Privacy Policy

Last updated:

1. Purpose of this Notice

This Privacy Policy explains how ZeroPointOne Ventures Ltd, operating SchoolTickets.org.uk ("we", "our", "us"), collects, uses, and protects personal data when you purchase tickets or use our website. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

The data controller is ZeroPointOne Ventures Ltd, operating SchoolTickets.org.uk.
Company No. 17398629.
Registered office: Collingwood Buildings, 38 Collingwood Street, Newcastle upon Tyne NE1 1JF.
Contact for all privacy matters: hello@zp1.ai

3. Personal Data Collected

We collect only the data necessary to process and fulfil ticket orders:

  • Parent information: name and email address.
  • Child information: first name and the first initial of the surname (or first initials of a double-barrelled name), school year and, only where the organiser asks, dietary requirements and allergies, which are shared with the event organiser to keep children safe at the event.
  • Transaction data: order number, event details, and payment confirmation reference.
  • Technical data: IP address, browser type, and security and session identifiers used for site functionality, sign-in and payment fraud prevention.

We do not collect or store full purchaser card details. Card payments are processed securely by Stripe, which acts as a separate data controller. For manual organisation payouts, we collect the account-holder name, sort code and account number. Full bank details are encrypted in storage, shown masked by default, and can only be revealed by authorised administrators for payment administration. Access and changes are recorded for audit.

4. How We Use Personal Data

We use your data to:

  • Process ticket purchases and send confirmation emails.
  • Create an optional Apple Wallet or Google Wallet pass for each ticket, if you choose to add one.
  • Identify the correct pupil and school year for event administration.
  • Contact you regarding your booking or any event changes.
  • Maintain accounting and legal compliance records.
  • Improve the website using aggregated, anonymised analytics (where consented).

5. Lawful Basis for Processing

Processing relies on:

  • Contract performance: to supply tickets and fulfil your purchase.
  • Legitimate interests: to manage event allocations and prevent duplicate records.
  • Legal obligations: to retain transaction information for audit and tax purposes.
  • Consent: for optional analytics or marketing communications (only if actively provided).

6. Data Sharing

We only share data where necessary:

  • Stripe Payments UK, Ltd. – payment processing.
  • Schools or event organisers – to confirm attendance and manage event logistics.
  • IT service providers – website hosting, database, and email delivery infrastructure.
  • Apple – only if you choose "Add to Apple Wallet". The pass shows the event, organiser, date, time, venue, session, ticket reference and check-in QR code, and the child's first name and surname initial(s). It never includes school year, email addresses, dietary or allergy information. Once added, the pass is stored on your device and may be synced through your Apple account under Apple's own privacy policy. We cannot change or remove a pass after it has been added, but cancelled or refunded tickets are not accepted at the door.
  • Google – only if you choose "Add to Google Wallet". The pass shows the same details as an Apple Wallet pass: the event, organiser, date, time, venue, session, ticket reference and check-in QR code, and the child's first name and surname initial(s). It never includes school year, email addresses, dietary or allergy information. Google stores the pass in its Wallet service and in your Google account, under Google's own privacy policy. We do not update a pass after it has been added, but cancelled or refunded tickets are not accepted at the door.

All third parties are bound by strict data protection terms and cannot use data for unrelated purposes.

7. International Data Transfers

All data is stored in the United Kingdom.
If any service provider processes data outside the UK, it will be subject to an adequacy decision or standard contractual clauses under UK GDPR.

8. Data Retention

We retain data only for as long as necessary:

  • Ticket and transaction records: 6 years (accounting compliance).
  • Child identification data: 12 months after the related event.
  • Marketing and consent data: until consent is withdrawn.

Data is securely deleted or anonymised once retention limits expire.

9. Cookies and Analytics

Essential cookies support organiser sign-in (__session and related cookies managed by Clerk) and request security (csrf-token, 4 hours). Sign-in cookie expiry follows the provider's session settings. Ticket purchasers can receive the security cookie without signing in.
Stripe.js may use fraud-prevention cookies, including __stripe_mid (1 year) and __stripe_sid (30 minutes). It loads when you open a ticket-booking or payment-confirmation page, not on an initial visit to ordinary pages. Once loaded, it may remain active during navigation in the same tab. Stripe receives the related fraud-prevention signals.
Clerk provides organiser sign-in. Any identity provider selected during sign-in may also use cookies under its own notices.
The older purchase flow stores pendingTickets in browser local storage to complete a purchase after a payment redirect. It is removed after successful ticket creation but has no automatic expiry if the purchase is abandoned or fails.
We do not currently use our own advertising or analytics cookies. Any future optional analytics cookies would require your consent.
You can manage cookies and clear local storage in your browser settings; disabling them may affect sign-in, secure forms and payments.
Our Cookie Policy explains the names, purposes, durations, users and providers of cookies and similar storage.

10. Data Security

We implement appropriate technical and organisational measures to secure all data, including encryption, access restriction, and regular system audits. Access to pupil identifiers is strictly limited to authorised personnel.

11. Children's Data

We collect only a child's first name and first initial(s) of surname(s), school year and, only where the organiser asks, dietary requirements and allergies, which are shared with the event organiser to keep children safe at the event. These details are provided voluntarily by a parent or guardian for ticket allocation.
We do not collect data directly from children.

12. Your Rights

You have the right to:

  • Access your data.
  • Request correction or deletion.
  • Restrict or object to processing.
  • Withdraw consent.
  • Complain to the Information Commissioner's Office (ICO): www.ico.org.uk.

To exercise your rights, email hello@zp1.ai.

13. Updates to this Policy

We may update this policy periodically. The most recent version will always be available on this page with an updated "Last updated" date.

14. Contact

Email: hello@zp1.ai
Website: https://schooltickets.org.uk