Privacy Notice
Last updated: 3 July 2026
1. Who we are
School2Pay is operated by [COMPANY LEGAL NAME], registered in England and Wales (company number [NUMBER]), registered address [ADDRESS] (“we”, “us”, “our”).
We act as a data processor on behalf of the school or trust (the “school”) that has engaged us to provide payment collection services. The school is the data controller for parent and pupil data.
We are registered with the Information Commissioner’s Office (ICO), registration number [ICO NUMBER].
2. What personal data we collect
Pupils
First name and year group only. We never store surnames, dates of birth, home addresses, or photographs.
Parents and guardians
Email address and, optionally, mobile phone number. These are provided by the school from their existing records.
Consent form responses
Where a school attaches a consent form to a trip payment, parents may submit medical conditions, dietary requirements, and emergency contact details. This is special category data under UK GDPR Art. 9 and is treated with additional safeguards.
Payment data
We do not store card numbers. Payments are processed by Stripe (PCI DSS Level 1). We store a Stripe payment reference and the amount in pence.
School administrators
Name and email address, used to log in to the School2Pay admin portal.
3. How we use your data
- • To send parents a secure, personal payment link by email for school trips, clubs, and activities.
- • To process card payments via Stripe on behalf of the school.
- • To collect and securely store digital consent form responses submitted by parents.
- • To provide the school with a real-time record of payments and consent status.
- • To send transactional emails — payment confirmations and automated reminders — via Resend.
- • To send SMS reminders where a mobile number is held and the school has enabled this feature.
- We do not use personal data for marketing, profiling, or any purpose beyond operating the payment service.
4. Legal basis for processing
Standard personal data (name, email, payment records): processed on the basis of legitimate interests of the school in collecting payments for activities it provides, and performance of a contract between the school and School2Pay.
Special category data (medical conditions, dietary requirements): processed on the basis of explicit consent given by the parent when signing the digital consent form (UK GDPR Art. 9(2)(a)).
5. Data retention
6. Third-party processors
Stripe, Inc. — Card payment processing
PCI DSS Level 1 certified. Data may be transferred to the USA under Standard Contractual Clauses.
Supabase, Inc. — Database hosting
EU region (Frankfurt). Data Processing Agreement in place.
Resend, Inc. — Transactional email delivery
Data Processing Agreement in place.
Vercel, Inc. — Application hosting
EU region. Data Processing Agreement in place.
Twilio, Inc. — SMS notifications (optional)
Only used where school has enabled SMS reminders.
7. Your rights
Under UK GDPR you have the right to:
- •Access the personal data we hold about you
- •Correct inaccurate data
- •Erase your data (where no legal obligation to retain it exists)
- •Restrict or object to processing
- •Withdraw consent for special category data at any time
- •Data portability
To exercise these rights, contact your school in the first instance, or email us at privacy@school2pay.com.
8. Cookies
We use only essential session cookies required to keep school administrators logged in. We do not use analytics, advertising, or third-party tracking cookies.
9. Contact and complaints
For privacy queries: privacy@school2pay.com
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.