Skip to main content

Privacy Policy

Last updated: 16 May 2026 Status: Draft pending founder sign-off.

Tahawi respects your privacy. This policy explains what personal data we collect when you use this website or contact us, how we use it, and the rights you have under UK GDPR and the Data Protection Act 2018.

Who we are

Tahawi is the educational institute behind this site. Our campus is at Myrdle Street, Whitechapel, London E1 1HL, with teaching on weekday evenings and at weekends. For data-protection enquiries, write to info@tahawi.org or to the postal address above marked “Data protection”.

What data we collect

We keep the data we hold to the minimum necessary to run the institute. The personal data we may collect from you falls into four categories:

  • Contact form submissions. When you send us a message through the contact form, we receive your name, email address, the subject you selected, and the body of your message. We may also receive your IP address as part of the request, which we use for rate-limiting and spam protection.

  • Enrolment data. When you register your interest in a programme or proceed to enrolment, we collect the details requested on the relevant form: typically name, date of birth, contact details, prior study, and (where applicable) parent or guardian contact details. Enrolment data is held in our admissions records.

  • Emergency contact details. The registration form asks for the name, relationship and telephone number of one person we may contact if something happens to a student while they are with us, and for anyone who will be under 18 we ask for a parent or guardian as well. We use those details for that purpose and to reach the student when we cannot reach them directly. Our lawful basis is legitimate interest, namely our duty of care to the people on our premises. If you give us someone else’s details, please tell them you have done so and that this policy explains what we do with them. That person can ask us what we hold about them, or ask us to remove it, at info@tahawi.org.

  • Email correspondence. When you email us directly at info@tahawi.org or admin@tahawi.org, we keep the correspondence in our mailbox for as long as is needed to respond and for our records.

  • Site analytics. If you consent to analytics cookies, we use Google Analytics 4 to understand how the site is used. The data we receive is aggregated and does not identify you personally. You can refuse or withdraw consent at any time via the cookie banner or the /cookies/ page.

Our programmes are for students aged 16 and over. Where an applicant or student will be under 18, we ask for a parent or guardian’s contact details as well as their own, and we may contact that parent or guardian about them. We do not knowingly collect data from children under 13.

Why we use your data

We process your personal data for the purposes set out below, relying on the lawful bases listed beside each.

  • To respond to your enquiry. Lawful basis: legitimate interest (running the institute and answering people who contact us).
  • To process your enrolment. Lawful basis: contract (taking steps prior to entering into a contract with you, then performing that contract).
  • To send you administrative information about a programme you have registered for (e.g. timetable, joining instructions). Lawful basis: legitimate interest.
  • To understand site usage in aggregate. Lawful basis: consent (you opt in via the cookie banner).
  • To meet our legal obligations. Lawful basis: legal obligation (for example, retention of financial records).

We do not send marketing emails. We do not sell personal data. We do not share personal data with third parties except as described below or as required by law.

Who we share data with

The processors who handle data on our behalf:

  • Resend: email delivery infrastructure for the contact form and registration acknowledgements, resend.com.
  • Cloudflare Turnstile: spam-protection check on the contact and registration forms, cloudflare.com.
  • Google Analytics 4: aggregated site analytics (only if you have given consent).
  • Supabase: our hosting database for enrolment records, hosted in the United Kingdom (London region).
  • Vercel: the platform hosting this website.

Each of these is a separate data controller for their own infrastructure and we have appropriate agreements in place. We do not transfer your personal data outside the UK or EEA except where the recipient is bound by an adequacy decision or equivalent safeguards.

How long we keep it

  • Contact-form submissions: 12 months from the date of the last reply, then deleted.
  • Registrations that do not lead to enrolment: 3 years from our last contact with you, then deleted. If you asked us to keep your details on file for a future cohort, we keep them until you tell us to stop, and you can tell us at any time. If there is no cohort scheduled for you yet and we have never put that question to you, we keep your registration until we are able to ask you.
  • Enrolment data: for the duration of your active study with us plus 7 years for academic-record purposes.
  • Email correspondence: for as long as our mailbox retains it; we do not actively prune.
  • Analytics data: retained according to the Google Analytics default of 14 months.

Where you ask us to delete data sooner, we will do so unless we have a legal obligation to retain it.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify data that is incorrect.
  • Erase your data (“the right to be forgotten”), subject to our legal obligations.
  • Restrict or object to our processing.
  • Portability: receive your data in a structured, machine-readable form.
  • Withdraw consent at any time, where the lawful basis is consent.
  • Complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your data.

To exercise any of these rights, email info@tahawi.org, or use the contact form. We will respond within one month.

Cookies

A separate cookies policy is at /cookies/ and describes what cookies the site sets, what each does, and how you can manage them.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent change. Material changes will be flagged on the home page for a reasonable period before they take effect.

Contact

Questions or requests under this policy: info@tahawi.org, or the contact form.