Privacy Policy

DotasToys is an educational platform for children aged 2 to 12. The platform is operated by DotasToys, based in the Netherlands. If you have questions about this privacy policy, you can contact us at info@dotastoys.com.

We collect the following data from the parent/guardian:

• Name and email address (at registration)
• Password (stored encrypted)
• Subscription details
• Payment details (processed via Mollie — we do not store card details)

From the child, we collect:

• First name and date of birth
• Chosen avatar (emoji)
• Learning progress, quiz results and points
• Date of last activity

We collect no location data, phone numbers or sensitive personal data of children.

We use the data exclusively for:

• Providing and improving the educational platform
• Tracking children's learning progress
• Processing subscription payments
• Sending relevant emails (e.g. welcome email, confirmations)
• Customer service

We never sell your data to third parties.

DotasToys is aimed at children, but accounts are created and managed by the parent or guardian. By creating a child profile, you as parent/guardian give consent for the processing of your child's data.

We comply with the General Data Protection Regulation (GDPR) and adhere to the additional rules for processing data of children under 16.

All data is stored on secure servers via Supabase (EU data centre). We use encrypted connections (HTTPS) and encrypted password storage (bcrypt).

Data is not stored longer than necessary. After cancellation of your account, data is deleted within 30 days, unless a legal retention obligation applies.

DotasToys uses technically necessary cookies for your cart and login session. Analytics and advertising cookies are placed only if you consent to them via the cookie banner.

With your consent we use Google Analytics and Hotjar (statistics) and Meta Pixel, the Pinterest Tag and OpenAI Pixel (advertising). Without consent these are not loaded. You can change your choice at any time via /cookies.

We work with the following trusted parties:

• Supabase — database and authentication (EU servers)
• Mollie — payment processing (Dutch provider)
• Brevo — email communication (opt-in newsletter)
• Vercel — web hosting (US, EU-US Data Privacy Framework)
• Google Gemini — AI for educational content (anonymised prompts)
• Goedgepickt — order fulfilment and shipping (name and address)
• Jortt — bookkeeping and invoicing (invoice data)
• Google Analytics and Hotjar — website statistics — only with your consent
• Meta, Pinterest and OpenAI — advertising measurement — only with your consent

The first six parties process data solely on our behalf. The analytics and advertising parties also use data for their own purposes, which is why we ask for your consent in advance and you can withdraw it at any time via /cookies.

As a parent/guardian you have the right to:

• Access — request what data we hold about you
• Rectification — have incorrect data corrected
• Erasure — have your account and all data deleted
• Objection — object to certain processing activities
• Data portability — request your data in a readable format

Send an email to privacy@dotastoys.com to exercise your rights. We respond within 30 days.

This privacy policy may be updated. For significant changes we will inform you by email. The date of the last change is at the bottom of this page.

By continuing to use DotasToys you accept the updated policy.

Questions or complaints about our privacy policy? Contact us at privacy@dotastoys.com.

You also have the right to lodge a complaint with the Data Protection Authority: autoriteitpersoonsgegevens.nl.