This policy explains what personal data BMA Pay collects, why, who sees it and how long we keep it. BMA Pay is where parents and carers pay for events, trips, clubs and shop items at Brampton Manor Academy.
Who is responsible for your data
Brampton Manor Trust, Roman Road, London, E6 3SQ, runs Brampton Manor Academy and BMA Pay. It is the "data controller". This means it decides how your data is used and is responsible for keeping it safe. We follow the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
This policy adds to the Academy's other privacy notices, including the Privacy Notice for Pupils. If they disagree, the Academy's notice applies.
To ask a question or use your rights, see our contact page. Put "Data request" in the subject.
What we collect
About you (parent or carer)
- Your name, title and email address.
- Your password. We store it in a scrambled form, so we cannot read it.
- What you buy: items, prices, dates, payment status, receipts and refunds.
- The last four digits of the card you paid with, and the payment approval code. We never see or store your full card number. You type it on the secure page of our payment provider.
- If you pay through a shared payment link without an account: your name and email address.
- Places you are waiting for, if you join a waiting list.
About your child
- Name, date of birth, year group, form and classes, and the school's student number.
- Which parents and carers are linked to them.
- What has been bought for them (for example a trip or club place), and, where it applies, tickets checked in at the door and club attendance.
We get this from the school's records (Arbor). Staff can also add or correct it by hand. Your child does not have a BMA Pay login.
Health and consent details for trips (special category data)
For some trips we ask you to fill in a form with your child's medical conditions, medication, allergies, food needs and an emergency contact, and to tick a box to give consent. We also keep your answers to any extra questions the trip asks. Health data needs extra care under the law, so we do the following.
- We ask for your explicit consent. You give it by ticking the box on the form. You can withdraw it by contacting us. If you do, we may not be able to take your child on the trip.
- We store these details in encrypted form.
- Only staff who need them for that trip can see them. Every time they are seen or downloaded, it is recorded.
- We delete them after the trip. See "How long we keep it" below.
Technical data
- Your IP address and browser details, and a record of important actions on your account (for example signing in, changing a password, paying).
- This is kept to protect the service, to find and fix problems, and to show who did what.
Why we use it, and the legal reason
- To run your account and take your payments. This includes emailing receipts, tickets and waiting-list offers. The reason is that we need to do this to provide the service you ask for (contract).
- To confirm that a parent may see a child. You enter your child's date of birth before you can see their profile. The reason is our legitimate interest in protecting children's information.
- To keep the service safe. This includes bot protection, limits on repeated requests and the activity log. The reason is our legitimate interest in security and preventing fraud.
- To keep accounting records and answer to auditors. The reason is a legal obligation.
- To look after your child on a trip. This means using the health and consent details. The reason is your explicit consent.
We do not use your data for marketing. We do not sell it. We do not make decisions about you by computer alone.
Who can see your data
- School staff can see what they need for their job. Finance staff see payments. Staff running a trip, club or event see who is booked on it. Only staff given special permission see trip health details.
- Companies that help us run BMA Pay. They may only use your data to do that. They are listed below.
- Others, only if the law requires it, for example the police, or if a safeguarding concern means we must share it.
| Company | What they do for us |
|---|---|
| Fiserv | Takes card payments and sends refunds. |
| Arbor | The school's records system. We read pupil and parent details from it. |
| Amazon Web Services (SES) | Sends our emails. |
| Cloudflare | Sits between you and our servers to block attacks and bots, and provides the bot check on our forms. |
| Sentry | Tells us when the website has an error, so we can fix it. It is set up not to collect personal details. |
| Our hosting provider | Runs the servers and database that hold our data. |
If a company handles data outside the UK, we make sure the transfer has proper legal protection, such as the UK International Data Transfer Agreement or a UK decision that the country is adequate.
How long we keep it
- Payment and accounting records: six years after the payment, as the law requires.
- Your account: while it is open. If you ask us to close it, we delete or anonymise your details within one month. We keep payment records for the six years above.
- Trip health and consent answers: deleted 30 days after the trip returns. We keep the record that you gave consent, and when, but not the health details.
- Your child's saved health details: deleted if they have not been updated for 365 days.
- Waiting lists: your entry is deleted 90 days after it ends.
- Activity and security logs: only as long as needed to keep the service secure and to investigate problems.
How we protect it
- All traffic is encrypted between your device and us.
- Health details are encrypted in our database.
- School staff must use a second step (an authenticator app) to sign in.
- We limit repeated sign-in attempts, and we record who sees or downloads sensitive data.
If there is a data breach that puts people at risk, we will tell the Information Commissioner's Office and, where required, the people affected.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data;
- correct data that is wrong;
- delete your data, in some cases;
- stop or limit how we use your data, in some cases;
- give you your data in a form you can move elsewhere;
- stop using your data for a reason you object to;
- take back your consent, where we rely on it.
Use our contact page. We reply within one month. You do not have to pay. We may ask you to prove who you are. If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use only cookies that the service needs to work. They keep you signed in, keep your session secure and protect our forms. Cloudflare's bot check may also store a small piece of information in your browser to tell people from bots. We do not use advertising or analytics cookies.
Changes to this policy
If we change how we use your data, we will update this page and the date at the top. For big changes we will also tell you by email.