Privacy Policy
Last updated: 8 July 2026
Scribbledeedo® is a brand of Watoto Play Ltd.
This Privacy Policy explains how Watoto Play Ltd collects, uses, stores and protects personal information when you use the Scribbledeedo® website, app, courses, membership, waitlists, forms, emails, downloads, live sessions, and related services.
For privacy questions, please contact:
privacy@watotoplay.com1. Who we are
Scribbledeedo® is a family creativity and connection brand operated by Watoto Play Ltd.
In this Privacy Policy, “Scribbledeedo®”, “we”, “us” and “our” mean Watoto Play Ltd, operating the Scribbledeedo® brand.
- Data controller: Watoto Play Ltd
- Brand: Scribbledeedo®
- Privacy contact: privacy@watotoplay.com
- Business address: [Insert business address]
2. Who this service is for
Scribbledeedo® is designed to support parents, carers and families through creative activities, courses, resources and relationship-building experiences.
Our services are intended to be managed by adults. Children may take part in activities with the support and supervision of a parent, carer, teacher or responsible adult.
Children should not create accounts, purchase services, join mailing lists, or submit personal information without appropriate adult involvement.
3. Personal information we collect
We may collect the following types of personal information:
Account and contact information
- name
- email address
- billing details
- account login details
- membership or course access details
- communication preferences
Form and waitlist information
When you complete a form, join a waitlist, download a resource, or register interest, we may collect:
- name
- email address
- form/list you joined
- source page
- consent preferences
- date and time of submission
- optional details such as your audience type (e.g. parent/carer, educator, practitioner), child age range, or topic interests
Course and membership information
If you join a course, membership or live session, we may collect:
- course enrolment details
- subscription/membership status
- lesson progress and completed activities
- live call registration or attendance information where applicable
- messages or responses you choose to submit
User-submitted images, artwork and reflections
If you submit images, artwork, captions or reflections to a gallery, community space or activity, we may collect what you submit.
This is higher-risk personal data because what you upload may contain personal data, children’s data, wellbeing information, disability or neurodivergence information, family information or other sensitive content depending on what you choose to share.
We explain how we use and protect this in our User-submitted content and images section.
Payment information
Payments may be processed by third-party payment providers such as Stripe. We do not store full card details on our own systems. Payment providers process payment information according to their own privacy and security practices.
Technical information
When you use our website or app, we may collect:
- IP address
- device type
- browser type
- pages visited
- approximate location based on device or IP information
- cookie and analytics information
- error logs and security logs
Child-related information
Scribbledeedo® activities are family-focused, but we aim to avoid collecting unnecessary personal information about children.
Where child-related information is collected, for example a child’s age range, activity preference, or parent-submitted information, we will only use it for the purpose explained at the time and with appropriate parent/carer involvement.
We do not knowingly ask children to provide personal information directly for marketing purposes.
4. How we use personal information
We use personal information to:
- provide access to courses, memberships, resources and downloads
- manage accounts and subscriptions
- send service emails, such as account, access, booking or membership information
- send marketing emails where you have opted in or where the law allows
- manage waitlists, signups and form lists
- schedule and send admin-created email campaigns or drip emails to selected lists
- provide live call details and replays to eligible customers
- respond to enquiries and support requests
- improve our website, app, courses and services
- protect the safety and security of our systems
- comply with legal, tax, accounting and regulatory obligations
5. Legal bases for using personal information
Where UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, or EU GDPR applies, we rely on one or more of the following legal bases:
Consent
We use consent where you choose to join a mailing list, receive marketing emails, accept optional cookies, or provide optional information.
You can withdraw consent at any time.
Contract
We use personal information where needed to provide something you have requested or purchased, such as a course, membership, live call, download or account access.
Legitimate interests
We may use personal information where we have a legitimate interest in doing so, such as improving our services, responding to enquiries, preventing misuse, and sending certain communications to existing customers where permitted.
Before relying on legitimate interests, we consider our specific purpose, whether the use is necessary to achieve it, and whether your rights and freedoms override our interests.
We do not rely on “recognised legitimate interests” for ordinary marketing, website security or product improvement; recognised legitimate interests are limited to specified public-interest purposes only.
Legal obligation
We may process personal information where we need to comply with legal, tax, accounting or regulatory duties.
Vital interests
In rare circumstances, we may use personal information to protect someone’s life or safety.
6. Email marketing and communications
We may send you emails if:
you join a mailing list
you join a waitlist
you request a free resource
you register for a course, membership or live call
you are an existing customer and the law allows us to contact you about similar services
you have otherwise given us permission
You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting privacy@watotoplay.com.
We may still send essential service emails, such as account access, payment, subscription, safety, or course access information.
7. Cookies and analytics
We may use cookies and similar technologies to:
- make the website work
- keep your account secure
- remember preferences
- understand how people use the website
- improve our services
- support marketing, where consent is required
Where required, we will ask for your consent before using non-essential cookies.
You can manage cookies through your browser settings and, where available, through our cookie consent settings.
Under changes introduced by the Data (Use and Access) Act 2025, some low-risk cookies and similar storage technologies that are necessary or have minimal privacy impact may not require consent; we will still be transparent about what we use and why.
8. How we share personal information
We may share personal information with trusted service providers who help us operate Scribbledeedo®.
This may include:
- website and app hosting providers
- email service providers
- payment processors
- analytics providers
- customer support tools
- file storage providers
- professional advisers, such as accountants or legal advisers
- regulators or authorities where legally required
We do not sell your personal information.
We do not allow service providers to use your personal information for their own unrelated purposes.
9. International transfers
Because we may use online service providers, your personal information may be processed in countries outside the UK, Ireland, the European Economic Area, Canada, or your country of residence.
Where required, we use appropriate safeguards, such as contractual protections, adequacy decisions, or other lawful transfer mechanisms.
10. How long we keep personal information
We keep personal information only for as long as needed for the purposes described in this Privacy Policy.
Typical retention periods may include:
- account information: while your account remains active
- course and membership records: while access is active and for a reasonable period afterwards
- payment and transaction records: as required for tax and accounting purposes
- marketing records: until you unsubscribe or ask us to delete your details
- support enquiries: for a reasonable period after the enquiry is resolved
- legal or safety records: as long as needed to protect rights, safety, or comply with law
We may anonymise information so it no longer identifies you and use it for service improvement or reporting.
11. How we protect personal information
We take reasonable steps to protect personal information, including:
- limiting access to people who need it
- using secure service providers
- using account authentication
- using technical and organisational safeguards
- monitoring for misuse or security issues
- keeping records only for as long as needed
No online service can be guaranteed to be completely secure, but we work to protect your information appropriately.
12. Exercising your data protection rights (including subject access)
Depending on where you live, you may have the following rights over your personal information under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, EU GDPR, or other applicable privacy laws:
- the right to be informed about how we use your personal information
- the right to access the personal information we hold about you (a “subject access request”)
- the right to have inaccurate personal information corrected
- the right to have personal information erased
- the right to restrict how we use your personal information
- the right to object to certain uses
- the right to receive a copy of your personal information in a portable format
- the right to withdraw consent at any time where we rely on consent
- rights relating to automated decision-making, including profiling, where this produces legal or similarly significant effects about you
Making a subject access request
You can ask us for a copy of the personal information we hold about you, and for information about how we use it, who we share it with, how long we keep it, where it came from, and whether it is used for automated decision-making.
To make a request, contact privacy@watotoplay.com with enough detail so we can identify you and understand what you are asking for.
How we handle your request
- We normally respond to a subject access request without undue delay and within one calendar month. If we need information from you to confirm your identity, confirm your authority to act for someone else, or clarify what you are asking for, the time limit may not start or may pause until we receive the information we reasonably need. We will not use this to avoid responding.
- If your request is complex or you have made a number of requests, we may extend our response time by up to two further months. If we do this, we will let you know within one calendar month of receiving your request and explain why the extension is needed.
- We will carry out a reasonable and proportionate search for the information you have asked for. This means looking in the places where the information is likely to be held, rather than searching every possible system or backup indiscriminately. If you do not narrow your request, we will still carry out reasonable searches where possible.
- We will normally provide the information where we are able to.
- We may refuse a request, or charge a reasonable fee, only where the request is manifestly unfounded or excessive, or where a specific exemption or restriction applies. If we refuse your request in whole or in part, we will explain the reasons for our decision and tell you about your right to complain to the Information Commissioner’s Office.
Identity verification
We may need to verify your identity before responding, so that personal information is not disclosed to the wrong person. We will only ask for what is necessary and proportionate.
Automated processes and decisions
We use automated processes for some routine tasks, such as sending confirmation emails, reminders, or routing messages. We explain these transparently in this policy.
We do not use automated decision-making that produces legal or similarly significant effects about you unless we have a lawful basis and provide appropriate safeguards. If that changes, we will update this policy and explain how you can seek human review or object.
To exercise any of these rights, contact privacy@watotoplay.com.
13. Data protection complaints
If you are unhappy with how we have handled your personal information, you have the right to complain. We want to put things right where we can, and we encourage you to contact us first.
How to complain
Contact privacy@watotoplay.com with the words “Data protection complaint” and a description of what has happened.
How we handle your complaint
- We will acknowledge your complaint within 30 days of receiving it.
- We will investigate your complaint and respond to you without undue delay.
- We will keep you informed of progress, and if we need more information or more time, we will contact you and explain why.
- We will tell you the outcome of your complaint and any steps we have taken or will take.
- We will keep a record of your complaint and how it was handled.
Your right to complain to the ICO
You have the right to complain to the Information Commissioner’s Office (ICO) at any time. The ICO is the independent authority that oversees data protection in the UK. You do not have to complain to us first, although we would welcome the chance to resolve your concern.
You can contact the ICO at: ico.org.uk · 0303 123 1113 · Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you are in Ireland, you can contact the Data Protection Commission at dataprotection.ie. If you are in the EU, you can contact your local data protection authority.
14. UK and Ireland privacy rights
If you are in the UK, Ireland, or the European Economic Area, you may have rights under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, or EU GDPR.
You may also have the right to complain to your local data protection authority.
In the UK, this is the Information Commissioner’s Office.
In Ireland, this is the Data Protection Commission.
We encourage you to contact us first so we can try to resolve your concern.
15. Canadian privacy rights
If you are in Canada, you may have rights under Canadian privacy laws, including PIPEDA where applicable.
You may request access to your personal information, ask for corrections, withdraw consent where appropriate, and ask questions about how your information is handled.
Commercial electronic messages will include identification information and a way to unsubscribe where required.
16. United States privacy rights
If you are in the United States, your rights may depend on your state.
Where applicable, you may have rights to access, delete, correct, or opt out of certain uses of personal information.
We do not sell personal information.
Where “sharing” for cross-context behavioural advertising is legally defined and applicable, we will provide appropriate choices or opt-out mechanisms.
17. Children’s privacy
Scribbledeedo® is family-focused, but it is not intended for children to independently create accounts, join mailing lists, make purchases, or submit personal information without adult involvement.
Parents and carers should supervise children’s use of Scribbledeedo® activities.
If we become aware that we have collected personal information directly from a child without appropriate consent or lawful basis, we will take steps to delete it or obtain appropriate consent where required.
For US users, if the Children’s Online Privacy Protection Act applies, we will obtain verifiable parental consent before knowingly collecting personal information online from children under 13.
For UK and Ireland users, we take children’s privacy seriously and aim to follow child-centred privacy principles where children are likely to access our services.
18. User-submitted content and images
If you submit images, artwork, captions, reflections, feedback, or other content, you confirm that you have the right to share it.
User-submitted images, artwork and reflections are higher-risk personal data because what you upload may contain personal data, children’s data, wellbeing information, disability or neurodivergence information, family information or other sensitive content depending on what you choose to share.
We will only use what you submit for the purpose explained at the time, and we will not use it for unrelated marketing without your permission.
You can ask us to remove your submitted content at any time by contacting privacy@watotoplay.com.
19. Special category or sensitive information
Please do not submit sensitive personal information unless we specifically ask for it and explain why it is needed.
Sensitive information may include health information, disability information, mental health information, religious beliefs, racial or ethnic origin, or other protected information.
If we do collect sensitive information, we will only do so where we have a lawful basis and, where required, explicit consent or another legal condition.
20. Third-party links
Our website, emails, courses or resources may include links to third-party websites, platforms or services.
We are not responsible for the privacy practices of third-party websites. You should read their privacy policies before using them.
21. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
When we make significant changes, we will update the “Last updated” date and, where appropriate, notify users by email or through the website/app.
22. Contact us
For privacy questions, requests or concerns, contact:
Scribbledeedo® is a brand of Watoto Play Ltd.