Privacy Policy

Class Fundraising, TS18 3TR (“we”, “us”) is the data controller for personal data collected through this site. We provide our service using the Hoodies for Good system under licence. Hoodies for Good hosts and operates the system on our behalf and handles personal data only to provide the service, under written terms.

• School contacts: name, email address, phone number, school name and delivery address, and the password for your dashboard (stored hashed).
• Pupil information: first and last names, and where relevant a self-portrait drawing, used only to produce the hoodies. We do not collect pupil information for any other purpose.
• Order information: design, hoodie and print choices, sizes, quantities, proof approvals and payment status.
• Payment information: handled by Stripe. We do not see or store card numbers.
• Technical information: basic data needed to keep the service working and secure, such as session cookies.

• To process and deliver your order, including producing proofs and hoodies (performance of a contract).
• To create and manage your dashboard account and send order and account emails (performance of a contract).
• To take payment and keep accounting records (contract and legal obligation).
• To keep the system secure and prevent misuse (legitimate interests).
• To answer your enquiries and provide support (legitimate interests).

We do not sell personal data, and we do not use pupil information for marketing.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In particular:

• Lawfulness and transparency: we only process data where we have a lawful basis, and we explain what we do in this policy.
• Data minimisation: we ask only for what we need. Designs that do not use names never ask for pupil names.
• Children's data:pupil information is provided by the school. The school is responsible for having a lawful basis, and where required consent, to share it with us. We give pupil data extra care and never display children's names publicly.
• Accuracy and storage limitation: we keep data up to date where we can and delete it when it is no longer needed (see section 8).
• Security: we use appropriate technical and organisational measures (see section 6).
• Personal data breaches:if a breach puts people's rights at risk, we will notify the Information Commissioner's Office within 72 hours of becoming aware and tell affected schools without undue delay.

Under UK GDPR you have the right to:

• be informed about how your data is used
• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased in certain circumstances
• restrict or object to certain processing
• receive your data in a portable format
• withdraw consent where we rely on it

Parents and guardians can ask us, through their school or directly, to access, correct or delete their child's information. To exercise any right, email privacy@hoodiesforgood.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.

The Hoodies for Good system was built with security as a core requirement. Our measures include:

• Encryption in transit: all traffic between your browser and the system uses HTTPS/TLS.
• Account protection: email verification, hashed passwords, and sessions that expire.
• Access control: each school can only see its own orders, proofs and data. Our admin area is restricted to authorised staff.
• Private order links: links used to manage an order use long, unguessable tokens.
• Server-side validation: prices, quantities and order details are checked on the server, not just in the browser.
• Payments: card payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card details never pass through our own servers.
• Infrastructure: hosting, database and payment services are provided by established providers that hold recognised security certifications. Data is encrypted at rest and backed up regularly.
• Least privilege: only people who need pupil information to produce an order can access it.

We share personal data only where needed to deliver the service:

• Hosting and database providers that run the system
• Stripe, to take card payments
• Our email provider, to send order and account emails
• Production and delivery partners, who receive only what is needed to make and ship your order

Some providers may process data outside the UK. Where they do, we rely on approved safeguards such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

• Pupil names and drawings: for the order and a short period afterwards for support and reprints, then deleted.
• Order and invoice records: 7 years, for accounting and legal requirements.
• School account data: while your account is active and for up to 2 years after.
• Payment card details: not stored by us.

We use only the cookies needed to keep you signed in and the service secure. We do not use advertising cookies.

We may update this policy and will change the date above when we do. Questions about privacy can be sent to privacy@hoodiesforgood.co.uk or by post to Class Fundraising, TS18 3TR. See also our Terms & Conditions.