Privacy notice for parents

Last updated [09/10/2026].

This explains what we hold about you and your child when you order from your school's shop, why we hold it, and what you can ask us to do about it.

Schools using our portal are given a separate notice, which they can read when signed in.

Who is responsible

Whitstable Print Ltd, trading as Art Projects For Schools, is the data controller for everything described here.

Unit 3, Joseph Wilson Industrial Estate, Millstrood Road, Whitstable, Kent CT5 3PS info@apfs.org.uk 01227 262417

ICO Registration Number: ZB976552

What we hold

About you. Your name and email address, and when you last signed in. We do not hold a password, because we sign you in with a code we email you instead. We also record that you accepted our terms, which version you accepted, and whether you asked to receive our emails. For those two choices we keep the date and time, the IP address and the browser they were made from, so that we can show what was agreed and when.

About your child. Their first and last name, their school, and their class. Nothing else. We do not ask for a date of birth, a home address, a photograph of your child, or any contact details for them.

The picture you upload. The artwork itself, and the version that results from any straightening, cropping or rotating you do in the shop. We keep the picture exactly as it arrived as well, so that nothing you do can lose the original. If you ask for an enhanced version, we keep that too and record which service made it. You can throw an enhanced version away at any time before you order.

Your order. What you ordered, for which child, the quantities, prices, VAT and order number, when it was paid for, and any refund.

Your basket. What is in it and when you last touched it, so that we can remind you if you asked us to.

Your payment. Taken by Stripe. We never see or hold your card number. We keep Stripe's reference for the payment, the amount and the date.

Signing in. Your email address and a one way scrambled copy of the code we sent you. The code expires shortly after it is sent and the record of it is deleted automatically.

Technical records. A record of your signed in session, which includes your IP address and browser, and our server logs. These are used to keep the shop working and to prevent abuse.

Why we hold it, and our lawful basis

| What for | Lawful basis | | --- | --- | | Taking your order, printing it and getting it to your school | Our contract with you | | Taking payment and dealing with refunds | Our contract with you | | Emailing you about your order, including when artwork needs replacing | Our contract with you | | Reminding you about a basket you did not finish | Your consent | | Sending you news about future projects | Your consent | | Enhancing a picture with AI | Only when you ask for it, as part of our contract with you | | Keeping the shop secure and preventing abuse | Our legitimate interests | | Keeping accounting and tax records | Our legal obligations | | Measuring how the shop is used | Your consent, through the cookie banner |

You do not have to accept our marketing emails to place an order. If you change your mind, every email we send has an unsubscribe link, and you can change the setting in your account at any time.

Your child's information

You give us your child's name and class. We never ask your child for anything, and your child does not have an account.

We need the name so that the right artwork is printed for the right child, and the class because that is how the print room groups a school's order so the school can hand the parcels out. For that reason your child's first name, last name and class appear on the printing paperwork, and your school can see what its own pupils have ordered.

We do not ask for your home address, because orders are delivered to the school rather than to you.

The AI enhancement option

If you choose to try an enhanced version of a picture, the picture is sent to the service that does the work, which is currently ImageKit and, for some options, OpenAI. The copy they receive is deleted again as soon as the enhanced version comes back. Your original is never replaced, and you choose which version is printed.

This is never applied to a photograph of a person. It is offered for a child's drawing or painting.

No decision about you is made automatically. Nothing here profiles you.

Who else sees it

We do not sell your information to anybody, and we do not share it for anyone else's marketing.

It is handled on our instructions by:

• Stripe, which takes the payment.
• Our own print room, which is part of the same company.
• Your child's school, which sees what its pupils ordered so that it can distribute the parcels, and which class each item belongs to.
• Hetzner, which hosts the service, in Germany.
• IDrive e2, which stores our encrypted backups, in the European Economic Area.
• Amazon Web Services and SMTP2GO, which deliver our email.
• ImageKit and OpenAI, only when you ask for an enhanced picture.
• Google Analytics, only if you agree to analytics cookies.

We will also disclose information where the law requires it.

Information that leaves the UK

Most of what we hold stays in the UK or the European Economic Area, which the UK recognises as offering equivalent protection.

Where a service we use is based outside those countries, including OpenAI and Google, the transfer is covered by [the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses], and we have satisfied ourselves that your information is protected. You can ask us for details.

How long we keep it

• Your account, orders and artwork: [for as long as your child takes part, and then for 6 years].
• Accounting records, including what you paid: six years, which is the period we are required to keep them for.
• Sign in codes: minutes, and the record of them is deleted automatically.
• Backups: copies of our records are held in encrypted backups which are deleted on a rolling schedule, the last of them after two years.

When a period ends, we delete the information or anonymise it so that it is no longer about you.

Keeping it safe

The shop and the portal are served over encrypted connections. Pictures are stored in private storage and are only ever served through the application to somebody entitled to see them. Access to our administration system is limited to named members of staff, protected by two factor authentication, and restricted to approved locations.

Your rights

You can ask us to:

• give you a copy of what we hold about you and your child,
• correct anything that is wrong,
• delete it, where we do not need to keep it,
• stop using it for a particular purpose, or restrict how we use it,
• send it to you or to somebody else in a portable form, and
• stop sending you marketing, which takes effect immediately.

Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.

Write to info@apfs.org.uk and we will answer within one month. We may ask you to confirm who you are first.

If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

Cookies

The shop sets a small number of cookies that are necessary for it to work: they keep you signed in, keep your basket, and protect the site against forged requests. These cannot be turned off.

With your agreement we also use Google Analytics, which sets cookies that tell us how many people use the shop and which pages they use. These are not necessary, they are off until you agree, and you can change your mind at any time using [the cookie settings link in the footer]. We do not use advertising cookies and we do not track you across other websites.

Changes to this notice

If we change how we use your information we will update this notice and, where the change matters to you, tell you about it the next time you sign in. The date at the top shows when it last changed.