Deleting your information
How to ask for information held in Kindra, made by Salix Limited, to be deleted; what is deleted; what is kept and why; and how long it takes.
Who decides, and who to ask
Your early learning service holds the information. Under the Privacy Act 2020 it is the agency, and Salix Limited holds the records only as its agent under section 11 of that Act, so they are the service’s to decide about and not ours. A request goes to the service, and the service decides it.
- A family: ask your child’s service. Every agency must have a privacy officer; ask the service who theirs is.
- A staff member, or a former one: ask the service you work or worked for. While you have a login you can always read your own records in Kindra.
- A service leaving Kindra: write to support@kindra.co.nz. Before anything is removed, the service’s owner can take a copy of the whole service from Settings, and we go through the rest with you: each child’s record is deleted, then the service itself, and what was exported, deleted and left is written down.
- Anyone with a login who no longer has a service to ask: write to support@kindra.co.nz and we will remove the login.
If you write to us about a service’s records instead of to the service, we pass the request to the service rather than act on it, because the records are theirs to decide about.
What the law gives you, and what it does not
New Zealand law gives you the right to see what is held about you or your child, and to ask for it to be corrected. It does not give a general right to have information erased; that is European law and it does not apply here. What the Privacy Act does require is that information is not kept longer than it is needed. So a deletion request is a request for the service to apply its retention rules to your record now, and the service can say yes where nothing still requires the record to be kept.
What is deleted
When a service deletes a child’s record, the whole record goes: enrolment, health and medication details, attendance, consent decisions, custody notes, messages, and the photographs and videos in the learning journal, with their files removed as part of the same deletion. A family’s contact details are removed once no child of theirs remains at the service. A login is removed separately, when the person’s access ends.
Deletion is never automatic: a person decides. A family still asks the service, or writes to us and we pass the request on. The deletion itself is carried out by the service’s owner, in Kindra’s retention review, once the legal minimum has passed. When a departed child’s record is past its seven years, the owner is told on the console’s home screen and taken to a review that lists each such record. Each is deleted one record at a time, with a written reason and the word DELETE typed to confirm.
The database enforces the rules itself. It refuses anyone who is not an owner of that service, refuses a child who is still enrolled, and refuses a record that is not yet past its seven years. It writes the reason to the audit trail before anything is removed, so a deletion that stops part way still leaves a trace of what was intended, and that entry keeps no personal details.
Job applications and enrolment enquiries held in the software can be destroyed outright by the service, because there is no reason to keep the details of somebody it did not employ or enrol.
What is kept, and why
| Kept | For how long | Why |
|---|---|---|
| A child’s record: enrolment, health and medication, attendance, consent, custody notes, messages | Seven years from the end of the Ministry funding period in which the child left | The Ministry of Education’s funding rules require enrolment and attendance records, and every record that supports a funding claim, to be kept for at least seven years. A child’s last days are claimed in that funding period’s return, up to four months after they leave, so the seven years start when the period ends. The rest of the child’s record is kept with it, so that what an audit needs is not separated from the record it describes. |
| Staff compliance records: first aid, police vetting, safety checks, practising certificates | Seven years after the person leaves | Licensing evidence outlives the employment. |
| A filed ECE Return, with each staff member’s census details as filed | Seven years after the return date | The Ministry requires a service to be able to show the last return it filed for any period in the past seven years. The copy is fixed when it is filed, and only the service’s owner and manager can read it. |
| The audit log: what changed, when and by whom | Indefinitely | It records the names of the fields that changed and never their contents, so it holds no personal information. It is also the record that a deletion happened, who did it and why. |
| Backup copies | Seven days | The database is backed up daily and each backup is kept for seven days. A photograph or file deleted from the software stays in the daily backup copy of files for seven days and is removed from it within about a day after that. |
| A family’s contact details | Until no child of theirs remains | The same person is often the contact for more than one child, so a contact card goes when the last of their children’s records goes. |
| Emails already sent | Out of the software’s reach | An invitation, reminder or reply the software has sent sits in the recipient’s mailbox and in whatever the service’s own mail practice keeps. Nothing in Kindra can recall it. |
For enrolment and attendance records the seven years is the Ministry’s published minimum. The Ministry does not say when the seven years start; we count them from the end of the funding period, for the reason in the table. Health, medication and custody records are not funding records; they are kept with the child’s record by the same rule. When a child’s record is archived the database sets the date itself, and nobody signed in to Kindra can move it earlier.
How long it takes
- A request to us at support@kindra.co.nz is acknowledged within three business days during support hours (8am to 5pm New Zealand time, Monday to Friday, excluding public holidays), and the acknowledgement says what happens next. A request that belongs to a service is passed to it in the same time.
- The service’s own time to decide is the service’s. The Privacy Act sets time limits for answering a request to see or correct your information, and those apply to the service as the agency that holds it.
- Once a record is deleted it is gone from the software immediately, from the database backups within seven days, and a photograph or file leaves the backup copy of files within about eight days.
Deleting the app is not the same as deleting your information
Removing the Kindra app from a phone or tablet removes only what the app kept on that device. It changes nothing in the service’s records and does not close your login. To close a login, ask the service, or write to support@kindra.co.nz if you no longer have a service to ask.