Privacy Policy

1. Introduction

Al Hikmah Institute Crawley ("we", "our", or "us") is committed to protecting and respecting your privacy. This policy explains how we collect, use, and safeguard your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Al Hikmah Institute Crawley
Address: Crawley, West Sussex, UK
Email: alhikmahinstitutecrawley@gmail.com
Phone: +44 7411 061242

2. Information We Collect

2.1 Student Information

• Full name and Arabic name (if applicable)
• Date of birth and age
• Gender
• Home address and contact details
• Medical information (allergies, conditions, emergency contacts)
• Academic progress and attendance records
• Photographs and videos for educational purposes

2.2 Parent/Guardian Information

• Full name and contact details
• Email address and phone numbers
• Relationship to student
• Emergency contact information

2.3 Website Usage Data

• IP address and browser type
• Pages visited and time spent on site
• Referring website addresses
• Device information (mobile, tablet, desktop)

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Educational Services

• Managing student enrollment and class assignments
• Recording attendance and academic progress
• Providing educational reports to parents
• Issuing certificates and achievements
• Tracking memorization progress (Quran, Duas, Hadiths)

3.2 Communication

• Sending important updates about classes and events
• Notifying parents about attendance and fees
• Responding to inquiries and support requests
• Sending newsletters and educational content

3.3 Financial Management

• Processing fee payments and generating invoices
• Managing outstanding fees and fines
• Providing financial statements to parents

3.4 Legal Basis

We process your data under the following legal bases:

• Consent: You have given clear consent for us to process your data
• Contract: Processing is necessary for the enrollment contract
• Legal Obligation: Required for safeguarding and health & safety
• Legitimate Interests: Running an effective educational institution

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in these circumstances:

4.1 Service Providers

• Supabase: Database hosting (UK/EU servers)
• Resend: Email delivery service
• Vercel: Website hosting

4.2 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal obligations (court orders, safeguarding)
• Protect the rights and safety of students and staff
• Prevent fraud or security threats

4.3 Parental Access

Parents have access to their own child's information through the secure parent portal. We verify identity before granting access.

5. Data Security

We implement appropriate security measures to protect your data:

• Encryption: All data transmitted is encrypted using SSL/TLS
• Access Control: Role-based access with password protection
• Secure Storage: Data stored in secure, encrypted databases
• Regular Backups: Daily backups to prevent data loss
• Staff Training: All staff trained in data protection
• Regular Audits: Security reviews and updates

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data.

6. Data Retention

We retain personal data for different periods depending on its purpose:

• Current Students: Duration of enrollment plus 3 years
• Former Students: Academic records kept for 7 years
• Financial Records: 6 years (UK tax requirements)
• Safeguarding Records: Until the child reaches 25 years (UK guidance)
• Application Data: 1 year for unsuccessful applications
• Website Analytics: 26 months (Google Analytics default)

After these periods, data is securely deleted or anonymized.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

8. Cookies and Tracking

We use cookies and similar technologies to improve your experience. See our Cookie Policy for details.

Types of Cookies We Use:

• Essential Cookies: Required for the website to function (login, security)
• Analytics Cookies: Help us understand how visitors use our site
• Preference Cookies: Remember your settings (dark mode, language)

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

9. Children's Privacy

We are committed to protecting children's privacy. Our services are designed for children aged 5-16 under parental supervision.

• We require parental consent before collecting children's data
• Children's data is only used for educational purposes
• Parents have full access to their child's information
• We comply with all safeguarding requirements
• Staff are DBS checked and trained in child protection

10. International Data Transfers

We primarily store data within the UK/EU. When we use services with servers outside the UK:

• We ensure appropriate safeguards are in place
• Data is protected to UK GDPR standards
• We use providers with adequate data protection certifications

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Significant changes will be communicated via email.

Continued use of our services after changes constitutes acceptance of the updated policy.

12. Complaints and ICO

If you have concerns about how we handle your data, please contact us first. If you're not satisfied with our response, you have the right to complain to the UK's supervisory authority:

13. Contact Us

For any questions about this privacy policy or how we handle your data: