Do we need a data processing agreement with SwapThat?
Yes, and it is already written. Where SwapThat processes personal data for your company — above all the people in your photographs — your company is the controller and SwapThat is the processor, and article 28 of the GDPR requires an agreement between the two.
An approver in your company accepts it once, in Settings, on behalf of the company. Nobody can generate an image until it has been accepted. It is versioned: if we change it materially, we ask again.
It lists which providers process your images, where, and on what basis anything leaves the EU, together with the retention periods and the security measures.