Data processing agreement
Last updated: 2026-06-18
Purpose of this agreement
This data processing agreement (DPA) forms part of the contract between the venue (the customer) and DoodleSwim, operated by Weektaak.com. It sets out how DoodleSwim processes personal data on the venue's behalf under Article 28 of the GDPR. Where this DPA and the terms of service conflict on data protection, this DPA prevails.
Roles
For the children's data collected through the service (scan photos and cutout drawings), the venue is the controller and DoodleSwim is the processor. DoodleSwim processes this data only on the documented instructions of the venue, which are given through the normal use of the service and through this DPA.
Subject matter and nature of processing
DoodleSwim processes the data to receive a scanned colouring sheet, extract the child's drawing, and display the drawing as an animated figure on the venue's screen, together with the short tank history. The data concerns children who colour sheets at the venue and the parents or guardians who scan them.
Categories of data
- Scan photo: the original photo of a colouring sheet, deleted within minutes of processing.
- Cutout drawing: the cropped child's drawing, not linked to any name, purged after at most 30 days.
- Scan session token: a short-lived random token, not linked to a person.
Our obligations as processor
DoodleSwim will:
- process the data only on your documented instructions;
- ensure that staff with access are bound by confidentiality;
- apply appropriate technical and organisational security measures;
- assist you, as far as reasonably possible, with data subject requests and with your own security and impact-assessment obligations;
- make available the information you need to show compliance with Article 28;
- delete or return the data at the end of the service, except where the law requires us to keep it.
Sub-processors
You give general authorisation for DoodleSwim to use the sub-processors below, each bound by equivalent data-protection obligations. We will inform you of intended changes so you can object:
- Stripe (payment processing).
- Mailgun (transactional email).
- OpenAI (optional theme generation from text only; children's drawings are never sent).
- Our hosting provider (servers and storage within the European Union).
International transfers
Children's drawings and scan data are stored within the European Union. Where a sub-processor may process limited data outside the EU, it is covered by an appropriate transfer mechanism such as the EU Standard Contractual Clauses.
Security and breaches
We protect the data with measures appropriate to the risk, including access controls, encryption in transit, and prompt deletion of source uploads. If we become aware of a personal data breach affecting your data, we will notify you without undue delay so you can meet your own notification duties.
Data subject rights and erasure
We will help you respond to requests from parents or guardians, including requests to erase a specific child's drawing. You can remove a drawing yourself from your dashboard, and on request we can permanently erase a specific drawing or all data for a tank. See our privacy policy for how to ask.
Retention and return
Source scan photos are deleted within minutes. Cutout drawings are purged automatically after at most 30 days. When the service ends, we delete or anonymise the children's data, except anything the law requires us to keep.
Contact
For any matter under this DPA, email [email protected].