Privacy Policy
Al Furqan Centre (“we”, “the academy”) is the data controller for personal information processed through the Awraq student portal. This policy explains what we collect, why, and your rights.
Information we collect
- Enrolment details: your name, email address, mobile phone number, and the class or cohort you apply for.
- Account: your password, stored only in a securely hashed form by our authentication provider (we never see it).
- Academic records: attendance, exam and homework submissions and marks, quiz attempts, and any awards.
- Billing: invoices and payment status. Card payments are handled directly by our payment provider, Stripe; we never see or store your card details.
- Technical: a limited record used to prevent duplicate or abusive enrolment submissions, and security logs of administrative actions.
Why we process it
- To provide the education service (enrolment, classes, attendance, exams, homework, timetable and billing). Lawful basis: performance of our contract with you.
- To take and keep records of payments. Lawful basis: contract and legal obligation.
- To keep the service secure and accountable. Lawful basis: our legitimate interests.
Who processes your data for us
We use trusted providers who act only on our instructions:
- Supabase - database and sign-in. Records are hosted in the United Kingdom.
- Stripe - payment processing.
- Resend - sending service emails such as your activation link and receipts.
- Vercel - hosting and delivery of the portal.
We do not sell your personal data.
Where your data is stored
Our database is hosted in the United Kingdom. Some providers, such as Stripe, may process limited data internationally under appropriate legal safeguards.
How long we keep it
We keep personal data only as long as necessary: while you are enrolled and for a reasonable period afterwards for academic and administrative purposes, and financial records for as long as the law requires (generally six years). Enrolment applications that are never activated are removed after a short period.
Your rights
You have the right to access your data, correct it, have it erased, restrict or object to its use, and receive a copy. To exercise any right, contact the academy. We aim to respond within one month.
Keeping your data safe
Data is separated per academy, access is role-restricted, sensitive tokens are stored hashed, connections are encrypted, and administrative actions are recorded in an audit log.
Complaints
If you have concerns about how we handle your data, please contact the academy. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Changes
We may update this policy from time to time. The current version is always available on this page.