Privacy Policy

[REQUIRES COMPLETION BEFORE LAUNCH: legal organisation name], trading through this platform as Al Huda UK, is intended to be the controller of personal information described here. Contact: [REQUIRES COMPLETION BEFORE LAUNCH: privacy contact email]; data-protection contact: [REQUIRES COMPLETION BEFORE LAUNCH: data-protection contact or responsible person]; address: [REQUIRES COMPLETION BEFORE LAUNCH: postal contact address].

This notice applies to visitors, account holders, students, parents or guardians where relevant, teachers, administrators and people who contact us. If you have a question, want to exercise a right, or have a concern about our use of your information, contact the privacy address above.

Depending on how you use the platform, we may collect:

• identity and contact information, including name, email address, telephone number, town or city and country;
• account and security information, including an internal user identifier, authentication events, account status and assigned student, teacher or administrator roles;
• course and enrolment information, registration dates, attendance-related class access, timetables, materials viewed and programme status;
• learning records, including quiz answers and scores, assignments, submissions, marks, teacher feedback, exam records, results and certificates where offered;
• messages, discussion posts, announcements, notifications and communications with staff;
• transaction information, including course price, currency, payment state, refund amount, provider references and fulfilment history — we do not receive or store full card numbers or CVVs;
• technical and security information reasonably needed to operate and protect the service, such as browser/session identifiers, request and audit records, and records of administrative actions;
• information you choose to provide in support enquiries or future file uploads.

We generally receive information directly from you, from a parent or guardian where appropriate, from authorised staff through teaching and administration, and from configured service providers such as a payment provider.

UK data-protection law requires a lawful basis for each use. The basis depends on the activity and circumstances:

• Contract: creating and administering an account, registering for and delivering a requested course, processing payment, providing materials and classes, assessing work, issuing results and handling refunds.
• Legitimate interests: operating and improving a secure education service, responding to enquiries, maintaining audit trails, preventing misuse, managing teachers and courses, and establishing or defending legal claims. We consider necessity, proportionality and the effect on individuals.
• Legal obligation: keeping records required by tax, accounting, safeguarding or other applicable law, responding to lawful requests and meeting data-protection duties.
• Consent: optional non-essential cookies or similar technologies, and electronic direct marketing where consent is required. Consent can be withdrawn without affecting earlier lawful processing.
• Vital interests or public task: only where the facts and law genuinely support that basis, for example an exceptional life-protecting situation. We do not rely on these routinely.

We do not use account creation or course registration as consent for optional cookies or direct marketing.

Teachers assigned to a course can access information needed to teach that course, including enrolled students, submissions, quiz and result information, and feedback. Administrators can access records needed to manage the platform. Students can access their own learning area and released results. Database permissions are designed around these roles rather than demo-specific accounts.

Class records may contain a meeting link, teacher, start time, duration and description. At present the platform stores administrator-entered joining links; it does not claim an automatic Zoom integration. Opening a class link may take you to a third-party video service whose own privacy information applies. Do not place unnecessary sensitive information in class names, chats, discussions or submissions.

The schema can reference learning files, but a production file-upload service is not currently active in the application. Before uploads are enabled, the operator must assess the storage provider, access controls, retention, acceptable file types, malware risk and any international transfers.

The platform creates its own internal order/payment record before a user is sent to any configured payment provider. The provider processes card details and sends server-to-server events that allow the platform to update pending, paid, failed, cancelled and refund states. Reaching a return page does not by itself grant course access.

No public payment provider is marked active in the legal settings. [REQUIRES COMPLETION BEFORE LAUNCH: confirm the active payment provider and its privacy terms before taking payment].

Internal transaction and provider-reference records may be retained to administer enrolment, refunds, reconciliation, fraud prevention, accounts and legal obligations. We do not store full payment-card numbers or card security codes.

Information is shared only where necessary with authorised administrators, assigned teachers and vetted service providers acting under appropriate arrangements. Categories may include database/authentication/hosting, payment processing, transactional email, file storage and video-conferencing services. Each must be confirmed through the administrator’s legal settings before being represented here as active.

• Payment: not identified as active
• Analytics: none identified as active
• Email delivery: not identified in public settings; authentication emails depend on backend configuration
• File storage: no production upload provider identified as active
• Video conferencing: no provider identified as active; links are entered manually

We may also disclose information where required by law, to protect people or the service, in connection with professional advice, or during an organisational transfer subject to suitable safeguards. We do not sell personal information.

Some configured suppliers may process information outside the UK. The operator must identify where each active provider processes information before launch. Where UK law requires it, an appropriate transfer mechanism should be used, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with a transfer-risk assessment and any additional safeguards.

[REQUIRES COMPLETION BEFORE LAUNCH: document supplier locations and applicable transfer safeguards]

We keep information only as long as reasonably needed for the purpose collected, applicable legal obligations, safeguarding, dispute handling and security. Different records need different periods. Account/profile data is normally kept while an account is active and for an approved closure period; learning records may need to remain available for course delivery, appeals and certification; transaction and audit records may require longer legal or fraud-prevention retention.

Approved organisation-specific schedule: [REQUIRES COMPLETION BEFORE LAUNCH: approved retention schedule]

When information is no longer needed, it should be securely deleted or irreversibly anonymised, including from backups in accordance with the relevant backup cycle. A request to delete an account may not require deletion of records that must lawfully be retained.

Measures reflected in the platform include authenticated access, role-based permissions, row-level database security, server-side administrative checks, audit records, signed payment webhooks and idempotent fulfilment. Payment-card details are handled by the payment provider rather than this database.

No system can guarantee absolute security. Users should use a strong unique password, keep sign-in details private, sign out on shared devices and report suspicious activity. The operator must maintain incident response, access review, backup, patching and supplier-management procedures outside the application as well as technical controls within it.

Islamic education may include children, but the operator has not yet published an approved minimum age or parental-authorisation process. [REQUIRES COMPLETION BEFORE LAUNCH: define intended age groups, age-assurance approach, parental responsibility and safeguarding process].

Information about a child should be limited to what is needed for education, safety and administration. Privacy explanations and interfaces should be appropriate to the child’s age. Where consent is relied on for an online service offered directly to a child, the UK rules on children’s consent must be assessed. In the UK, a child aged 13 or over may generally consent to an information-society service, but this does not remove the need to consider capacity, fairness, safeguarding or whether parental involvement is appropriate. Different rules may apply outside the UK.

Service communications about accounts, enrolments, payments, class changes, assignments, security and policy updates are not marketing and may be needed to perform a contract or operate the service. No marketing or advertising tracker is currently active in the application.

If optional email or electronic marketing is introduced, it must have an appropriate UK GDPR basis and comply with PECR. Every marketing message should provide a simple opt-out. We will not make access to education conditional on agreeing to unrelated marketing.

The platform can automatically mark quizzes against answers configured by authorised staff, calculate scores and activate enrolment after a secure payment confirmation. These are operational rules, not currently decisions described as producing legal or similarly significant effects solely by automated means. Teachers or administrators can review educational or payment issues.

We do not currently use profiling for advertising or significant automated decision-making. If that changes, this notice must explain the logic, significance, expected consequences and applicable rights before the processing begins.

Subject to the circumstances and exemptions in UK law, you may have the right to:

• be informed about how your information is used;
• ask for access to your personal information;
• ask for inaccurate information to be corrected;
• ask for deletion of information;
• ask for use to be restricted;
• receive certain information in a portable format;
• object to processing based on legitimate interests or direct marketing;
• withdraw consent at any time where consent is the basis; and
• seek safeguards concerning solely automated decisions with legal or similarly significant effects.

These rights are not absolute. We may need to verify identity and clarify a request. We normally respond without undue delay and within one month, subject to lawful extensions for complex or multiple requests. To make a request, contact [REQUIRES COMPLETION BEFORE LAUNCH: privacy contact email].

You also have the right to complain to the UK Information Commissioner’s Office (ICO). Current contact details and complaint guidance are available at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first, but you do not have to contact us before the ICO.

Necessary browser storage is used for authentication sessions and to remember your consent decision. Optional categories remain off unless you choose them and a corresponding service is actually configured. Google Fonts are currently requested from Google’s font domains; this is an external resource request rather than an application-set cookie.

Read the Cookie Policy for the current inventory, or Cookie Settings to change your optional choices.

We may update this notice when the platform, suppliers, purposes or law change. The current version is 1.0, dated [REQUIRES COMPLETION BEFORE LAUNCH: policy date]. Material changes should be brought to affected users’ attention where appropriate. Earlier versions should be retained by the operator for accountability.