Privacy policy

About us

School Milk Services Ltd is the data controller for the personal information described in this notice. This means we decide why and how that information is used.

This notice covers parents and carers, customer contacts at schools, NHS sites and other organisations, and people who contact us or use our website.

We handle personal information in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended.

You can contact us at:

School Milk Services Ltd
Manor Farm, Collum Lane, Kewstoke
Weston-super-Mare, North Somerset, BS22 9JL
Email: sales@schoolmilkservices.co.uk

Our Managing Director oversees data protection. Please use these details for privacy enquiries, complaints or requests about your information.

Information we collect

Depending on the service you use, we collect:

• Names, addresses, email addresses and telephone numbers.
• Organisation and delivery-site details, account references and contact information.
• Orders, standing orders, delivery instructions and correspondence.
• Payment and transaction information needed to administer accounts.
• Information provided by parents or carers to register a child for school milk, including the child’s name, age or relevant birthday information, and school details.
• Information supplied when making an enquiry, reporting a problem or requesting an account change.

For our NHS supply service, allergen requirements are recorded at site level, such as a nut-free site. We do not collect individual patient medical or dietary information for that contract.

We receive information directly from you and, where applicable, from your organisation when it identifies you as a contact.

Collected Technical Data

• IP Address: Stored in an anonymized form, primarily used to determine the geographic location of access.
• Requested Data: The specific name of the requested file, webpage, or URL.
• Referrer: The previously visited website that directed the user to the page.
• Device & OS: The operating system and device type used (such as mobile or desktop).
• Browser Details: The browser type and specific version.
• Access Timestamp: The exact date and time of access.
• Transfer Volume: The amount of data transferred during the request.
• Requesting Provider: The visitor's internet service provider or network provider.

Purpose and Retention

Operational Purpose: Used for ensuring trouble-free server operation, security maintenance, and technical optimization.

Retention Period: Standard usage and server log data is typically deleted automatically within a maximum of seven days

Why we use information

We use personal information to:

• Set up and administer accounts and registrations.
• Process orders and payments and arrange deliveries.
• Contact you about the service you have requested.
• Answer enquiries, resolve problems and process refunds.
• Maintain necessary financial records.
• Protect our systems and manage disputes.

Where an individual buys services from us, we rely on the contractual lawful basis for information necessary to enter into and perform that contract.

We rely on legitimate interests to use organisational contact details to manage customer relationships, orders and deliveries. Our interests are providing an effective supply service and communicating with the people responsible for it.

For children’s registration information, our proposed basis is to administer the school milk service requested by a parent or carer and ensuring the service is provided to the correct child.

We rely on legal obligations where we must retain or provide information for accounting, tax or other statutory purposes. We may also rely on legitimate interests to protect our systems and establish, exercise or defend legal claims.

Where information is necessary to provide a service, we will explain this when collecting it. Without the required details, we may be unable to set up an account or fulfil an order.

Registration invitations and service communications

Schools distribute our introductory information to parents through paper leaflets, letters or school-issued emails, inviting parents to register for the milk service.

Where a parent or carer chooses to pre-register, we use the registration details to follow up about the requested service, including an invitation to arrange payment when the child approaches their fifth birthday.

We also send payment reminders and other communications needed to administer existing accounts and orders. NHS contacts receive account and service communications relating to their supply arrangements.

Where we rely on consent for any additional use of information, we will explain that purpose and ask for a clear, positive choice. Visiting our website or accepting general terms does not, by itself, provide consent.

You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Who receives information

Authorised staff have access to information where needed for their responsibilities.

We also use providers supporting our internal systems, IT security, cloud backups, email, website and payment processing. Information is shared with them where necessary for those services.

Our payment provider is Elavon whose own privacy notice can be viewed here https://www.elavon.co.uk/privacy-policy.html. Payment information gathered and stored is transaction key, payee email address and amount paid.

The child’s name and class information is sent to the school on a weekly basis for distribution purposes.

We may disclose information where required by law, to obtain professional advice or to establish, exercise or defend legal claims. Relevant information may also be disclosed in connection with a business sale or reorganisation, subject to appropriate protections.

Storage and security

Our internal customer system, Roundsman, is hosted on a server at our premises. Daily backups are sent to cloud storage. IT checks backups and tests restoring them.

Access to internal information is restricted. Child-registration information requires a company-computer login and a separate internal-system login.

Drivers’ handheld devices require a PIN. Remote access requires IT review and Managing Director approval. Multifactor authentication is used for new email logins.

Completed round sheets are held in our office, which is locked overnight, and shredded after one month. Downloaded contact lists are encrypted while held on our server and deleted after use.

IT monitors the connection between our server and Roundsman and receives alerts if the connection is lost.

International transfers

Storage, backups and website services are stored within EU data centres. Email and payment services are stored in UK-based data centres.

How long we keep information

We retain information only for as long as it is needed for its purpose, including any applicable legal obligations and the resolution of outstanding balances, refunds, complaints or disputes.

Relevant accounting and transaction records are normally retained for six years from the end of the company financial year to which they relate, or longer where legally required.

Children’s registration and operational delivery information is assessed separately. A connection with a payment does not automatically mean every registration detail must be retained for the full accounting period.

Child registration and account data is stored until the child leaves primary school.

Completed round sheets are shredded after one month. Temporary downloaded contact lists are deleted after use.

Information no longer required will be securely deleted or anonymised.

Your rights

Depending on the circumstances, you can:

• Request access to your personal information and a copy of it.
• Ask us to correct inaccurate information or complete incomplete information.
• Request deletion or restriction of processing.
• Object to processing based on legitimate interests.
• Receive information you have provided in a structured, commonly used, machine-readable format where the right to portability applies.
• Withdraw consent where we rely on it.

You can object to direct marketing at any time.

Some rights depend on the circumstances and lawful basis. We will explain any lawful reason why we cannot fulfil a request.

Requests can be made using the contact details above and do not need particular wording. We may ask for information reasonably needed to verify identity or authority to act for someone else.

We normally respond without undue delay and within one month. Where the law permits an extension or adjustment to the response period, we will explain this.

Requests are normally free. We will only charge a reasonable fee or refuse a request where permitted by law, and will explain our reasons.

Children have their own data protection rights. Where a parent or carer makes a request about a child, we will consider their authority to act and the child’s understanding and interests.

Complaints

Please contact us if you are concerned about how we use your information so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office:

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

Cookies and website technologies

1. Cookies Used by Default

Session Cookies: These temporarily assign a random "session ID" to a visitor's browser. They ensure the site functions smoothly (e.g., maintaining items in a shopping basket or keeping a user logged in across multiple pages).

Expiration: These strictly necessary cookies contain no permanent personal tracking info and are automatically wiped as soon as the visitor closes their browser session.

2. Built-in Analytics Technology (IONOS SiteAnalytics)

No Cookies for Tracking: Unlike tools like Google Analytics, IONOS SiteAnalytics does not use cookies to track user behaviour.

Tracking Pixels & Log Files: Traffic data is collected exclusively using server side log files or a basic invisible tracking pixel embedded in the code.

Anonymisation: The system registers browser type, device type, and referrer URLs. The user's IP address is anonymised immediately upon transmission so that individual visitors cannot be personally identified or tracked across the web.

No profiling or automated decision making takes place.

Changes to this notice

We will publish updates on our website when our practices or legal requirements change. Where appropriate, we will also bring significant changes to your attention directly.