Privacy Policy

SchoolCart is a trading name of DREO Solutions Limited, registered in England & Wales, company number 16303674. We are the “controller” of the personal information described here, which means we decide how and why it is used. We follow UK data protection law (the UK GDPR and the Data Protection Act 2018).

Information you give us

• Your name, email address and password. Your password is stored in a protected (hashed) form, so we cannot read it.
• Optional details such as a phone number and address. These are private to you and are not shown to other members.
• The schools you follow.
• Your listings: titles, descriptions, photos, sizes, condition, prices and handover preferences.
• Your messages to other members, your reservation requests, your saved items and any reports you make.

Information created as you use the site

• Notifications we generate for you (for example a new message or an item you asked to be told about).
• Technical information such as your IP address and browser type, which our hosting and security systems record to keep the service working and safe.

What other members see is only a short display name (for example “Sarah M.”), your listings and the messages you send them.

We do not knowingly collect information about children.

Please do not put children's names, dates of birth, photos or other personal details in listings or messages. If you photograph clothing, lay it flat or use a hanger, and make sure no child, face or name-tape is visible. We may remove content that breaks this rule.

UK law says we need a lawful reason for using personal information. Ours are:

• To provide SchoolCart to you (contract): creating your account, showing your listings, passing on messages and reservation requests, and sending notifications and emails about them.
• To keep SchoolCart safe (legitimate interests): checking first listings, handling reports, blocking, preventing fraud and misuse, and keeping security and audit records.
• To meet legal duties (legal obligation): such as keeping company and tax records, and responding to lawful requests.
• To improve and run the service (legitimate interests): understanding in general terms how the site is used and fixing problems. If we add analytics that uses cookies or similar technology, we will ask for your consent first.

We do not use your information for advertising, and we do not sell it or use it to make automated decisions that have legal or similarly significant effects on you.

• Other members see your display name, your listings and your photos, and the messages you send them. They do not see your email, phone number or address.
• Our team can see account details, listings and reports when needed to run and protect the service. Admin actions are recorded in an audit log.
• Authorities. We may share information where the law requires it, or where it is needed to prevent or investigate a crime or to protect someone's safety.
• Business changes. If the business were sold or reorganised, your information could pass to the new owner, who would have to protect it in line with this policy.

We use trusted providers (called “processors”) who handle information only on our instructions and under contract:

• a hosting provider to deliver the website;
• a database, sign-in and file storage provider to store accounts, listings, messages and photos;
• an email provider to send account and notification emails.

Some providers may process information outside the UK. When they do, we make sure it is protected by approved safeguards, such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

• Your account information, listings, photos, messages and saved items are kept while your account is open.
• When you delete your account, we delete your profile and the information that belongs to it. Messages you sent may be removed along with it.
• Some records are kept longer where we have a good reason or a legal duty, for example security and audit logs, records of reports about serious misuse, and accounting records.
• Listings expire after 90 days. Expired listings are kept so you can relist them, until you delete them.

Under UK data protection law you have the right to:

• be told how your information is used (this policy);
• see the information we hold about you and get a copy;
• have wrong information corrected;
• have your information deleted;
• restrict or object to some uses of it;
• receive your information in a portable form, and withdraw consent where we rely on it.

You can do much of this yourself in Account settings:

• change your name, email, password and contact details;
• download a copy of your data;
• turn email notifications on or off;
• delete your account.

For anything else, contact us (see below). We will reply within one month.

We use only the cookies and similar storage the site needs to work, such as keeping you signed in securely. These do not need your consent. We do not use advertising cookies. If we add analytics or other optional cookies, we will ask first and you will be able to say no.

Connections to SchoolCart are encrypted, passwords are stored in protected form, and access to information is limited by strict rules in our database, so members can only see what they should. No online service is perfectly secure, so please use a strong, unique password. If there is a breach that puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

We will update this page if we change how we use information, and change the “last updated” date. For important changes we will also tell members by email or on the site.

DREO Solutions Limited, trading as SchoolCart. Registered in England & Wales, company number 16303674.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.