1. Who we are

Arabic Academy Luton (“the Academy”, “we”, “us”) is a Sunday school providing Arabic, Qur’an and Islamic studies education to children aged 5 to 17 in Luton.

For the purposes of UK data protection law, the Academy is the data controller for the information described in this policy. That means we decide what information is collected and how it is used.

• Address 145 High St, Luton LU4 9LE
• Email [email protected]
• Phone 07459 335241

If you have any question about this policy or about the information we hold, please contact us using the details above.

2. What information we collect

We collect only what we need in order to enrol and teach your child safely.

About the pupil

• Name, in English and in Arabic
• Gender and age
• The class or level they are joining, and their progress, attendance and assessment records
• Any medical, dietary, additional-needs or safeguarding information you choose to tell us, so that we can look after your child properly

About the parent or carer

• Name, relationship to the pupil, and contact details (email address, telephone number and postal address)
• Emergency contact details
• Your preferred method of paying fees, and a record of payments made
• Your answer to our photography and video consent question

When you use this website

• Anything you send us through our contact form or by email
• Account details, where an account was created on the site
• Standard technical information kept by our web server, such as IP address and browser type, which is used to keep the site running and secure

We do not collect payment card details through this website. Fees are paid by bank transfer, or by cash or card in person at the school.

3. Why we use it, and our lawful basis

UK data protection law requires us to have a lawful basis for using your information. Ours are as follows.

• To provide your child’s place and teach them. Processing your application, registering your child, organising classes, recording progress and attendance, and contacting you about the school. Our basis is the contract between us, and our legitimate interests in running the Academy.
• To keep children safe. Emergency contacts, medical and safeguarding information. Our basis is legal obligation and vital interests — protecting someone’s life or wellbeing.
• To collect fees and keep proper accounts. Our basis is contract and legal obligation.
• To use photographs and video. Our basis is your consent, which you can withdraw at any time (see section 5).
• To answer your enquiries. Our basis is our legitimate interests in responding to you.

Some of the information we hold — such as health information, or information that reveals religious belief — is treated in law as special category data. Where we hold it, we do so with your explicit consent, or because it is necessary to protect a child, and we apply extra care to it.

4. Children’s information

Most of the information we hold concerns children. We treat it with particular care.

• Applications are completed by a parent or legal guardian, not by the child.
• Pupil information is seen only by staff who need it to teach or to keep your child safe.
• We do not use children’s information for marketing, profiling or advertising, and we never sell it.

5. Photographs and video

We sometimes take photographs or video at school events, and may use them for educational purposes or to show what the Academy does — for example on our website, in newsletters, or on our Instagram and TikTok pages.

We only do this where a parent or guardian has given permission on the application form. You can change your mind at any time by emailing [email protected], and we will stop using new images of your child and remove existing ones from material we control. Please note that we cannot always remove an image that has already been reshared by someone else.

6. Who we share information with

We do not sell your information, and we do not share it for advertising. We share it only where we need to:

• Google. Our application form is a Google Form, and we use Google’s services to receive and store responses. Google acts as our processor and handles the data on our instructions.
• Our website host and IT provider, who maintain this site and its backups on our behalf.
• Emergency and medical services, if a child needs urgent help.
• Safeguarding authorities, including the local authority or the police, where we have a duty to report a concern about a child’s welfare.
• Our bank, in order to receive and reconcile fee payments.

Some of these providers may store information outside the UK. Where that happens, we rely on the safeguards permitted by UK data protection law to make sure your information remains protected.

7. The website and cookies

This website sets a small number of cookies that are necessary for it to work — for example to keep you signed in if you have an account, and to keep the site secure. These cannot be turned off without breaking the site.

We do not use Google Analytics, advertising pixels, or any other tracking or profiling tools on this website.

The site also uses the following third-party services:

• Google Fonts, to display typefaces. Your browser requests the font files from Google.
• WhatsApp, through the chat button. Selecting it opens WhatsApp, and any conversation from that point is covered by WhatsApp’s own privacy policy.
• Google Forms, on our application page. The form is provided by Google and is subject to Google’s privacy policy as well as this one.

We also link to our Instagram and TikTok pages. Those are ordinary links; visiting them takes you to those platforms, which have their own privacy policies.

8. How long we keep information

We keep information only for as long as we need it.

• Pupil and parent records: for as long as your child attends the Academy, and for three years after they leave.
• Safeguarding and incident records: longer where we are required to keep them, in line with safeguarding guidance.
• Financial records: six years, as required for tax and accounting purposes.
• Unsuccessful or withdrawn applications: twelve months.
• Enquiries through the website: twelve months after we have dealt with them.

When information is no longer needed it is securely deleted or destroyed.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you or your child;
• ask us to correct anything that is inaccurate or incomplete;
• ask us to delete information, where there is no good reason for us to keep it;
• ask us to restrict how we use it, or object to our using it;
• ask us to transfer it to another organisation;
• withdraw consent at any time, where we relied on your consent — for example for photographs.

To exercise any of these rights, email [email protected]. We will respond within one month. There is normally no charge.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator:

• Website ico.org.uk/make-a-complaint
• Helpline 0303 123 1113

11. Changes to this policy

We may update this policy from time to time, for example if we change how we collect information or start using a new service. When we do, we will change the date at the top of this page. Where the change is significant, we will tell parents directly.