Version 1.0 · September 2026
1. Purpose and roles
Customer uses DailyDotKids to manage child care operations. For personal information Customer enters into or generates through DailyDotKids about children, families, and staff (“Customer Personal Information”):
- Customer is the organization that determines the purposes and means of processing (controller / equivalent under applicable Canadian privacy law).
- Anthor processes Customer Personal Information only to provide, secure, and support DailyDotKids, and on Customer’s documented instructions (including configuration and use of the product).
2. Scope of processing
- Subject matter: Hosting and processing of daycare operational records via DailyDotKids (Admin, Teacher, Parent apps and related APIs).
- Duration: For the term of Customer’s use of DailyDotKids, plus any retention period described in our retention practices or required by law.
- Nature: Collection, storage, retrieval, transmission, display, backup, and deletion as needed to operate the service.
- Categories of data: May include names, contact details, attendance, health/allergy notes, emergency contacts, activity logs, photos, documents Customer uploads, and account credentials metadata — as entered by Customer or its users.
- Data subjects: Children enrolled at Customer’s centres, parents/guardians, and Customer’s staff/users.
3. Customer responsibilities
- Ensure Customer has lawful authority (including parental authorizations where required) to upload and process children’s and families’ information.
- Configure access (invitations, roles) appropriately; revoke access when staff or families leave.
- Use DailyDotKids in line with applicable child care licensing and privacy obligations.
- Not instruct Anthor to process data unlawfully.
4. Anthor obligations
- Process Customer Personal Information only to provide DailyDotKids and related support, or as required by law.
- Maintain appropriate technical and organizational measures described in our Security & data residency materials (including Canadian regional hosting for core production database and file storage).
- Ensure persons authorized to process Customer Personal Information are under confidentiality obligations.
- Assist Customer, where reasonably practicable, with data subject or regulator requests that relate to the platform.
- Notify Customer of a confirmed personal information breach affecting Customer Personal Information without unreasonable delay, consistent with our incident response practices.
- Upon end of service and Customer’s written request, delete or return Customer Personal Information from production systems within the retention windows we publish, except where law requires retention.
5. Subprocessors
Customer authorizes Anthor to use subprocessors listed at dailydotkids.ca/subprocessors.html (or the then-current list). Anthor remains responsible for subprocessors’ performance insofar as they process Customer Personal Information for DailyDotKids. Material additions will be reflected on that page; Customer may object on reasonable privacy grounds by emailing hello@dailydotkids.ca within 15 days of notice of a material change.
6. International transfers
Core production database and file storage for DailyDotKids centres (Canada and the USA) are hosted in Canada (Google Cloud northamerica-northeast1). We aim to keep daycare operational data local to each country as regional hosting expands. Certain delivery services (for example push notifications or app stores) may process limited data outside Canada as described in the Subprocessors list. Customer instructs Anthor to make such transfers as needed to operate the service.
7. Security
Anthor will implement and maintain reasonable safeguards appropriate to the sensitivity of children’s and family information, including encryption in transit, encryption of sensitive fields and vault files as described publicly, access controls, and secret management. Customer acknowledges that no method of transmission or storage is fully secure.
8. Audits
Upon reasonable written request no more than once per 12 months, Anthor will provide available security documentation (for example architecture/residency summary and policies). On-site audits are not offered at this stage unless required by law or separately agreed in writing.
9. Liability
Liability under this DPA is subject to the limitations in the DailyDotKids Terms of Service, except where prohibited by applicable law. Nothing in this DPA reduces Customer’s obligations as a licensed child care operator.
10. Order of precedence
If this DPA conflicts with the Terms of Service on data protection, this DPA controls for that conflict. Capitalized terms not defined here have the meaning in the Terms, if any.
11. Governing law
This DPA is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable therein, without regard to conflict-of-law rules.
Signatures
Anthor Canada corp
Name: _______________________________
Title: _______________________________
Date: ________________________________
Customer
Legal name: __________________________
Name: _______________________________
Title: _______________________________
Date: ________________________________
This addendum is effective when signed by both parties. For questions, email hello@dailydotkids.ca.