Privacy notice

Part 1

Our website and enquiries

What we collect

• When you request a demo: your name, email address, phone number if you give one, your madressah's name, your role, roughly how many pupils it has, and anything you write in the message box.
• When you email us: your email address, name and whatever you choose to tell us.
• When you visit: our hosting provider, Microsoft Azure, receives your IP address and browser details in order to deliver the page, as every web server does. We don't use them to identify you, and the site itself runs no analytics.

Why we use it, and our lawful basis

• To arrange and give you a demo, and to answer your questions. Our lawful basis is legitimate interests: you asked us to get in touch, and replying is the point of the form.
• To keep the site running and secure. Our lawful basis is legitimate interests in running a working, secure website.

We won't add you to a mailing list. If you'd like to hear about new features, you can ask us to, and you can stop at any time by replying to any email or writing to info@madrasaty.co.uk.

Who handles it for us

• Web3Forms (Web3Creative, India) carries the demo form to our inbox. It stores submissions on Amazon Web Services and deletes its copy after 7 days. Because this is a transfer outside the UK, it is covered by Web3Forms' data processing agreement.
• Google Workspace (Google) hosts our email, so your demo request and any emails you send us are held there.
• Microsoft Azure hosts the website.

The full list, with where each one processes data, is on our sub-processors page.

How long we keep it

If a demo doesn't lead anywhere, we delete your request and our emails about it 12 months after we were last in touch. If your madressah goes on to use Madrasaty, see Our customers.

Part 1, continued

Our customers

For each madressah that uses Madrasaty we keep the names and contact details of the people we deal with (usually the head, an administrator or a trustee), our correspondence with them, and the record of the agreement between us.

• We use it to provide the service, give support, tell you about changes to the service or these terms, and keep business and tax records.
• Our lawful bases are contract (providing what we agreed), legitimate interests (keeping in touch with the people who run each madressah) and legal obligation (company and tax records).
• We keep it while your madressah uses Madrasaty and for six years afterwards, which is how long tax and company law can require.

Part 2

Inside the Madrasaty app

This part is for the staff, parents and guardians whose madressah uses Madrasaty.

Your madressah is in charge of your information

Your madressah decides what it records in Madrasaty, why, and for how long. It is the controller, and its own privacy notice should explain what it does. We are its processor: we store and handle the records on its behalf, under a data processing agreement, and we never use them for our own purposes. If you have a question about your information, or want to use one of your rights, please ask your madressah first. We'll help them answer you.

What the app holds

• Staff: name and title, date of birth, contact details and home address, next of kin, role and employment details, hourly rate, hours worked, and the classes they teach.
• Parents and guardians: name and title, contact details and address, preferred language and contact method, and how they're related to each child, including who may collect them and who is an emergency contact.
• Pupils: name, date of birth, classes, attendance, progress, and absences reported by their guardians.
• Notices sent by the madressah, and who has read them.
• Sign-in details: email address, which madressah the account belongs to, and a securely hashed password. We can never see your password.

Information that needs extra care

Some of this information is especially sensitive under data protection law. Being enrolled at a madressah can reveal a family's religion, and the reason given for an absence can be about a child's health. We treat all of it with that care: the reason a guardian gives for an absence is shown only to the child's class teacher and the madressah's office, and none of it is shared with anyone outside the madressah.

Where it is kept

The app's records and their backups are stored in Microsoft Azure's UK South region, in London. The app's own code is delivered through Microsoft's global network, which handles your IP address in order to send the page, but no records are stored there. See sub-processors.

How it is protected

• All traffic is encrypted (HTTPS), and the database is encrypted at rest.
• Each madressah's records are kept apart from every other's, and every request is checked against the madressah and permissions of the person making it.
• Teachers see their own classes, parents see their own children, and only a madressah's administrators see everything at that madressah.
• Sign-in attempts are limited, and changes to pupils' and staff records keep an audit history.

What the app stores on your device

The app keeps your sign-in session, which madressah and account type you last used, and your light or dark mode choice on your device, so you stay signed in. It uses no cookies, no analytics and no advertising trackers. The cookie notice lists each item.

Service logs

To keep the app working and secure we keep technical logs of requests and errors for 90 days. IP addresses in those logs are masked.

How long it is kept

Records stay for as long as your madressah keeps them; it can remove or anonymise a pupil, guardian or staff member. If a madressah stops using Madrasaty, it can export its records, and we then delete them within 60 days of the agreement ending. Backups expire within a further 7 days.

Part 3

Your rights

You have the right to:

• ask for a copy of the personal information held about you
• have it corrected if it is wrong or incomplete
• ask for it to be deleted, or its use restricted, in some circumstances
• object to it being used on the basis of legitimate interests
• receive it in a portable format, in some circumstances

For our website, enquiries and customer records, write to info@madrasaty.co.uk. For anything inside the app, ask your madressah, and we'll help them answer. We reply within one month, and tell you if we need longer for a complicated request.

Part 4

Complaints

If you're unhappy with how we've handled your information, please tell us first at info@madrasaty.co.uk. We'll acknowledge your complaint within 30 days, look into it, and tell you what we found and what we've done.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.

Changes to this notice

When we change this notice we'll update the date at the top. If a change affects how a madressah's records are handled, we'll tell its administrators before it takes effect.