Information about you: how we use it and who we share it with

The information you provide will be used by East Lothian Council and Cash Registers (Buccleuch) Ltd, trading as CRB Cunningham, to allow you to create an account with which you can make payments for school-related items and expenditure online. In addition, if your child or children are at nursery or primary schools, your account will allow you to pre-order meals for them.

The following information is shared with CRB Cunninghams, who provide the SchoolPay online school payments system;

  1. Data regarding your child(ren):

    Name, Date of Birth, Free School Meal status. These details enable the software to identify and match pupils, with their corresponding free school meal status.
  2. Data regarding your child(ren)’s “main contact”:

    Name, address, telephone, email. These details enable the software the ability to match and contact the account owners whenever necessary (for example, to provide personalised instructions on the registration process). The school staff initiate contact with person(s) identified as the “main contact” via the SchoolPay software.

This sharing is required in order to ensure that you are correctly and successfully linked with your child or children’s records when you apply to create an SchoolPay account. In order for your account to be created, you will be routed to the identity verification system, operated by an external company, called the Improvement Service. This will cross-check the details you give against databases accessible to the Improvement Service. Once your identity is authenticated, you will be transferred into SchoolPay to complete the account creation process.

The council remains responsible for your personal data and that of your children. Technical security and legal obligations are in place to ensure it is kept safe.

All online card payments are protected by Transport Layer Security (TLS), as recommended by the Payment Card Industry Security Standards Council and are directly processed using the Pay360 by Capita service. Capita's online payment management solutions are independently and rigorously security assessed, and are certified by Visa and MasterCard as a Payment Card Industry Data Security Standard (PCI DSS) Level 1 payment processor.

East Lothian Council will hold personal data on your child and the person nominated as our primary contact for a period of seven years after your child leaves school or is transferred to another school out with East Lothian. CRB Cunninghams, which provides the SchoolPay system, will retain the details of people who create SchoolPay accounts for a period of six years. If you make a financial transaction, such as topping up your child’s balance on the SchoolPay system, our finance partner Capita will retain your details securely for a period of six years.

Data processing and sharing agreements are in place between East Lothian Council and CRB Cunninghams (for SchoolPay) and between East Lothian Council and Capita for our income management system (which takes your payments). These agreements protect your data by setting stringent conditions on its storage, processing and use.

If you have any questions, please contact [email protected].

Data controller and contact details

For data collected under this privacy notice, East Lothian Council is the Data Controller (as that term is defined in the EU General Data Protection Regulation (Regulation (EU) 2016/679), registered with the Information Commissioner’s Office, Registration Number Z5759571.

Mandatory data sharing

In addition to the primary purposes, we are also legally obliged to share certain data with other public bodies such as HMRC and will do so where the law requires this; we will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate.

Transfers outside the EEA

The Council will only transfer data to countries outside the EEA when satisfied that both the party which handles the data and the country it is processing it in provide adequate safeguards for personal privacy.

Your rights

You have the right to request access to, copies of and rectification or erasure of personal data held by the Council and can request that we restrict processing or object to processing as well as the right to data portability (i.e. the right to ask us to put your data into a format that it can be transferred easily to a different organisation). If you wish to make use of one of these rights, please email your local contact.

If we have asked for your consent in order to process your personal data you can withdraw this consent in whole or part at any time. To withdraw consent, please email your local contact, who will explain the consequences of doing so in any particular case and initiate proceedings for withdrawing consent.


If you are unhappy with the way we have processed your personal data you have the right to complain to the Information Commissioner’s Office at [email protected] but we ask that you raise the issue with our Data Protection Officer first.