Introduction to our Privacy Policy

Hasanah Academy (“we” or “us”) promises to take great care with your personal data, and we commit to protecting any personal information we obtain about you. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect. This Privacy Policy sets out how and why we obtain, use and protect personal information.

Who we are?
Hasanah Academy is a private education company supported by Hasanah Aid – A registered Charitable Organisation in UK; we are committed to protecting your personal data. This privacy policy states how we collect, store and use data. The following policy is written in accordance with the GDPR and Data Protection Act 1998. We are registered under the Data Protection Act 1998, registration number Z1169585. If you have questions regarding this policy, please contact our Data Protection Officer by email: Email Us

Policy Aims

Hasanah Academy is committed to being transparent about how it collects and uses the personal data of its members and parents and to meeting its data protection obligations. This policy sets out the organisation’s commitment to data protection, and individual rights and obligations in relation to personal data.

Hasanah Academy is committed to complying with data protection legislation and good practice including: 

• Processing personal information only where this is strictly necessary for legitimate organisational purposes
• Collecting only the minimum personal information required for these purposes and not processing excessive personal information
• Providing clear information to individuals about how their personal information will be used and by whom
• Only processing relevant and adequate personal information
• Processing personal information fairly and lawfully
• Maintaining an inventory of the categories of personal information processed by Hasanah Academy
• Keeping personal information accurate and, where necessary, up to date
• Retaining personal information only for as long as is necessary for legal or regulatory reasons or, for legitimate organisational purposes
• Respecting individuals’ rights in relation to their personal information, including their right of subject access
• Keeping all personal information secure

Responsibilities under the General Data Protection Regulation (GDPR)

• Hasanah Academy is a Data Controller and a Data Processor under the GDPR.
• Senior Management and all those in managerial or supervisory roles throughout Hasanah Academy are responsible for developing and encouraging good information handling practices within the organisation.
• We have appointed a Data Privacy Manager to oversee the management of personal information within Hasanah Academy and for ensuring that compliance with data protection legislation and good practice can be If you have any questions about this privacy notice or how we handle your personal information please contact the data privacy manager.
• Compliance with data protection legislation is the responsibility of all staff at Hasanah Academy who process personal information.

The Kind of information we hold about you:

As a tuition provider, Hasanah Academy is responsible for the personal information it handles in order to deliver our service. This information is only used for delivering tuition and for safeguarding purposes:

The kind of information we hold varies, depending upon whether you are a customer of an Hasanah Academy, or whether you/your child is receiving tuition with us via their eLearning. More detailed information on this is as follows:

Customers of “Hasanah Academy” centres and “Hasanah Academy at Home” online tuition.

When you express interest in Hasanah Academy and book a free trial session, we will collect and process the following data from you:

• your name
• email address which will be used to send you a confirmation email
• contact telephone numbers which will be used to send you a confirmation SMS and confirmation call
• child’s name, age, school and reason for interest in tuition

When you join Hasanah Academy, we will collect and process the following data from you:

• Parent/Guardian’s name, postal and email address, contact phone numbers
• Membership payer’s name, postal and email address, contact phone numbers (if not parent/ guardian)
• Emergency contact’s names and phone numbers
• Child/ren’s name, age, date of birth and school
• Information about any medical conditions, allergies or Special Educational Needs of child/ren
• Details of Direct Debit and debit/credit cards in order for us to accept payment

You should notify Hasanah Academy of any changes in circumstances to enable personal records to be updated accordingly.

How we will use information about you

We need the above categories of information primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below.

• For the purpose of delivering tuition and for improving that tuition service;
• To safeguard members’ health and welfare and provide appropriate pastoral care;
• For the purposes of management planning and forecasting, research and statistical analysis
• To carry out or cooperate with any external complaints, disciplinary or investigation process
• Where otherwise reasonably necessary for Hasanah Academy’s purposes, including to obtain appropriate professional advice and insurance.
• To enable relevant authorities to monitor our performance and to intervene or assist with incidents as appropriate.
• To escalate and investigate safeguarding concerns.

In addition, we will on occasion need to process special category personal data in accordance with rights or duties imposed on it by law, including as regards safeguarding, or from time to time by explicit consent where required. These reasons will include:

• To safeguard students’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual’s medical condition or other relevant information where it is in the individual’s interests to do so: for example for medical advice, for social protection, safeguarding, and cooperation with police or social services;
• To provide educational services in the context of any special educational needs of a member;

Please note that we may use anonymised data which cannot be linked to you for research purposes and to improve our services, but will not be able to link that information to anyone who participates in the delivery of our tuition.

The data of customers of Hasanah Academy Centres and eLearning additionally be used for the following purposes, subject to consent:

• You have the option of allowing us to use your child’s photo for the purpose of promoting Hasanah Academy during and/or after your membership.
• You have the option of allowing us to share your data with trusted external companies for research, analysis and personalised marketing. When we share your email address with trusted third‐parties for marketing purposes, your data is anonymised, and will only be matched with existing data they hold. You can find out more in our Cookie Policy. If you do not wish to share your email address with third‐parties as described above, so that we can show you personalised online adverts, please email us.

Who will your personal information be shared with? 

For the most part, personal data collected by us will remain us, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis).

Occasionally, we will need to share personal information relating to students and parents with third parties, such as:

• Professional advisers (e.g. lawyers, insurers, PR advisers and accountants).
• Government authorities (e.g., DfE, CAFCASS, police, Home Office, a relevant public health / NHS body and

/ or local authority) and/or appropriate regulatory bodies.

• Your data is hosted on several different All these providers have relevant safeguards in place to protect your data in the same way that we do.
• On signing up to a course as part of your membership, you agree to us sharing your name and home address with a 3rd party organisation, our printing company, if in order for your child’s course resources to be sent directly to you via Royal Mail, or courier delivery service.
• Your data may be shared with our service providers (for example, suppliers who develop or host our services) in which case we will require them to implement appropriate technical and organisational measures to meet the requirements of applicable law.
• In connection with a sale, joint venture or other transfer of some or all of our company or assets, subject to the commitment of the acquiring entity to comply with this Privacy Notice.

Access to sensitive data

Particularly strict rules of access apply in the context of “special category” data, most notably:

• medical records; and
• pastoral or safeguarding

Medical data: We need to process such information to comply with statutory duties and to keep members and others safe, but Hasanah Academy will ensure only authorised staff can access information on a need‐to‐know basis. Express consent will be sought where appropriate.

However, a certain amount of any SEND member’s relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the member requires.

How long we keep personal data

We will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason.

• Upon cancellation of membership, your data will be stored safely and securely. We will retain your personal data for a minimum of 2 years and a maximum of 3 years following cancellation of your membership to comply with relevant safeguarding bodies
• Accident/Incident reports and Administration of Medication records will be kept indefinitely.
• Registers of attendance will be kept indefinitely.
• If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the data privacy manager. However, please bear in mind that we will often have lawful and necessary reasons to hold on to some personal data even following such request.
• A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfil your wishes (called a “suppression record”).

Data protection principles

All processing of personal data is done in accordance with the following data protection principles of the Regulation, and Hasanah Academy’s policies and procedures are designed to ensure compliance with them. These are:

1. Personal data must be processed lawfully, fairly and transparently

The GDPR introduces the requirement for transparency whereby the controller has transparent and easily accessible policies relating to the processing of personal data and the exercise of individuals’ “rights and freedoms”. Information must be communicated to the data subject in an intelligible form using clear and plain language.

The specific information that must be provided to the data subject must as a minimum include:

• the contact details of the Data Privacy Manager, where applicable
• the purposes of the processing for which the personal data are intended as well as the legal basis for the processing
• the period for which the personal data will be stored
• the existence of the rights to request access, rectification, erasure or to object to the processing
• the categories of personal data concerned
• the recipients or categories of recipients of the personal data, where applicable
• any further information necessary to guarantee fair processing

2. Personal data can only be collected for specified, explicit and legitimate purposes 

Data obtained for specified purposes must not be used for a purpose that differs from those formally notified to the Information Commissioner as part of Hasanah Academy’s GDPR registration.

3. Personal data must be adequate, relevant and limited to what is necessary for processing

• The Data Privacy Manager is responsible for ensuring that information, which is not strictly necessary for the purpose for which it is obtained, is not collected.
• All data collection forms (electronic or paper‐based), including data collection requirements in new information systems, must be approved by the Data Privacy Manager.
• The Data Privacy Manager will ensure that, on an annual basis all data collection methods are reviewed to ensure that collected data continues to be adequate, relevant and not excessive.

4. Personal data must be accurate and kept up to date 

• Data that is kept for a long time must be reviewed and updated as necessary. No data should be kept unless it is reasonable to assume that it is accurate.
• Members should notify Hasanah Academy of any changes in circumstance to enable personal records to be updated accordingly.
• It is the responsibility of staff at Hasanah Academy to ensure that data held by Hasanah Academy is accurate and up to date. Completion of an appropriate registration or application form etc. will be taken as an indication that the data contained therein is accurate at the date of submission.

5. Personal data must be kept in a form such that the data subject can be identified only as long as is necessary for processing

• Where personal data is retained beyond the processing date, it will be pseudonymised in order to protect the identity of the data subject in the event of a data breach.
• Personal data will be retained in line with the retention of records procedure and, once its retention date is passed, it must be securely destroyed as set out in this procedure.

6. Personal data must be processed in a manner that ensures its security

• Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
• These controls have been selected on the basis of identified risks to personal data, and the potential for damage or distress to individuals whose data is being processed.
• Personal data shall not be transferred to a country or territory outside the European Union unless that country or territory ensures an adequate level of protection for the ‘rights and freedoms’ of data subjects in relation to the processing of personal data.
• The transfer of personal data outside of the EU is prohibited unless one or more of the specified safeguards or exceptions apply.

7. Accountability 

The GDPR introduces the principle of accountability which states that the controller is not only responsible for ensuring compliance but for demonstrating that each processing operation complies with the requirements of the GDPR.

Specifically, controllers are required to maintain necessary documentation of all processing operations, implement appropriate security measures, perform DPIAs (Data Processing Impact Assessment), comply with requirements for prior notifications, or approval from supervisory authorities and appoint a Data Protection Officer if required.

8. Data subjects’ rights 

Data subjects have the following rights regarding data processing, and the data that is recorded about them:

• To make subject access requests regarding the nature of information held and to whom it has been disclosed.
• To prevent processing likely to cause damage or distress.
• To prevent processing for purposes of direct marketing.
• To be informed about the mechanics of automated decision‐taking process that will significantly affect them.
• Not to have significant decisions that will affect them taken solely by automated process.
• To sue for compensation if they suffer damage by any contravention of the GDPR.
• To take action to rectify, block, erased, including the right to be forgotten, or destroy inaccurate data.
• To request the ICO to assess whether any provision of the GDPR has been contravened.
• The right for personal data to be provided to them in a structured, commonly used and machine‐readable format, and the right to have that data transmitted to another controller.
• The right to object to any automated profiling without consent.

9. Right to be forgotten 

Data Subjects who wish to exercise their right to be forgotten can request this by contacting us.

10. Complaints 

Data Subjects who wish to complain to Hasanah Academy about how their personal information has been processed may lodge their complaint directly by emailing us. Data subjects may also complain directly to the Information Commissioner’s Office (ICO).

11. Consent

Hasanah Academy understands ‘consent’ to mean that it has been explicitly and freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she by statement, or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. The consent of the data subject can be withdrawn at any time.

12. Security of data

All Employees are responsible for ensuring that any personal data which Hasanah Academy holds and for which they are responsible, is kept securely and is not under any conditions disclosed to any third party unless that third party has been specifically authorised to receive that information and has entered into a confidentiality agreement. Care must be taken to ensure that PC screens and terminals are not visible except to authorised Employees. Manual records may not be left where they can be accessed by unauthorised personnel and may not be removed from business premises without explicit authorisation. As soon as manual records are no longer required for day‐to‐day membership support, they should be archived. Personal data may only be deleted or disposed of in line with the Data Retention Procedure. Manual records that have reached their retention date are to be shredded and disposed of as ‘confidential waste’.

13. Rights of access to data

Data subjects have the right to access any personal data (i.e. data about them) which is held in electronic format and manual records which form part of a relevant filing system.

To obtain a copy of the personal information we hold about you, please email us.

Cookies

What are cookies?

A cookie is a small data file that is placed and stored on your device (computer, smartphone, tablet etc.) when you visit a website. When you visit hasanahacademy.org we may automatically collect information that allows us to recognise and remember you through cookies.

How do we use cookies?

We use cookies in a variety of ways:

• Understanding how you use our site
• Analysing our communication with you
• Working with third party companies to serve you relevant advertising on other sites

What types of cookies do we use?

There are three main types that require consent.

1. Functionality cookies – these allow you to navigate the site and use our features, such as the members’ area and ‘find a centre’ location
2. Analytics or performance cookies – these cookies allow us to measure and analyse how our customers use the site, to improve both its functionality and your
3. Targeting or advertising cookies – these are used to deliver adverts relevant to you and help us measure the effectiveness of our marketing

How to manage cookies 

You can manage cookies by changing your browser’s cookie settings. These settings are usually found in the ‘options’ ‘help’ or ‘preferences’ menu of your browser.

If you would like to know more visit our cookie policy. This is available on our website.

Updates to this policy

This policy is reviewed frequently and updated on the Hasanah Academy website. You may therefore want to visit our website regularly to view our most up to date policy.

Amendments to the Privacy Policy

This policy was last updated December 2022
We may change our policy from time to time so please visit our website and read the privacy policy each time you share your personal information with us.

If there are any significant changes in the way we treat your personal information we will contact you and we will place a prominent notice on our website(s).

Contact us 

If you would like to contact us about any aspect of this Privacy Policy, please email us.