Privacy
What we hold, and why
This is a draft, not a legal notice. It sets out the questions a real privacy notice has to answer and marks the ones still unanswered. It must be completed and reviewed by someone qualified before any real child’s data is collected.
What we hold
For each child: their name, their class, the photographs their parent uploads, the written answers their parent enters, and a private link.
For each parent: the contact number the school provided, and optionally their name.
For school staff using the dashboard: name, email address, and a record of the actions they take.
Where it comes from
The school provides the class list and parent contact numbers. Photographs and answers come from parents themselves.
Parents do not create an account. Access is by a private link sent to the number the school provided.
Why we hold it
To produce the printed photo book the school has commissioned, and to let parents contribute to it and correct it before it goes to print.
Who else sees it
The school. The print shop receives the finished pages. Photographs are stored with a cloud storage provider and are never publicly reachable.
TO BE COMPLETED: name the storage provider, the messaging provider and the print shop, and the country each stores data in.
How long we keep it
TO BE COMPLETED. There is currently no automatic deletion. A retention period has to be set and honoured before real data is collected.
Your rights
You can ask for a copy of what is held about your child, ask for it to be corrected, or ask for it to be deleted.
TO BE COMPLETED: give a real contact address and say how quickly requests are answered.