[Participating School Name] ("Controller"), the educational institution providing pupil data for ticketing and event management.
Together referred to as "the Parties".
2. Purpose
The Processor will process limited pupil and parent information on behalf of the Controller solely to administer and fulfil event ticketing. This Agreement sets out the data protection obligations required under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. Subject Matter and Duration
Subject matter: processing of pupil and parent information for ticket sales, event coordination, and attendance validation.
Duration: for the period necessary to administer the event(s) and up to 12 months after the final event, after which data will be deleted or anonymised.
4. Nature and Purpose of Processing
Processing activities include:
Receiving and storing ticket order information.
Associating tickets with pupils by first name, surname initial(s), and school year.
Providing organisers with attendance lists.
Sending booking confirmations and relevant event communications.
No automated decision-making, profiling, or marketing to children takes place.
5. Categories of Data Subjects
Pupils attending the event.
Parents or guardians purchasing tickets.
School staff acting as event organisers (if applicable).
6. Types of Personal Data
Pupil: first name, first initial of surname (or first initials of a double-barrelled name), school year.
Parent: name and email address.
Event details: order number, ticket references, attendance records.
Technical data: IP address (for security logging).
No special category data (e.g. health, ethnicity, religion) is collected.
7. Processor Obligations
The Processor shall:
Process personal data only on documented instructions from the Controller.
Ensure all personnel handling data are subject to confidentiality obligations.
Implement appropriate technical and organisational measures to ensure data security, including:
encrypted transmission and storage;
restricted access controls;
secure hosting in the United Kingdom.
Not engage sub-processors without the Controller's prior written authorisation.
Assist the Controller in fulfilling data subject rights requests (access, rectification, erasure, etc.).
Notify the Controller without undue delay of any personal data breach.
Provide all necessary information to demonstrate compliance and allow audits by the Controller (with reasonable notice).
Delete or return all personal data upon completion of processing, unless retention is required by law.
8. Sub-Processing
Where third-party service providers are used (e.g. hosting, email delivery), the Processor ensures they:
Operate under binding written contracts with equivalent UK GDPR safeguards;
Process data only for the defined purpose;
Are subject to appropriate security standards.
Current sub-processors include:
Provider
Purpose
Location
Hosting provider
Web hosting and database
United Kingdom
Stripe Payments UK, Ltd.
Payment processing (parents only)
United Kingdom / EEA
9. Data Transfers
Personal data is processed and stored within the United Kingdom. If any transfer outside the UK becomes necessary, the Processor will apply appropriate safeguards under Chapter V of the UK GDPR.
10. Controller Obligations
The Controller shall:
Provide only the minimum necessary pupil data.
Ensure all disclosures to the Processor are lawful under UK GDPR.
Inform parents/guardians, through their own privacy notices, that the Processor assists with event ticketing.
Promptly notify the Processor of any requests or changes affecting lawful processing.
11. Data Breach Notification
In the event of a personal data breach, the Processor shall:
Notify the Controller promptly with all known details;
Cooperate in assessing risk and, if required, assist the Controller in notifying the ICO and affected individuals.
12. Liability
Each Party is liable for its own breaches of this Agreement and of applicable data protection law. Nothing in this Agreement limits statutory liability under the UK GDPR.
13. Termination
Upon termination or completion of event-related services, the Processor will securely delete or anonymise all personal data unless legal retention requirements apply.
14. Governing Law
This Agreement is governed by the laws of England and Wales, with exclusive jurisdiction in the courts of England.