East Sheen Primary School PTA (“the PTA”, “we”, “us”) is a registered charity (no. 273295) run by parent volunteers to raise money for the children of East Sheen Primary School. This policy explains what personal information we collect through this website (espspta.org), why we collect it, who we share it with, how we keep it safe, and the rights you have over it. We are the data controller for this information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information we collect
We only collect what we need for the activity you are taking part in. Depending on what you do on the site, that may include:
- Donations and Gift Aid — your name, email address, the amount given and, if you make a Gift Aid declaration, your home address and postcode (HMRC requires these for the claim).
- Orders and bookings (for example Christmas trees, Year 6 photos, Quiz Night tables, fair tickets) — your name, email address, phone number, what you ordered, your chosen collection or event date, payment status and any note you leave us.
- Volunteering and sign-ups (for example Clean-Up Day, Open Mic, the bike ride) — your name, contact details and anything else the form asks for, such as the jobs you would like to do or a child’s year group so we can place families together.
- Suggestions and messages — such as book suggestions for the school libraries, which may include a child’s first name and class if you choose to give them.
- Local businesses and supporters — the business name, contact name, email address, phone number and our correspondence with them about sponsorship, prizes and offers.
- PTA organisers — the names, email addresses and login details of committee volunteers who use the admin area.
- Technical information — anonymous, aggregated page-view statistics (page visited, country, device type). We do not use advertising or tracking cookies.
Payment card details are entered directly into our payment provider, Stripe, and never pass through or are stored on our own systems. We do not knowingly collect information from children; where a form asks for a child’s name, class or age, it is provided by a parent or carer and used only for that activity.
2. How we use it
- To process your donation, order or booking, send you a confirmation and get your tree, photos, table or tickets to you.
- To claim Gift Aid from HMRC on donations where you have made a declaration.
- To organise events and volunteering, and to contact you about something you have signed up for.
- To keep records of our fundraising and accounts, as a registered charity must.
- To approach local businesses about supporting the school, and to thank and credit those who do.
- To understand how the site is used, in aggregate, and keep it secure.
Our legal bases for this are: contract (processing your order or booking), legal obligation (Gift Aid and charity accounting records), legitimate interests (running the PTA, fundraising, keeping the site secure, contacting local businesses) and consent where we specifically ask for it. We do not sell personal information, and we do not use it for marketing by third parties.
3. Who we share it with, and how
We share information only with the organisations that help us run the site and the PTA. Each acts under a contract or terms that require them to protect it, and we share only what each needs. Information is passed to them over encrypted (HTTPS) connections by the website itself, not by hand.
- Stripe — takes card payments and sends you a payment receipt. Stripe receives your name, email address and the amount; your card details go only to Stripe.
- Supabase — hosts our database, where orders, bookings, sign-ups and donation records are stored.
- Vercel — hosts the website and provides the anonymous usage statistics.
- Resend — delivers our confirmation and transactional emails on our behalf.
- Cloudflare — stores and serves purchased photo files.
- Google Workspace — our pta@espspta.org mailbox, where copies of confirmations and your emails to us are kept.
- HMRC — receives the name, address, postcode and donation details of anyone who has made a Gift Aid declaration, as the law requires for the claim.
- Suppliers for specific events — for example, the Christmas tree grower receives the buyer names needed to label each tree. We give them the minimum needed and nothing else.
Some of these providers process data outside the UK, mainly in the EU and the United States. Where they do, transfers are covered by the safeguards the UK GDPR allows, such as the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework. We will also disclose information if the law requires us to.
4. How we keep it safe
- The whole site is served over HTTPS, so information you enter is encrypted in transit.
- Card payments are handled by Stripe, which is certified to PCI DSS Level 1. We never see or store full card numbers.
- Our database is not publicly readable. The website reads and writes it using private server-side credentials, and row-level security is switched on for tables holding personal information.
- Only PTA committee volunteers who need access have an admin login. Each has their own account and password, with permissions limited to the sections they work on. Passwords are stored as salted hashes, sessions expire, and access is removed when a volunteer steps down.
- Secret keys for our providers are held in the hosting platform’s encrypted settings, not in the website’s code.
- We collect the minimum, and we anonymise or delete records once an event or campaign is over (see below).
- If we ever became aware of a breach that put your rights at risk, we would tell you and the Information Commissioner’s Office as the law requires.
5. How long we keep it
- Gift Aid declarations and donation records — six years after the end of the tax year they relate to, as HMRC requires.
- Orders and bookings — until the event is over and the accounts for it are closed, then anonymised or deleted within 12 months.
- Volunteer sign-ups and suggestions — anonymised once the event or campaign has finished.
- Business contacts — for as long as the business is supporting, or may support, the school; removed on request at any time.
- Emails to pta@espspta.org — kept for the period needed to deal with them and for our records, then deleted.
6. Cookies
The public pages of this site set no tracking or advertising cookies. The only cookie we set ourselves is a secure login session cookie for PTA organisers using the admin area. Our payment form is provided by Stripe, which may set its own cookies for fraud prevention while you pay; see Stripe’s privacy policy.
7. Your rights
Under the UK GDPR you can ask us to:
- tell you what information we hold about you and give you a copy;
- correct anything that is wrong;
- delete it, where we no longer need to keep it;
- stop or restrict how we use it, or object to our use of it;
- give you the information you provided in a form you can take elsewhere; and
- withdraw any consent you have given, at any time.
To do any of these, email pta@espspta.org. We will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
8. Links to other sites
Our pages link to other organisations, such as our business supporters, booking and payment services, and the school’s own website. Their privacy policies apply once you leave espspta.org.
9. Changes to this policy
We will update this page if what we collect or how we use it changes, and show the date of the latest version at the top.
10. Contact us
East Sheen Primary School PTA, c/o East Sheen Primary School, Upper Richmond Road West, London SW14 8ED.
Email: pta@espspta.org · Registered charity no. 273295.