CAC Privacy Policy.

# Chipmunk Achievers Privacy Policy

**Owner:** Northwest Langley Baptist Church, British Columbia, Canada  

**Privacy contact:** Graham Coates — gracoat@mac.com

Chipmunk Achievers collects and uses children’s information only to operate the preschool, support staff, and keep children safe. The information may include registration and contact details, attendance, authorized pickup information, notes, health or allergy information, and photographs where provided for preschool use.

Access is limited to staff who work directly with children and the designated network/IT administrator. The preschool director approves every new staff account and asks the app or IT administrator to complete onboarding. Staff access is removed immediately when there is a security concern or involuntary dismissal, and no later than 12 hours after any staff member leaves.

The apps use secure sign-in, encrypted connections, protected device storage, and automatic privacy locking. Staff may use personal devices only when the device has a passcode or Face ID, current security updates, encryption, and remote-wipe capability. Student information must not be copied to personal cloud storage, Photos, Notes, screenshots, exports, or other unapproved locations.

The student database is hosted on a Synology DiskStation NAS owned by Maple Ridge Christian School, which provides hosting to Chipmunk Achievers. The preschool director is responsible for the hosted data and the authorized network/IT administrator maintains the system. Access is restricted and administrative activity is reviewed when needed.

Paper registration records are kept for seven years. Digital records are kept for no more than one year after a child leaves the preschool, unless a longer period is required by law or is necessary to resolve a documented dispute or safety matter. After that period, digital records are securely deleted. Parents and guardians may ask to see or request deletion of their own child’s digital information, subject to legal retention requirements.

There are currently no routine backups of the digital student database. The preschool accepts the possibility that digital convenience data could be lost; original paper registration records remain the authoritative backup. The preschool may introduce an encrypted backup in the future.

Lost or stolen devices and suspected privacy incidents must be reported to the preschool director immediately and no later than 24 hours after discovery. For a suspected breach, the director or IT administrator will restrict access or take the hosted database offline, preserve relevant evidence and logs, revoke active sessions or credentials, investigate and fix the cause, and restore service only after the issue is contained. The preschool will determine whether families, Maple Ridge Christian School, insurers, or regulators must be notified.

Questions or privacy requests may be sent to Graham Coates at gracoat@mac.com.

This policy should be reviewed by Northwest Langley Baptist Church and the preschool director before publication and whenever the app, hosting arrangement, or privacy practices change.

# Chipmunk Achievers Staff Security Procedure

This procedure supports the Chipmunk Achievers Privacy Policy.

## Access

Only child-facing staff and the authorized network/IT administrator may access student data. The preschool director approves new access and requests onboarding from the app or IT administrator. Access should be reviewed at least every three months.

When a staff member leaves, access is removed immediately for a dismissal or security concern, and no later than 12 hours after any other departure. Active sessions, passkeys, and device access should be revoked as part of offboarding.

## Personal devices

Any personal device used for student data must have a passcode or Face ID, device encryption, current operating-system security updates, and remote-wipe capability. Staff must not store student information in personal Photos, Notes, cloud drives, messaging apps, screenshots, or exported files.

## Incidents

Report a lost or stolen device or suspected privacy incident to the preschool director immediately and within 24 hours at the latest. The director and IT administrator will restrict or disable access, preserve evidence, revoke sessions and credentials, investigate the hosted Synology DiskStation database, and restore service only after the issue is contained.

## Privacy requests

Send parent or guardian requests about their child’s inform