Privacy notice

[DRAFT: THIS IS A PLACEHOLDER, NOT COOL MILK'S PRIVACY NOTICE. It has not been written or reviewed by anyone qualified. The owner and the Data Protection Officer must replace every section before it is published.]

Who we are

[DRAFT: the legal name and address of the organisation responsible for personal data in this portal, and how to contact the Data Protection Officer.]

What information we hold

[DRAFT: the categories of personal data. The data map in the internal portal (Data protection, Data map) lists what the portal actually holds, table by table: parents' names, email addresses, phone numbers and addresses; children's names, dates of birth, school, funding type and milk balance; payments; support tickets.]

Why we use it, and our lawful basis

[DRAFT: each purpose and the lawful basis for it, decided by the Data Protection Officer. Marketing email needs consent and is separate from everything else.]

Who we share it with

[DRAFT: the organisations that handle data for us. The processor register (docs/data-protection/processor-register.md) lists them as the code uses them today: confirm it and describe each in plain words.]

How long we keep it

[DRAFT: the retention schedule once the owner and the Data Protection Officer have agreed it.]

Children

[DRAFT: how this notice speaks to parents about their children's information, and the position of schools whose pupils are in the portal without a parent account.]

Your rights

[DRAFT: the right to see, correct and erase your data, to restrict or object to its use, to move it, to withdraw consent and to complain to the Information Commissioner's Office, and how to ask.]

Contact

[DRAFT: where to send a request.]