Privacy policy

Introduction

This privacy policy describes how Babysits collects, uses, and protects your information. Babysits is aware that your personal data must be secured well. We have internal guidelines that describe exactly how our collaborators must handle personal data. Babysits will only process your personal data in accordance with the purposes that you provided them for, as well as in conformity with the General Data Protection Regulation.

Babysits values the protection of the privacy of all users of the platform and the mobile applications. We ask you to read this privacy policy that explains how Babysits uses and protects your data with attention.

Who is responsible for your data

Babysits B.V. operates the platform, including its infrastructure, security systems and identity verification. Babysits Switzerland GmbH, a wholly-owned subsidiary of Babysits B.V., is the contracting party for members whose registered address is in Switzerland and holds the licence required for that activity.

For those members, the two companies are joint controllers under Article 26 GDPR and joint responsible parties under the Swiss Federal Act on Data Protection. Babysits B.V. is responsible for how the platform processes your data, for security, and for handling requests about your rights. Babysits Switzerland GmbH is responsible for your contract, payments and invoicing, and for the obligations attached to its Swiss licence. You may exercise your rights against either company, and your request will be handled either way. For all other members, Babysits B.V. is the sole controller.

In this policy, "Babysits", "we" and "us" refer to Babysits B.V. and, for members with a registered address in Switzerland, also to Babysits Switzerland GmbH.

Company details

Babysits Switzerland GmbH — members with a registered address in Switzerland

Neuhofstrasse 31 (no visiting or pick-up address), 6345 Neuheim, Switzerland
Commercial register of the Canton of Zug, UID: CHE-447.449.119

Babysits B.V. — all other members

Vasteland 78 (no visiting or pick-up address), 3011 BN Rotterdam, Netherlands
Registration number Chamber of Commerce: 68591950

What data we collect and why

The lists below set out the data we process for each type of account. Underneath, we explain what each category is for.

If you want to create an account as a family, we process the following (special) personal data of yours:

  • First and last name;
  • E-mail address;
  • Password;
  • Address information;
  • Phone number;
  • Bank account or credit card number (only the last 4 digits);
  • IP-address;
  • Identity document verification data;
  • Profile photo;
  • User-ID (when you link an Apple, Google, LinkedIn and/or Facebook account to this platform, and depending on the settings on your account, data from your registrations with these parties).

If you want to create an account as a babysitter, we will process the following (special) personal data of yours:

  • First and last name;
  • E-mail address;
  • Password;
  • Address information;
  • Phone number;
  • Bank account or credit card number;
  • IP-address;
  • Identity document verification data;
  • Profile photo;
  • Gender;
  • Date of birth;
  • User-ID (when you link an Apple, Google, LinkedIn and/or Facebook account to this platform, and depending on the settings on your account, data from your registrations with these parties);
  • Profession;
  • Education/diplomas;
  • Skills;
  • Availability;
  • Bank account number;
  • ID;
  • Criminal register check (or local equivalent).

Account and profile data

  • Account information. When you register for a Babysits account, we collect certain information, such as your first name, last name, and your e-mail address.
  • Profile information. To activate your Babysits profile, we can ask you for additional information, such as address, gender, and date of birth.

Verification and safety data

  • Verification information. To create and maintain a trusted community, we can collect verification information, including a phone number and e-mail address.
  • Document control: We enable users to provide a Criminal Registration Check (or local equivalent). As soon as Babysits has assessed the document, it is removed from our servers. Members in the United States can instead complete a background check through First Advantage, our screening partner, who carry out the check and return the result to us.
  • ID verification. Identity verification is one of the ways we keep Babysits safe, and it is required before you can message other members. We may collect your facial imagery, ID-number, date of birth, first name, last name, middle name, document type, document issuing country, nationality and address, as well as fraud signals and information about the devices that connect with our services. Members must be at least 16 years old, which we check against the date of birth on the ID. To pay babysitters we may share babysitter IDs with our payment provider Stripe due to regulatory and financial partner requirements. The document is read by our service provider Mistral. Facial recognition data is processed by our service provider Amazon Web Services (AWS), which also compares your selfie with those of other verified members to detect duplicate accounts. Verification usually completes quickly; if you ask us to review a result, this can take up to 1 week. After verification is completed, we no longer store the photos of your ID document. We do keep your facial image, for the safety purposes described under "Biometric data".

Babysits monitors the platform for safety risks and may investigate matters that affect member safety or platform integrity. When necessary to protect our community's safety, Babysits will cooperate with law enforcement authorities when required or appropriate to do so. This may include sharing user data as part of such cooperation.

Payment and booking data

  • Payment information. We ask families that want to pay and childcare providers that want to be paid
    to provide our payment provider with payment information, such as a bank account or credit card information to facilitate the processing of payments.
  • Booking information. When you use our booking system, we collect information about your booking, payment, and all information you provide us with.

Communication, technical and advertising data

  • Communication with other platform users. When you communicate with other Babysits users via our messaging system, we collect information about your communications and all information that you want to provide. Messages and profile text are automatically screened for content that breaches our Community Standards, such as sexual or abusive language, scam patterns, or contact details shared in ways our rules do not allow.
  • Advertising measurement. If you arrived at Babysits through an advertisement and gave your consent, we share a limited set of data with the advertising platform you came from so we can measure which advertisements work: your email address, first name, last name and Babysits user ID in hashed form, the fact that you created an account or subscribed to Premium, the click identifier from the advertisement, your IP address and browser information. Hashing means the platform cannot read these details directly, but it can match them against its own users, so this remains personal data.
  • Technical information. When you use the platform we collect technical data such as your IP address, device information and log data, which we use to keep the platform secure and working correctly.

Our legal grounds

We process personal data on the following bases.

Performance of a contract

Most processing is necessary to provide the platform to you: creating and maintaining your account and profile, showing your profile to other members, enabling messaging, and handling bookings and payments.

Legitimate interests

We process personal data where we have a legitimate interest that is not overridden by your rights. This applies to keeping the platform safe, detecting and preventing fraud, scams and abuse, investigating reports about members, preventing removed members from registering again, securing our systems, and improving our services. You can object to processing based on legitimate interests; see "Your rights".

Legal obligation

We process and retain certain data because the law requires it, including tax and reporting obligations relating to payments made through the platform.

Consent

We rely on your consent for the choices you make in the "Your privacy choices" banner: advertising cookies and similar technologies, and sharing data with advertising platforms as described under "Advertising measurement". We also rely on consent for marketing communications. You can withdraw that consent at any time in your privacy settings. Withdrawal does not affect the lawfulness of processing before withdrawal. Consent lapses after 6 months, after which we ask again. Identity verification is not based on consent; the basis we rely on for it is set out under "Special categories and criminal offence data".

Special categories and criminal offence data

Identity verification involves biometric data, a special category of personal data under Article 9 GDPR. We process it on the basis of Article 9(2)(g) GDPR and Article 29 of the Dutch UAVG (necessary for authentication and security purposes), in the substantial public interest of protecting children and young babysitters. This processing is not based on consent, so it cannot be withdrawn; you can object to it, see "Your rights".

Where a member chooses to add a criminal record document, or completes a background check, this involves personal data relating to criminal convictions and offences under Article 10 GDPR. Providing this is always optional. We process it only to confirm that the document is authentic and to show on the member's profile that a check has been completed. We do not retain the document itself.

Members under 18

Members can register from the age of 16 (or an older age if this applies locally); members under 18 must have the permission of a parent or guardian. We verify that a member is at least 16 using the date of birth on the identity document.

Automated decisions

To keep the platform safe, text that you enter in your profile or send in messages is automatically screened against our Community Standards. Where the system identifies content that breaches those standards, it can block the message or profile text from being published, and can restrict or suspend the account.

A restriction applied in this way takes effect immediately and is then reviewed by a member of our team. You can also ask us to review it yourself, explain your situation, and contest the outcome, by contacting us through the contact details at the end of this policy. Where we restrict or remove an account, we tell you the reason.

These measures concern access to the platform only. They do not affect any agreement between a family and a babysitter.

Identity verification and profile photo checks are also automated. If a check fails, or you believe the result is wrong, you can ask a member of our team to review it and contest the outcome through the contact details at the end of this policy.

How long we keep your data

After you delete your account, we remove different types of data on different timelines.

  • Identity and verification data (including ID document data and biometric verification data): removed from our active systems within 6 months.
  • Account data (including your profile and other account information): removed from our active systems within 9 months.
  • Records of members we have blocked for a safety violation: kept for up to 10 years, reviewed at least every 3 years.
  • Backups: after data is removed from our active systems, it may still exist in our backups for up to 3 additional months, after which it is fully removed.

We keep identity and verification data for this period because of our role in childcare, possible law enforcement cooperation in child safety matters, and the time investigations involving minors typically take.

In some cases we need to keep data longer, for example where the law requires it, where a safety investigation is running, or to meet tax or financial obligations. In those cases we keep only what is necessary and no longer than required.

How we keep your data secure

Babysits has taken appropriate technical and organizational measures to protect your information against loss, abuse, and unlawful processing. These include encryption, access controls, and monitoring of our systems.

Biometric data

For identity verification and profile photo checks, our system processes the following biometric data.

Facial recognition templates. Our service provider AWS Rekognition creates encrypted mathematical templates from your verification selfie. These are stored in secure AWS Face Collections and used only to verify your identity and to detect duplicate accounts.

Original facial images. We store the original facial image for child safety and fraud prevention: to prevent identity fraud, to support safety investigations, and to assist law enforcement when required.

Profile photos. We compare your profile photo with your verification selfie, and with the photos of members we have blocked for safety violations, so that a removed member cannot return. We keep the facial data of blocked members for up to 10 years.

Biometric data is encrypted, processed within the European Economic Area, and access is strictly limited to authorized personnel and rate-limited per staff member to prevent abuse.

Who we share data with

The personal data of users are not sold to third parties.

Subprocessors

To deliver our services we engage the third parties listed below.

  • OVH (France) — hosting and storage.
  • Hetzner (Germany) — hosting and storage.
  • Bunny CDN (Slovenia) — content delivery; processes technical data such as IP addresses to serve content, which may be cached on edge servers in various locations.
  • Mistral (France) — reading identity documents during verification, and AI functionality for certain features; content is processed to generate results and is not used to train Mistral's models.
  • Crisp (France) — customer support chat; processes contact details and your communications with our support team.
  • New Relic — server and performance monitoring; processes technical data such as IP addresses and error logs.
  • Amazon Web Services (AWS) — facial recognition and biometric verification (see "Biometric data").
  • Stripe — payment processing and babysitter identity data required by regulation.
  • First Advantage (United States) — background checks for members in the United States; processes identity details and returns the result of the check.

We keep this list up to date as our providers change.

Advertising platforms

These parties are not processors: they also use the data they receive for their own purposes. We share with only one of them, the advertising platform you came from, and only under the conditions set out under "Advertising measurement".

  • Meta (Ireland / United States)
  • Google (Ireland / United States)
  • Microsoft / Bing (Ireland / United States)
  • TikTok (stored in Ireland, Norway and the United States; remotely accessible by TikTok group staff in China and other countries listed in TikTok's privacy policy)
  • OpenAI (United States)

For Meta and TikTok, Babysits and the platform are joint controllers under Article 26 GDPR: we are responsible for obtaining your consent and for what we send, the platform for what it does with the data afterwards. You can exercise your rights against either party. The other platforms listed act as independent controllers for the data they receive.

International transfers

Switzerland and the European Economic Area recognise each other as providing an adequate level of data protection, so no additional safeguards are required for data moving between our Swiss and Dutch entities or within the EEA. Where personal data is transferred to a country that does not provide an adequate level of protection under EU or Swiss law, Babysits uses appropriate safeguards, such as standard contractual clauses recognised by the European Commission and the Swiss Federal Data Protection and Information Commissioner. Where a recipient is certified under the EU-US and Swiss-US Data Privacy Frameworks, we rely on that certification. The country in which each provider processes data is shown in the list above.

Your rights

Right of access

You have the right to peruse the information that Babysits has stored. If you want a copy of the data that Babysits has stored, click on the download button on the page: Personal information.

Right to correction and deletion

If you want to modify or remove the data that Babysits has stored, go to the page: Account.

Control over your profile

You choose whether the personal data on your profile is visible to all Babysits users or only to users you have been in contact with. If you choose "everyone", public search engines such as Google and job vacancy websites will also include your profile.

Right to be forgotten

If there are no grounds any longer to process your data, Babysits will remove your data. This may be the case when you no longer wish to make use of our provision of services, when you object against the use of your data, or when the personal data were processed unlawfully.

If you delete your account or ask us to erase your data, we remove it on the timelines set out under "How long we keep your data". We may keep data longer where we have blocked you for a safety violation, where an investigation is ongoing, or where the law requires it; if so, we tell you why, where we are allowed to.

Right to restrict processing

In certain situations you can ask us to suspend the use of your data, for example while we check data you say is incorrect, or while we assess an objection you have made.

Right to object

You can object to processing we carry out on the basis of legitimate interests, and to the biometric processing described under "Special categories and criminal offence data". We will stop unless we have compelling grounds that override your interests. Because identity verification is required in order to message other members, upholding an objection to it means you will not be able to use that part of the platform. Advertising is based on your consent, not on legitimate interests, and you can withdraw that consent at any time in your privacy settings.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, and you can contact the authority in the country where you live or work. Our lead supervisory authority in the EU is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl; a list of European authorities is available at edpb.europa.eu.

If you are in Switzerland, you can report a matter to the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), edoeb.admin.ch.

If you want to exercise one of the rights listed above, you can indicate this by contacting: Contact page. We will contact you no later than within 14 days.

Cookies

This platform uses cookies. The cookies below are necessary for the platform to work and are always set. Advertising cookies are only set if you agree to them.

  • Session: to log in and for the use of our website;
  • Keep me logged in: to remember login names;
  • New Relic: to use their service Server Monitoring;
  • Stripe: to process payments;
  • Google Analytics: to analyze the effectiveness of the website;
  • GrowthBook: anonymous feature testing to improve website performance and usability. No personal data is collected.

We use cookies and similar technologies to measure advertisements. These apply only if you arrived through an advertisement and then gave your consent. That same choice also covers the data we send directly from our own servers to the platform concerned, described under "Advertising measurement". Nothing is sent if you decline, or if you never saw the banner. We share only with the advertising platform you came from. Which platforms these can be, where they process data and their role is set out under "Advertising platforms".

Google Analytics

We make use of Google Analytics, which is a web-analysis service that is offered by Google to keep track of and report on activities on our website.

In order to remain transparent and protect our users, we have:

  • Concluded a Data Processor Agreement with Google;
  • Anonymized IP-addresses by removing the last eight digits from the IP-address;
  • Deactivated the sharing of statistics with Google;
  • Deactivated use of different Google services in combination with Google Analytics cookies.

For more information about Google Analytics cookies, we advise you to go to https://policies.google.com/privacy.

Contact

If you have questions, comments, or complaints about this privacy policy, you are welcome to contact us:

  • By e-mail: Contact page
  • By regular mail, members with a registered address in Switzerland: Babysits Switzerland GmbH, Neuhofstrasse 31 (no visit address), 6345 Neuheim, Switzerland.
  • By regular mail, all other members: Babysits B.V., Vasteland 78 (no visit address), 3011 BN Rotterdam, the Netherlands.

If you have a complaint about how we handle your personal data, we would like to hear from you first so we can try to resolve it. You can also lodge a complaint with a data protection supervisory authority, as described under "Your rights".