Data Processing Agreement

Effective Date: October 28, 2025

This Data Processing Agreement ("DPA") is an addendum to the Terms of Service ("Agreement") between Tinypaths.com ("Provider," "we," "us") and the childcare provider subscribing to our services ("Client," "you"). This DPA applies to the extent that Provider processes Personal Data on behalf of the Client in the course of providing the Services. It supplements — and does not replace — our Privacy Policy, which describes our data practices in plain language.

1.Definitions

"Applicable Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under the Agreement, including but not limited to the Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), Washington's My Health, My Data Act (MHMDA), the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and the EU General Data Protection Regulation (GDPR), as applicable to the Client's specific location and operations.

"Client Data" means any data, information, or material provided or submitted by the Client or its Authorized Users to the Service in the course of using the Service.

"Data Controller" means the entity that determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, the Client is the Data Controller.

"Data Processor" means the entity that processes Personal Data on behalf of the Data Controller. For the purposes of this DPA, Tinypaths.com is the Data Processor.

"Data Subject" means the individual to whom Personal Data relates.

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to "personally identifiable information" (PII), "protected health information" (PHI), and "consumer health data" as defined under Applicable Data Protection Laws.

"Processing" means any operation performed on Personal Data, such as collection, recording, organization, storage, use, disclosure, or deletion.

"Security Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

2.Roles and Responsibilities

2.1 Parties' Roles

The parties acknowledge and agree that with respect to the processing of Personal Data, the Client is the Data Controller and Tinypaths.com is the Data Processor.

2.2 Provider's Processing of Personal Data

As a Data Processor, Provider shall process Personal Data only on behalf of and in accordance with the Client's documented instructions for the sole purpose of providing the Services as described in the Agreement. Provider shall not retain, use, or disclose Personal Data for any purpose other than for the specific purpose of performing the Services.

2.3 Client's Responsibilities

The Client, as the Data Controller, has sole responsibility for the accuracy, quality, and legality of the Personal Data and the means by which it acquired the Personal Data.

3.Client's Obligations and Warranties

3.1 Compliance with Laws

The Client agrees that it is solely responsible for its compliance with all Applicable Data Protection Laws in its respective jurisdiction(s). This includes, but is not limited to, any laws related to childcare licensing, data privacy, and security.

3.2 Lawful Basis for Processing

The Client represents and warrants that it has a valid legal basis for the processing of all Personal Data provided to the Provider and that its instructions for the processing of Personal Data shall comply with all Applicable Data Protection Laws.

3.3 Consent

The Client is solely responsible for obtaining and documenting all necessary rights, permissions, and consents from Data Subjects (e.g., parents and legal guardians) required by Applicable Data Protection Laws for Provider to process Personal Data on its behalf. This includes, without limitation:

3.4 Notices

The Client is responsible for providing all necessary privacy notices to Data Subjects in a clear and conspicuous manner, as required by Applicable Data Protection Laws.

3.5 Data Subject Requests

The Client is solely responsible for receiving and responding to requests from Data Subjects to exercise their rights (e.g., rights to access, correct, or delete their Personal Data). Provider shall provide reasonable assistance to the Client, upon written request, to facilitate the Client's response to such requests. All such requests from Data Subjects received by Provider will be forwarded to the Client.

4.Provider's Obligations

4.1 Confidentiality

Provider shall ensure that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the Personal Data and are subject to a duty of confidentiality.

4.2 Security

Provider shall implement and maintain appropriate technical and organizational security measures designed to protect Personal Data against a Security Breach, including encryption of data in transit and at rest and strict access controls.

4.3 Sub-processors

Client agrees that Provider may engage third-party sub-processors to process Personal Data on Client's behalf. Provider will maintain a list of its sub-processors and will enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA.

4.4 Data Breach Notification

Provider will notify the Client without undue delay after becoming aware of a Security Breach and will provide reasonable assistance to the Client in its efforts to investigate and mitigate the breach.

5.Indemnification

5.1 Indemnification by Client

The Client agrees to indemnify, defend, and hold harmless Tinypaths.com, its affiliates, officers, directors, employees, and agents from and against any and all third-party claims, demands, losses, liabilities, damages, and expenses (including reasonable attorneys' fees) arising out of or in connection with:

5.2 Indemnification by Provider

Provider agrees to indemnify, defend, and hold harmless the Client from and against any third-party claims alleging that the Service, as provided by Provider, infringes on the intellectual property rights of a third party.

6.Limitation of Liability

6.1 Exclusion of Damages

In no event will either party be liable for any indirect, incidental, special, punitive, or consequential damages of any kind in connection with this DPA, including loss of profits, data, or revenue, even if informed of the possibility of such damages.

6.2 Maximum Liability

Except for liabilities that cannot be excluded by law, each party's total liability arising out of or related to this DPA will not exceed the total amount paid by the Client to the Provider under the Agreement during the twelve (12) months preceding the event giving rise to the claim.

6.3 Exceptions

The limitations in this Section 6 shall not apply to a party's indemnification obligations under Section 5, or to liability arising from a party's gross negligence or willful misconduct.

7.Term and Termination

7.1 Term

This DPA will remain in effect for as long as Provider processes Personal Data on behalf of the Client.

7.2 Data Deletion

Upon termination of the Agreement, Provider shall, at the Client's instruction, delete or return all Client Data in its possession, unless retention is required by applicable law.

8.General Provisions

8.1 Governing Law

This DPA shall be governed by and construed in accordance with the laws of the jurisdiction specified in the main Agreement.

8.2 Entire Agreement

This DPA, together with the Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof. In the event of a conflict between this DPA and the Agreement, the terms of this DPA shall prevail.

Questions About This DPA?

If you're an existing or prospective Client with questions about this Data Processing Agreement, please contact us.

Request Demo
↑