Privacy Policy

1. Introduction

IANTZ LIMITED ("we", "us", "our"), trading as Payments by iAntz, is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our payment platform and website.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to school staff users, parents/guardians, and visitors to our website.

By using our services, you agree to the collection and use of information in accordance with this policy.

2. Data Controller and Processor Roles

Company Name: IANTZ LIMITED

Company Number: 13777598

ICO Registration Number: ZC093007

Registered Office Address:
3 Princes Court, Royal Way, Loughborough, Leicestershire, United Kingdom, LE11 5XR

General Enquiries: [email protected]

Data Protection Lead: Our data protection lead can be contacted at [email protected]

Our Role as Controller vs Processor

Under UK GDPR, our role depends on the type of data:

• School customer accounts and billing data: IANTZ LIMITED acts as Data Controller. We decide how to collect and use this data to provide our services and manage our relationship with schools.
• Student/pupil data entered by schools: IANTZ LIMITED acts as Data Processor. The school or trust is the Data Controller for student data. We process this data only as instructed by schools and in accordance with our Data Processing Agreement.
• Parent/guardian accounts created directly: IANTZ LIMITED acts as Data Controller for account and payment data. For student information linked to parent accounts, we act as Data Processor on behalf of the school.

If you have questions about data subject rights or wish to make a request, please contact our data protection lead at [email protected].

3. Information We Collect

We collect different types of personal data depending on how you interact with our services:

3.1 School Users (Administrators)

• Name and contact details (email, phone number)
• Job title and role within the school
• School or trust name and address
• Account credentials and authentication data
• Payment and transaction data
• Usage data and system logs
• In-app messages and communications sent through the platform
• Push notification preferences and device tokens (if enabled)
• Communication preferences

3.2 Parents and Guardians

• Name and contact details (email, phone number, address where provided)
• Payment card information (processed securely by our PCI-DSS compliant payment processor)
• Student information (name, year group, class) as provided by the school
• Transaction history and payment records
• Account credentials and authentication data (including passkeys and multi-factor authentication, where used)
• In-app messages between schools and parents/guardians
• SMS and WhatsApp messages (where you have provided a phone number and your school uses these channels)
• Push notification preferences and device tokens (if enabled)
• Communication preferences

3.3 Website Visitors

• Name, email, phone number (if you submit a demo request form)
• School or trust name
• IP address and browser information
• Cookies and similar tracking technologies (see Cookies section below)

3.4 Children's Data

We process limited personal data about children (students) as necessary to provide our payment services. This data is provided to us by schools and typically includes:

• Student name
• Year group and class
• Payment items and amounts

Safeguards for Children's Data:

• We do not collect data directly from children
• We do not use student data for marketing purposes
• Only authorized school staff can access student data through our platform
• We process only the minimum data necessary to provide payment services
• All student data processing is governed by our Data Processing Agreement with schools, available on request

Schools act as data controllers for student information. We process student data only as necessary to provide payment services and in accordance with our Data Processing Agreement with schools.

4. How We Use Your Information

We use your personal data for the following purposes:

• Service Delivery: To provide, operate, and maintain our payment platform
• Payment Processing: To process payments, manage transactions, and handle refunds
• Account Management: To create and manage user accounts, authenticate users, and provide customer support
• Communication: To send service-related communications (including in-app messages, email, SMS, and WhatsApp where enabled), respond to inquiries, and provide support
• AI and Automation: To power our agentic AI features, including automated reconciliation, reporting, and insights (see Automated Decision-Making section below)
• Compliance: To comply with legal obligations, including financial regulations and data protection laws
• Security: To detect, prevent, and address security issues and fraud
• Improvement: To analyse usage patterns and improve our services (using anonymised data where possible)
• Marketing: To send marketing communications (only with your consent, and you can opt out at any time)

Automated Decision-Making and Profiling

We use automated tools and AI to assist with:

• Payment reconciliation and matching
• Generating reports and insights
• Identifying potential payment issues or anomalies (for example, missed or overdue payments)

Important: These automated tools assist our services but do not make solely automated decisions that produce legal or similarly significant effects on individuals. All significant decisions involve human review or oversight.

If you have concerns about automated processing that affects you, you have the right to request human intervention, express your point of view, and contest the decision. Contact us at [email protected].

5. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases, mapped to specific purposes:

• Contract: Service delivery, payment processing, account management, and customer support
• Legal Obligation: Financial record keeping (7 years), tax obligations, and compliance with data protection laws
• Legitimate Interests: Fraud prevention, security monitoring, service improvement (using anonymised data), and business operations
• Consent: Marketing communications and non-essential cookies (you can withdraw consent at any time)

For student data processed on behalf of schools, the legal basis is determined by the school as the data controller, in accordance with their own privacy policies and legal obligations.

6. Data Sharing and Third Parties

We may share your personal data with the following third parties:

6.1 Service Providers

• Payment Processors: Stripe (PCI-DSS compliant) to handle card transactions. We do not store full card details.
• Cloud Hosting: Amazon Web Services (AWS, London region) for our API, database, and backend services; Cloudflare for website and application hosting, CDN, and security
• Authentication: Sign in with Apple, Google, Microsoft, and Facebook where you choose them; passkeys and email/password are managed through our own authentication platform
• Email: Amazon SES for transactional and service-related email
• SMS and WhatsApp: Twilio for service-related text messages and WhatsApp messages (where enabled by your school or where you have agreed to receive them)
• Push notifications: Google Firebase Cloud Messaging (FCM) to deliver app notifications you have enabled
• MIS Integrations: School management information system providers (such as Wonde), as authorized by schools, for data synchronisation
• Customer support and CRM: HubSpot for managing customer inquiries, support tickets, and our relationship with schools
• Monitoring: Sentry for error monitoring and platform stability (personal data is minimised where possible)
• Analytics: We may use analytics tools to understand platform usage (using anonymised data where possible). On our marketing website, HubSpot analytics and marketing cookies are used only with your consent.

6.2 Legal Requirements

We may disclose your data if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users.

6.3 Data Processing Agreements

All third-party service providers are bound by strict data processing agreements and are only permitted to use your data for specified purposes. We do not sell your personal data to third parties.

A list of our current sub-processors is available in our data protection pack and on our Security page. For further detail, contact [email protected].

7. Data Retention

We retain your personal data only for as long as necessary. Specific retention periods:

• Financial and transaction records: 7 years (legal requirement under UK financial regulations). If you delete your account, transaction records may be retained in anonymised form for this period.
• Account data on deletion: When you delete your account in the app, we anonymise your personal data promptly (for example, your name is replaced with "Deleted User", and your email, phone, and profile photo are removed). Self-service deletion does not permanently erase all database records, to preserve data integrity and meet legal obligations.
• Support tickets and communications: 2 years after resolution
• System logs and security data: 30-180 days (depending on log type and security requirements)
• Marketing consent records: Until consent is withdrawn or account is closed

When data is no longer needed, we securely delete or anonymise it in accordance with our data retention policy. Some data may be retained longer if required by law or to resolve disputes.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request a copy of your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw consent where processing is based on consent

Note for student data: For student data where we act as a processor, data subject rights should be exercised through the school as the data controller. Requests relating to student data may be directed to the school (as controller) or to us, and we will support schools in responding.

8.1 Exercising Your Rights in the App

Parents, guardians, and school staff can exercise certain rights directly in the Payments by iAntz app (at iantz.app or in the iOS/Android app):

• Download your data (access and portability): Open Profile, choose Edit profile, scroll to Account, and tap Download my data. You will receive a JSON file containing the personal data we hold about you, including linked children, transactions, and school roles.
• Delete your account (erasure): Open Profile, choose Edit profile, scroll to Account, and tap Delete my account. Type DELETE to confirm, then re-authenticate with your current sign-in method (for example, passkey, email and password, Sign in with Apple, or Google). We anonymise your personal data. If you have payment or transaction history, transaction records are retained in anonymised form for 7 years for legal compliance. If you have no transactions, your personal data is removed as described above. Linked children's school wallets and balances are not deleted; other carers or the school can still manage them.

Some accounts (for example, super admin accounts) cannot be deleted through the app. If you cannot use the in-app options, or you wish to exercise another right, contact us as below.

To exercise any of these rights by email, or for requests we cannot fulfil in the app, please contact our data protection lead at [email protected]. We will respond to your request within one month.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to provide and improve our services. Below is a breakdown of the types of cookies we use:

9.1 Strictly Necessary Cookies

These cookies are essential for the website and platform to function. They include:

• Login and session management cookies
• Security and fraud prevention cookies
• Cookies that remember your preferences and settings

Strictly necessary cookies do not require consent under UK GDPR as they are essential for the service to work.

9.2 Analytics Cookies

We may use analytics cookies (for example, HubSpot on our marketing website) to understand how visitors use our website. This helps us improve our services and user experience. Analytics cookies are optional and require your consent.

9.3 Marketing Cookies

We may use marketing cookies (for example, HubSpot) to deliver relevant content and measure campaign effectiveness. Marketing cookies are only used with your explicit consent.

9.4 Cookie Consent and Control

When you first visit our website, you will see a cookie consent banner. You can:

• Accept all cookies
• Reject non-essential cookies (as easily as accepting - we do not use dark patterns)
• Change your mind at any time using the "Cookie settings" link in our footer

Non-essential cookies (including HubSpot analytics and marketing) are only loaded after you give consent. You can also control cookies through your browser settings. However, disabling strictly necessary cookies may affect the functionality of our website and platform.

You can change your cookie preferences at any time using the Cookie settings link in our footer, adjusting your browser settings, or contacting us at [email protected].

10. Data Security

We take security seriously. We implement robust technical and organisational measures to protect your personal data, including:

• Payment Security: Card payments are handled by our PCI-DSS compliant payment processor. We do not store full card details.
• Encryption: We use TLS encryption for data in transit and encryption at rest where supported by our infrastructure.
• Data Hosting: Core application data is hosted in AWS UK (London). Our website and app are served via Cloudflare. Some sub-processors (e.g., email delivery, monitoring) may process data outside the UK/EEA with appropriate safeguards.
• Access Controls: Strict access controls, multi-factor authentication, and role-based permissions
• Regular Audits: CREST-accredited independent penetration testing and security assessments
• Staff Training: Regular data protection and security training for all staff
• Standards alignment: Our security and privacy programme is aligned with ISO/IEC 27001, 27002, 27701, 27017, 27018, and 42001. We hold Cyber Essentials Plus certification (2026). See our Security page and data protection pack for detail.

For a full overview of our technical and organisational security measures - including our cloud infrastructure, encryption standards, access controls, vulnerability management, and business continuity practices - please see our dedicated Organisational & Security Measures page.

Despite our security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability.

11. What We Do NOT Do

To be clear about our practices:

• We do not sell personal data to third parties or use it for purposes unrelated to our services
• We do not store full payment card details - card information is handled securely by our PCI-DSS compliant payment processor
• We do not use student data to train public AI models - our AI features process data only for the purpose of providing payment services to your school
• We do not use student data for marketing - student information is used solely for payment processing and related services

If you have questions about our data practices, please contact us at [email protected].

12. International Data Transfers

Your personal data is primarily stored and processed in the United Kingdom. If we need to transfer data outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Adequacy decisions by the UK government
• Other approved transfer mechanisms under UK GDPR

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending an email notification (for significant changes)
• Displaying a notice on our platform

The "Last updated" date at the top of this policy indicates when it was last revised.

14. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). IANTZ LIMITED is registered with the ICO under registration number ZC093007.

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Email: [email protected]
Phone: 0303 123 1113

We encourage you to contact us first at [email protected] so we can try to resolve any concerns.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Lead: [email protected]
General Enquiries: [email protected]

For data subject access requests (DSARs) or other privacy-related requests, please email [email protected] with "Privacy Request" in the subject line.