School Data Processing Agreement

Scribbletastic · Expressions Creative Studio · Version 1.0 · June 2026

UK GDPR CompliantChildren's DataEdtech Safe

In short

✓No child accounts. Children only type a first name or nickname on a shared class device.
✓No email addresses, photos, or personal identifiers collected from children.
✓Your school stays in control. Teachers can delete all class data at any time.
✓We never sell, share, or advertise using any data.
✓Data is encrypted and access-controlled. Only your school sees your class data.
✓We will sign a countersigned DPA on request. Just email us.

1. Parties to This Agreement

Data Processor: Expressions Creative Studio, operating Scribbletastic.
Contact: expressionscreativestudio@gmail.com

Data Controller: The subscribing school or educational institution (the School), represented by the member of staff who created the Scribbletastic school account.

By using Scribbletastic in a school setting, the School confirms it has the authority to enter into this agreement on behalf of the institution.

2. What Data Is Processed

Teacher and staff accounts:

Email address and name (required for login)
Class names and pupil first-name lists (created by the teacher)

Children (pupils):

First name or nickname only, typed by the child on a shared device
Drawings (image file and optional stroke recording)
Mood check-ins (emotion selected from a list, e.g. happy, calm, worried)
An optional short note about how they feel

Not collected: No child email addresses, passwords, photos, dates of birth, location data, device identifiers, or any identifier beyond a first name.

3. Purpose of Processing

Data is processed solely to provide the Scribbletastic service to the School:

Enabling children to draw and complete mood check-ins on shared class devices
Allowing teachers to view class artwork and emotional wellbeing patterns
Optional sharing with parents or a named therapist, when enabled by the teacher

No data is used for advertising, profiling, or research.

4. School Responsibilities

As Data Controller, the School is responsible for:

Obtaining appropriate parental or guardian consent before children use the app
Ensuring children only enter a first name or nickname, not a full legal name
Only sharing class access with authorised parents or therapists
Deleting class data at the end of each academic year using the tools provided
Notifying Expressions Creative Studio of any suspected data breach promptly

Tip: Use the "Delete all student data" button inside each class at the end of the school year to permanently remove all drawings and mood data.

5. Our Responsibilities as Processor

Expressions Creative Studio commits to:

Processing school data only on the School's documented instructions
Maintaining appropriate technical and organisational security measures
Not transferring data outside the EEA without appropriate safeguards
Assisting the School in responding to subject access requests
Deleting or returning all school data upon termination of the service
Notifying the School of any personal data breach within 72 hours

6. Data Retention and Deletion

Data is retained while the school subscription is active.

Teachers can delete all drawings and mood data for any class at any time via the School Dashboard. This is immediate and permanent.

Upon cancellation or account closure, all associated data is deleted within 30 days.

7. Sub-Processors

We use the following sub-processors to deliver the service:

Sub-processor	Purpose	Location
Hosting provider	App hosting, database and authentication	EU/EEA
Stripe	Payment processing (teacher accounts only)	EU/USA (SCCs)

No child data is passed to Stripe. Stripe only processes teacher billing information.

Need a countersigned DPA?

Some schools and MATs require a formally countersigned DPA for their procurement process. We are happy to provide one. Email us with your school name and we will return a signed copy within 5 working days.

Request a Signed DPA