GDPR Privacy Policy

1. Who We Are

School Fundraising Company ("we", "us", "our") operates a fundraising platform that helps schools manage children's artwork and generate personalised keepsakes. We are the data controller for the personal data we process in connection with this service.

2. Data We Collect

We may collect and process the following categories of personal data:

• School & organiser details: contact name, school name, email address, phone number, and delivery address.
• Children's data: child's first name and surname, and a unique reference code used to identify artwork. This is collected to personalise products (e.g. "Designed by [Child's Name]").
• Customer order data: name, email, phone, delivery address, and payment confirmation (we do not store full card details).
• Artwork images: scanned or uploaded children's artwork used to create personalised products.

3. Legal Basis for Processing

We process personal data under the following lawful bases under UK GDPR:

• Contract: to fulfil orders and deliver personalised products you have purchased.
• Consent: for processing children's artwork and names to create personalised keepsakes (e.g. "Designed by [Child's Name]").
• Legitimate interests: for communication about projects and service improvements.
• Legal obligation: to retain financial records as required by law.

4. How We Use Your Data

• To create and deliver personalised products featuring children's artwork.
• To process and fulfil customer orders.
• To communicate with schools and organisers about fundraising projects.
• To calculate and pay commission to participating schools.

5. Data Sharing

We do not sell personal data. We share data only with trusted third parties who help us deliver our service, such as payment processors, print and fulfilment partners, and cloud storage providers. All processors act under appropriate data processing agreements.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal and accounting requirements. Children's artwork images are retained for the duration of the project and a reasonable period thereafter, then deleted unless otherwise requested.

7. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your personal data.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.

To exercise any of these rights, please contact us using the details below.

8. Children's Data

Our service involves processing children's artwork and names. We collect the child's first name and surname to personalise products (e.g. "Designed by [Child's Name]"). We work directly with schools and parents to ensure that consent is obtained before any child's artwork or name is used. We minimise the data we hold about children and do not knowingly collect additional personal data from children.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including encrypted storage, access controls, and regular security reviews.

10. Contact Us

If you have any questions about this policy or wish to exercise your data protection rights, please contact us via our Contact page.