Privacy policy

1. Who we are

PTA Central is made and run by Wilgenry (“we”, “us”). You can reach us at hello@ptacentral.co.uk.

This policy covers people who visit ptacentral.co.uk, people who sign up a PTA or get in touch, businesses that sponsor a PTA, and what the PTA Central app does on your phone.

2. Data that PTAs keep in PTA Central

Each PTA uses PTA Central to keep its own records: members, parents and carers, volunteers, donors, ticket buyers and, at Christmas, children’s Santa letters. For that information the PTA is the data controller and we are its data processor. We only use it to run PTA Central for that PTA, under our data processing agreement.

If your question is about information a PTA holds about you or your child, please contact that PTA: its own privacy notice is on its website. If you contact us instead, we’ll pass your request to the PTA and help them answer it.

3. What we collect, and why

We don’t use analytics, advertising or tracking cookies, and we never sell personal data or use it for marketing other companies’ products.

4. The PTA Central app

The app is for members of PTAs that use PTA Central. It talks to your PTA’s site, whose data is stored in the UK (Amazon Web Services, London), and to ptacentral.co.uk when you search for your PTA. It shows only what your role in your PTA allows.

• On your phone the app keeps: which PTAs you’ve added and the email you last used for each (to fill in the sign-in form), your sign-in and Face ID or fingerprint sign-in key in the phone’s secure storage (Keychain or Keystore), and a copy of the lists and pictures you’ve opened, so they load quickly and work with a weak signal. Signing out removes the sign-in and that PTA’s copy. The app never stores your password: your phone’s password manager can, if you choose.
• Pictures you add are made smaller on your phone before they’re sent, and their location details are removed.
• Notifications are sent through Google’s Firebase Cloud Messaging, which receives your phone’s notification token and the notification’s short title and message (never children’s details), and may process them outside the UK.
• Permissions (camera, photos, Face ID or fingerprint, notifications) are asked for only when you first use the feature that needs them.
• The app has no advertising and no analytics. Its information about you is held by your PTA, as described above.

5. Who else handles data

We use a small number of trusted companies to run PTA Central. They may only use data to provide their service to us:

• Amazon Web Services (London): each PTA’s database, files and backups, and sending email. This is where PTA Central’s data is stored.
• Stripe: card payments, for PTA Central subscriptions and sponsorships, and through each PTA’s own Stripe account for its tickets and donations. Card details go straight to Stripe and never reach our servers. Stripe processes data in the UK, the EU and the United States.
• Google Gemini: only if a PTA uses the optional AI features, such as receipt reading. It uses Google’s paid service, which doesn’t use the data to train its models, and may process it outside the UK.
• Google Firebase Cloud Messaging: phone notifications from the PTA Central app. It receives the phone’s notification token and the notification text, and may process them outside the UK.
• Cloudflare Turnstile: only if it’s switched on, a check on forms that you’re a person and not a robot.

Some of these companies may process data outside the UK (for example in the United States). When they do, it’s protected by the safeguards UK data protection law requires. We may also share data if the law requires it.

6. Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to limit or object to how we use it, or to have it in a form you can take elsewhere. Email hello@ptacentral.co.uk and we’ll reply within one month.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

7. Keeping it safe

Each PTA’s data is stored in the UK (Amazon Web Services, London), sent over encrypted connections and protected by two-step sign-in, encryption of sensitive details and careful access controls. Read more on our security page.

8. Children

This website and our sign-up are for adults running PTAs. Children’s details only reach PTA Central when a PTA uses it, for example for Santa letters, where only first names are asked for, the details are encrypted, and they’re deleted on a date the PTA sets. For those, the PTA is the controller.

9. Changes to this policy

If we change this policy we’ll update the date at the top. If a change matters to PTAs using PTA Central, we’ll email their super admins too.