Privacy Policy

Last updated: 23 October 2026 Status: Draft pending founder sign-off.

Tahawi respects your privacy. This policy explains what personal data we collect when you use this website or contact us, how we use it, and the rights you have under UK GDPR and the Data Protection Act 2018.

Who we are

Tahawi is the educational institute behind this site. Our campus is at Myrdle Street, Whitechapel, London E1 1HL, with teaching on weekday evenings and at weekends. For data-protection enquiries, write to info@tahawi.org or to the postal address above marked “Data protection”.

What data we collect

We keep the data we hold to the minimum necessary to run the institute. The personal data we may collect from you falls into the categories below:

Contact form submissions. When you send us a message through the contact form, we receive your name, email address, the subject you selected, and the body of your message. We may also receive your IP address as part of the request, which we use for rate-limiting and spam protection.
Enrolment data. When you register your interest in a programme or proceed to enrolment, we collect the details requested on the relevant form: typically name, date of birth, contact details, prior study, and (where applicable) parent or guardian contact details. Enrolment data is held in our admissions records.
Emergency contact details. The registration form asks for the name, relationship and telephone number of one person we may contact if something happens to a student while they are with us, and for anyone who will be under 18 we ask for a parent or guardian as well. We use those details for that purpose and to reach the student when we cannot reach them directly. Our lawful basis is legitimate interest, namely our duty of care to the people on our premises. If you give us someone else’s details, please tell them you have done so and that this policy explains what we do with them. That person can ask us what we hold about them, or ask us to remove it, at info@tahawi.org.
Email correspondence. When you email us directly at info@tahawi.org or admin@tahawi.org, we keep the correspondence in our mailbox for as long as is needed to respond and for our records.
Site analytics. If you consent to analytics cookies, we use Google Analytics 4 to understand how the site is used. The data we receive is aggregated and does not identify you personally. You can refuse or withdraw consent at any time via the cookie banner or the /cookies/ page.

Our programmes are for students aged 16 and over. Where an applicant or student will be under 18, we ask for a parent or guardian’s contact details as well as their own, and we may contact that parent or guardian about them. We do not knowingly collect data from children under 13.

Why we use your data

We process your personal data for the purposes set out below, relying on the lawful bases listed beside each.

To respond to your enquiry. Lawful basis: legitimate interest (running the institute and answering people who contact us).
To process your enrolment. Lawful basis: contract (taking steps prior to entering into a contract with you, then performing that contract).
To send you administrative information about a programme you have registered for (e.g. timetable, joining instructions). Lawful basis: legitimate interest.
To understand site usage in aggregate. Lawful basis: consent (you opt in via the cookie banner).
To meet our legal obligations. Lawful basis: legal obligation (for example, retention of financial records).

We do not send marketing emails. We do not sell personal data. We do not share personal data with third parties except as described below or as required by law.

The processors who handle data on our behalf:

Resend: email delivery infrastructure for the contact form and registration acknowledgements, and job application notifications and confirmations, reference requests and our emails telling applicants about their references, resend.com.
Cloudflare Turnstile: spam-protection check on the contact and registration forms and the job application form, cloudflare.com.
Google Analytics 4: aggregated site analytics (only if you have given consent).
Supabase: our hosting database for enrolment records, job applications and references, hosted in the United Kingdom (London region).
Vercel: the platform hosting this website.

Each of these is a separate data controller for their own infrastructure and we have appropriate agreements in place. We do not transfer your personal data outside the UK or EEA except where the recipient is bound by an adequacy decision or equivalent safeguards.

How long we keep it

Contact-form submissions: 12 months from the date of the last reply, then deleted.
Registrations that do not lead to enrolment: 3 years from our last contact with you, then deleted. If you asked us to keep your details on file for a future cohort, we keep them until you tell us to stop, and you can tell us at any time. If there is no cohort scheduled for you yet and we have never put that question to you, we keep your registration until we are able to ask you.
Enrolment data: for the duration of your active study with us plus 7 years for academic-record purposes.
Email correspondence: for as long as our mailbox retains it; we do not actively prune.
Analytics data: retained according to the Google Analytics default of 14 months.
Job applications: see If you apply to work with us below.
References: see If you give us a reference below.

Where you ask us to delete data sooner, we will do so unless we have a legal obligation to retain it.

If you apply to work with us

This section covers the job application form we send to candidates.

What we collect. What the form asks for: your name, email address, phone number and home address; whether you have the right to work in the UK; your qualifications and Islamic studies background, including your teaching experience; when you left school; each course you have studied and each job you have held since then, paid or voluntary, with its dates, and for a job your main duties and, if you have left it, why you left it; what you were doing during any gaps since you left school that no course or job covers, including, if you have not had a job yet, the time since your studies; your supporting statement, saying why you would like to teach with us and what qualities and experience you would bring; when you are available; whether you hold an enhanced DBS certificate; the names, relationships, email addresses and phone numbers of two referees; your CV, if you attach one; and your answer to a question about criminal convictions and cautions.
Our confirmation. When your application reaches us, we email you to confirm it. That email gives your name, the post and your application reference, and nothing else from your application.
Referees. If you give us someone’s details as a referee, please tell them, and tell them that this policy explains what we do with them. We email each referee a link to a short reference form while we are considering your application, or after we appoint you, and we use their details for nothing else. We email you when we ask each referee, with the email address we used, and again when their reference reaches us. Those emails never include what a referee has written. If a referee’s contact details turn out to be wrong, we may correct them, and we keep a record of the change with your application.
Online search. If you are shortlisted, we may search online for publicly available information about you, as part of safer recruitment. If we find anything relevant, we note it with your application and keep that note for as long as we keep your application.
Who reads it. Three people at Tahawi read applications, and each application is emailed to them. While we decide, they may share a copy with the rest of our management team. Until we make a decision, our admin staff can see your name, email address and phone number, the post, the date you applied, whether you have been shortlisted, and your referees’ details, so that they can arrange interviews and ask your referees for references. In our system they do not see the rest of your application. Your answer to the criminal record question is held separately: it is never emailed or shared, only those three people can see it, and if you answer yes we will talk it through with you in confidence.
Why. To consider your application and, if we offer you the post, to make the safer recruitment checks required for work with students under 18. Lawful basis: taking steps at your request before entering into a contract with you, and our legitimate interest in recruiting safely.
How long. If you are not appointed, we delete your application and your CV from our systems 6 months after we make our decision. Copies sent by email are deleted by hand, and we ask everyone who receives one to delete it once a decision has been made. If we have not made a decision 12 months after you apply, we delete your application then. If you are appointed, your application becomes part of your staff record.

If you give us a reference

This section covers the reference form we send to referees.

What we collect. Your name, job title and organisation; how long you have known the candidate and in what capacity; if you employed them, their job title, dates and reason for leaving; your assessment, your answers to our safeguarding questions and any comments; and your declaration. The candidate gave us your name, your relationship to them, your email address and your phone number. If those contact details turn out to be wrong, we may correct them, and we keep a record of the change with the candidate’s application.
Why. To decide whether to appoint the candidate, and to make the safer recruitment checks required for work with young people, including students under 18. Lawful basis: our legitimate interest in recruiting safely.
Who reads it. We treat your reference as given in confidence. The three people at Tahawi who read applications read it, and while we decide they may share it with the rest of our management team. Our admin staff can see your name, your contact details and whether your reference has arrived, but they cannot open your reference in our system. Emails to info@tahawi.org are read by our office staff, so please do not put your reference in an email.
How long. We keep your reference with the candidate’s application and delete it when we delete the application: 6 months after an unsuccessful decision, or 12 months after the candidate applied if we have not decided by then. If the candidate is appointed, your reference becomes part of their staff record.
Our email to you. Its link works until the date the email gives, and you can send the form once. We send it through our email provider, Resend. We tell the candidate that we have emailed you, with the email address we used, and again when your reference reaches us, but never what it says.

Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Rectify data that is incorrect.
Erase your data (“the right to be forgotten”), subject to our legal obligations.
Restrict or object to our processing.
Portability: receive your data in a structured, machine-readable form.
Withdraw consent at any time, where the lawful basis is consent.
Complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your data.

To exercise any of these rights, email info@tahawi.org, or use the contact form. We will respond within one month.

Cookies

A separate cookies policy is at /cookies/ and describes what cookies the site sets, what each does, and how you can manage them.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent change. Material changes will be flagged on the home page for a reasonable period before they take effect.

Contact

Questions or requests under this policy: info@tahawi.org, or the contact form.