

3. What we collect

• About your child: name, nationality, passport, visa and Emirates ID details, photographs, home languages, dietary requirements, allergies and medical conditions, immunisation records, medication records, developmental observations and assessments, attendance, accident and incident records, and any safeguarding records.
• About you: name, relationship to the child, address, phone numbers, email address, passport, visa and Emirates ID details, employer where relevant to a corporate discount, emergency contacts, authorised collection contacts and their ID, billing and payment records, and correspondence with us.
• If you enquire: the information you enter into the enquiry form and send to us by WhatsApp or email — your name, contact details, your child's name, age band and preferred start date, and anything you choose to write in the message.
• If you apply for a job: your CV, qualifications, references, police clearance and medical fitness results, and interview records.
• When you visit the premises: visitor sign-in records and CCTV footage of communal areas, corridors and classrooms. There are no cameras in toilets or nappy-changing areas.

4. Why we use it, and on what basis

We use personal data to provide care and education under our contract with you; to meet our legal and regulatory obligations to the KHDA and other authorities; to protect the vital interests of a child in a medical or safeguarding emergency; and, for a limited set of optional activities, on the basis of your consent. Consent-based uses — publishing photographs on this website or on social media, sunscreen application, outings, and marketing emails — are always optional, are never a condition of a place, and can be withdrawn at any time.

5. The enquiry form on this website

This website has no backend and no database. The enquiry form runs entirely in your own browser: when you press send, your answers are assembled into a message and handed to WhatsApp or to your email application, and you send it yourself. Nothing you type is transmitted to or stored by this website, and we do not receive anything until you press send in your own app. Once your message reaches us it is handled as described in this notice. WhatsApp is a third-party service governed by its own privacy terms.

6. Cookies and analytics

This website sets no advertising or tracking cookies and does not profile visitors. All fonts, images and scripts are served from our own domain, so no third party receives your IP address when you browse this serving those files. If we add analytics in future, this notice will be updated and a consent banner added before any such cookie is set.

7. Who we share data with

We share personal data only where we need to: with the KHDA and other UAE regulators where required; with emergency services, the Dubai Health Authority or child protection authorities where a child's safety or health requires it; with the schools you name for transition reports; with therapists or other professionals where you have consented; with our insurers and professional advisers where relevant to a claim; and with the software providers who host our parent app and administrative systems under written processing agreements. We never sell personal data, and we never share it with advertisers or commercial marketing partners.

8. Photographs

Photographs and short videos are taken only on nursery-owned devices and stored in a managed, access-controlled account. Learning photographs are shared through the parent app with the parents of the children pictured, and nowhere else. Any wider use requires separate specific written consent, which you may give for some uses and refuse for others. Withdrawing consent takes effect within thirty days for material we control, though we cannot recall items already printed or already shared by other parents.

9. How long we keep it

Enquiry correspondence is kept for twelve months from your last contact unless you enrol. A child's care, learning and attendance records are kept for the period required by the KHDA after they leave, and accident, incident and safeguarding records are kept substantially longer in line with regulatory requirements. Financial records are kept for the period required by UAE tax and commercial law. CCTV footage is overwritten after thirty days. Unsuccessful job applications are kept for six months.

10. Security

Records are held in access-controlled cloud systems with individual user accounts and multi-factor authentication, and any paper records are held in locked cabinets in the office. Access is limited to staff who need it for their role: a practitioner sees the children in their own room, not the whole nursery. Staff sign a confidentiality undertaking and are trained in data handling at induction. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority without undue delay.

11. Your rights

Under the UAE PDPL you may ask us to give you a copy of the personal data we hold about you and your child; correct anything inaccurate; delete data we no longer have a lawful reason to keep; restrict or object to certain processing; provide your data in a portable format; and withdraw any consent you previously gave. Write to operations@mosaicnursery.com and we will respond within thirty days. We may need to verify your identity first, and we cannot delete records we are legally required to keep. If you are not satisfied with our response, you may complain to the UAE Data Office.

12. Children's data

Almost all the data we hold concerns children under five, who cannot exercise these rights themselves. Rights are exercised by parents or legal guardians. Where parents are separated, both holders of parental responsibility generally have equal rights of access unless a court order provides otherwise; please give us a copy of any order that affects this.

13. Changes to this notice

We review this notice annually and whenever our systems or practices change materially. The date at the top of this page shows the current version. Where a change materially affects how we use your data, we will tell you directly through the parent app or by email rather than relying on you to notice this page.