ST PAUL’S PARENTS’ ASSOCIATION
Privacy & cookies
How information is used for the SPPA’s 2026 tea towel fundraiser. Last updated 25 September 2026.
Who is responsible
St Paul’s Parents’ Association (SPPA), registered charity number 1130128, organises this fundraiser and is responsible for the order information collected through this shop. The shop supports St Paul’s Catholic Primary School, Thames Ditton; it is run by the parents’ association.
For privacy questions or requests about your information, contact sppa@stpauls-thamesditton.surrey.sch.uk.
Information collected when you order
The order form asks for the purchaser’s name and email address, children’s names and year groups, and quantities for each year group. When you continue to payment, the shop stores these details together with an order reference, creation date, amount and payment status. An unpaid order may remain if the SumUp payment is not completed.
Children’s details help match tea towels to the correct family for collection. Please provide only the details requested and only where you are their parent, carer or otherwise authorised to arrange collection. No child’s account is needed.
The shop does not upload portraits or collect additional artwork through this order form. This notice covers ordering, not the separate arrangements for collecting children’s artwork.
Why information is used
Purchaser and order details are used to take steps at your request before purchase, fulfil your order, arrange collection and deal with order enquiries. This processing is necessary for the purchase contract.
Children’s names and year groups are used for the SPPA’s legitimate interest in matching and distributing orders correctly. Necessary technical records support the legitimate interest in keeping the shop secure. Financial information may also be kept to meet applicable accounting and legal obligations. Order details are not used by this shop for advertising or mailing-list subscriptions.
You do not need to consent to marketing to place an order. Acknowledging the cookie notice is separate from the use of information needed to handle your order.
Payments through SumUp
After the shop records your order, it shows the exact amount and an order reference, then links to the SPPA’s SumUp payment page. You enter the amount on SumUp and may add the order reference as a note. The shop does not send children’s names or card details to SumUp. Card details are entered on SumUp’s website and are not stored in this shop.
The SPPA checks SumUp payments against order references and amounts, then marks orders paid manually. A visit to the payment link alone does not confirm an order. SumUp handles information on its own site under its privacy information.
Who can access information
The shop provides access to order records and downloadable order lists to its authorised order administrator. The SPPA uses the details needed to organise the fundraiser and collection. Its hosting and database providers, OpenAI Sites and Cloudflare, process information needed to host, deliver and secure the service; SumUp handles payments.
Providers may process information outside the UK. Their privacy information explains where they process data and the safeguards they use: OpenAI, Cloudflare and SumUp. Contact the SPPA for information about its arrangements.
Keeping and removing order records
The relevant retention criteria are completion of the fundraiser and collection, resolution of enquiries, refunds or disputes, and any applicable financial record-keeping requirements. Children’s collection details do not need to be retained merely because a financial record is still needed.
Order records are not automatically deleted by this shop. The SPPA manages their retention and removal, including downloaded copies. Contact sppa@stpauls-thamesditton.surrey.sch.uk to ask how long your records will be kept or to request deletion where applicable.
Your rights and enquiries
Depending on the circumstances, you can ask to access, correct or erase personal information, restrict its use, object to processing based on legitimate interests, or request a portable copy. Some financial records may need to be kept despite a deletion request. Contact sppa@stpauls-thamesditton.surrey.sch.uk; the SPPA may need to verify your identity before responding.
You can also raise a concern with the UK Information Commissioner’s Office.
Changes to this notice
This notice should be updated if the shop’s handling of information changes. Any future optional tracking must have an appropriate choice before it is enabled; acknowledging this notice does not authorise future tracking.