Data processing agreement

1. Who this agreement is between

The controller is the PTA that uses PTA Central (“your PTA”). The processor is Wilgenry (“we”), who make and run PTA Central. In this agreement, words like “personal data”, “processing”, “data subject” and “personal data breach” mean what they mean in the UK GDPR and the Data Protection Act 2018.

2. What we process

• Subject and purpose: providing PTA Central to your PTA: hosting its website, members’ area and records, sending its emails and app notifications, recording its payments, and (if you use them) the optional AI features.
• How long: while your PTA uses PTA Central, and then until the data is deleted as described below.
• People: your committee members, helpers and school staff; parents and carers; donors, ticket buyers, sponsors, stallholders and newsletter subscribers; and children, only in the limited ways described below.
• Kinds of data: names and contact details; orders, payments and claims (including bank details for paying people back); Gift Aid declarations (name, house name or number, postcode); answers to ticket questions (such as a child’s first name and class); chat messages and photos; DBS check facts (the type, date and last four digits, never the certificate); for Santa letters, children’s first names, ages, classes and the details parents choose to share; and technical data such as sign-in records.
• Special category data: PTA Central isn’t designed for it. If your PTA collects any (for example a child’s allergy on a ticket form), your PTA is responsible for having a lawful basis and keeping it to a minimum.

3. How we handle your data

• We only process your PTA’s personal data on your documented instructions. Our terms, your settings and the way your PTA uses PTA Central are those instructions. We’ll tell you if we think an instruction breaks data protection law.
• Everyone at Wilgenry who can access your data is bound to keep it confidential, and only accesses it when needed to run or support PTA Central.
• We keep your data secure with the measures in section 6.
• We help you respond to people exercising their rights. PTA Central has tools to find a person’s details by email, export your mailing list and delete people’s details. If someone contacts us directly about your PTA’s data, we’ll pass it to you without delay.
• We help you meet your duties on security, breach notification, data protection impact assessments and consulting the ICO, taking into account what we know as your processor.
• We give you the information you reasonably need to show you’re meeting your obligations, and allow reasonable audits by agreement, with reasonable notice, no more than once a year unless there’s been a breach.

4. Sub-processors

You give us general permission to use these sub-processors. Each is bound by data protection terms with us, as the law requires.

If your PTA connects SumUp card readers, SumUp processes card payments under your PTA’s own agreement with SumUp.

We’ll tell your super admin by email at least 30 days before we add or replace a sub-processor. If you object for a good data protection reason, we’ll work with you to find a solution; if we can’t, you can end your subscription and we’ll refund any unused part of your year.

Transfers outside the UK: your PTA’s database, files and backups are stored in the UK. Where a sub-processor processes data outside the UK, it’s protected by the safeguards UK law requires, such as UK adequacy regulations or the International Data Transfer Agreement.

5. Security measures

• A separate database and set of files for each PTA, with its own encryption keys.
• Each PTA’s data stored in Amazon Web Services’ London region; nightly backups, encrypted and kept off the server for 30 days.
• Encrypted connections (TLS) for all traffic, with HSTS.
• Sensitive fields encrypted with AES-256-GCM, with keys kept outside the database: children’s Santa letter details, bank details for claims, chat messages, two-step sign-in secrets and integration keys.
• Passwords stored as scrypt hashes, NCSC-style password rules and checks against known breaches; two-step sign-in, required for committee roles; sessions that expire; sign-in throttling and lockouts; new-device alerts.
• Role-based permissions, so each person sees only what they need; Santa letter details visible only to the Santa’s elf role.
• An audit log of sign-ins, changes to money, people, roles and settings, and every look at Santa letter details.
• Strict browser security headers, checked uploads, and private files served only after a permission check.
• Automatic deletion on set dates: Santa letters after the PTA’s delete date, stallholders’ insurance certificates six months after the event, unconfirmed newsletter sign-ups after 30 days, chat after the period the PTA chooses.

More detail is on our security page.

6. If there’s a breach

If we become aware of a personal data breach affecting your PTA’s data, we’ll tell your PTA’s super admin without undue delay, and within 48 hours at the latest. We’ll explain what happened, the kinds of data and roughly how many people are affected, the likely consequences, and what we’re doing about it, adding details as we learn them.

We’ll help you decide whether to report it to the ICO (which must be done within 72 hours of your PTA becoming aware, where it’s needed) and whether to tell the people affected.

7. When your PTA leaves

Before you leave, you can download your records from your members’ area. When your PTA’s account is closed, we delete its personal data within 30 days, unless the law requires us to keep some of it. Copies in our backups are deleted when those backups expire, within a further 30 days.

8. Everything else

The limits on responsibility in our terms apply to this agreement. If this agreement and our terms ever disagree about data protection, this agreement wins. It’s governed by the law of England and Wales.