Privacy Policy & Cookie Statement

01Who is responsible for your information

Your Madrasah normally decides what pupil, parent, guardian, staff and educational information is collected, why it is collected and how it is used.

The Madrasah is therefore normally the data controller for pupil, parent, guardian, staff, attendance, educational, safeguarding and other institutional records entered into MMD.

MMD normally acts as the data processor for this information, processing it on behalf of and according to the instructions of the Madrasah.

If your question concerns your pupil or family records, please contact your Madrasah directly.

MMD may act as a data controller for limited information that it collects and uses for its own purposes, including:

• account registration;
• platform administration;
• subscriptions;
• billing;
• technical support;
• security;
• fraud and misuse prevention;
• legal and regulatory compliance; and
• operation and improvement of the MMD platform.

For questions relating to information controlled directly by MMD, please contact:

support@mmdatabase.org.uk

02How we process personal data and why

Personal information may be:

• supplied directly by you;
• provided through an application or registration form;
• entered by an authorised member of the Madrasah;
• generated through your use of MMD;
• generated through communications with the Madrasah or MMD;
• received from a connected service, such as an email or payment provider; or
• generated through security, authentication and operational activity.

We use personal information only where there is an appropriate lawful basis for doing so.

The information may be used to:

• register and administer pupils and families;
• provide educational services;
• manage classes and attendance;
• record assessments and progress;
• manage safeguarding and pupil welfare;
• communicate with parents, guardians, pupils and staff;
• manage applications and admissions;
• administer donations and Gift Aid;
• provide access to the MMD portal;
• provide technical and customer support;
• maintain the security of the platform;
• prevent misuse and investigate security incidents;
• comply with legal and regulatory requirements;
• maintain appropriate historical and educational records; and
• maintain relationships with former pupils and members of the Madrasah community where appropriate.

03The information we collect

We collect information that is reasonably necessary to educate and care for pupils and to operate the Madrasah.

This may include the following.

Registration, account and contact information

• Name
• Date of birth
• Address
• Telephone number
• Email address
• Account and registration details
• Parent or guardian details
• Emergency contact details
• Relevant school information

Pupil and educational information

• Class information
• Attendance records
• Assessment records
• Progress information
• Educational records
• Achievements and certificates
• Enrolment and participation information
• Other information required for the educational and administrative functions of the Madrasah

Staff information

Where applicable, we may process information about teachers, staff, volunteers and administrators, including:

• name and contact details;
• role and responsibilities;
• class assignments;
• employment or volunteering information;
• account and authentication information; and
• information necessary for safeguarding, administration and legal compliance.

Health and medical information

Where necessary for pupil welfare and safety, we may process information such as:

• allergies;
• medical conditions;
• medication information;
• health needs; and
• other relevant medical or welfare information.

Health information is subject to additional legal protection because it may constitute special category personal data.

Safeguarding information

Where necessary, we may maintain safeguarding information and records of safeguarding concerns or incidents.

Such information is handled with particular care and is accessible only to appropriately authorised individuals.

Financial information

Where applicable, we may process:

• MC records;
• receipts;
• donations;
• Gift Aid information;
• payment status;
• transaction references; and
• billing records.

We do not hold personal payment-card details.

Communications

We may process:

• messages;
• emails;
• permitted attachments;
• correspondence;
• notification preferences; and
• records necessary to administer communications.

Technical and security information

We may process:

• IP addresses;
• browser information;
• device information;
• login and authentication information;
• session information;
• security and audit records;
• access records; and
• technical information required to operate and secure MMD.

04Our lawful bases for processing

Under UK data protection law, the lawful basis for processing depends on the type of information and the circumstances.

Depending on the circumstances, we may rely on one or more of the following:

Consent

Where consent is the appropriate lawful basis, we obtain consent through our application, registration or other relevant processes.

Users may also be asked to provide consent for particular optional activities, such as certain communications, health information or optional integrations.

Where we rely on consent, it may be withdrawn at any time.

Contract

We may process information where it is necessary to provide agreed educational, administrative, subscription or other services.

Legitimate interests

We may process information where it is necessary for legitimate interests, such as:

• operating the Madrasah;
• administering the MMD platform;
• maintaining security;
• preventing misuse;
• providing support;
• maintaining appropriate records; and
• communicating with members of the Madrasah community.

Where we rely on legitimate interests, we consider the individual's rights and interests.

Vital interests

In limited circumstances, information may be processed where necessary to protect someone's vital interests, including in an emergency involving a person's health or safety.

05Children's information

Protecting children's information is central to what we do.

MMD is specifically designed to enable educational institutions to hold and manage pupil records, including, where necessary:

• educational information;
• attendance;
• progress;
• safeguarding information; and
• health or medical information.

We limit the information collected to what is reasonably necessary and restrict access according to role and need.

Parents and guardians are generally able to access information relating to their own family where authorised by the Madrasah. Teachers and staff receive access appropriate to their responsibilities.

Each Madrasah's records are logically separated from the records of other institutions.

Data protection rights relating to a child belong to the child. Depending on the child's age, understanding and circumstances, a parent or guardian may usually exercise those rights on the child's behalf.

06Health and special category information

Some information, such as health and medical information, receives additional protection under UK data protection law.

Where a Madrasah collects this information, it is used only for appropriate purposes, such as:

• ensuring staff are aware of relevant medical needs;
• managing allergies or medical conditions;
• supporting pupil welfare;
• safeguarding;
• responding appropriately to emergencies; and
• meeting applicable legal obligations.

Access to this information is restricted to people who have a genuine need to know.

Where appropriate, the Madrasah will obtain explicit consent for the processing of health information. In an emergency, information may be processed where necessary to protect an individual's vital interests.

07How we protect your information

We take appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

• encrypted HTTPS connections;
• encryption of information while stored where appropriate;
• password hashing;
• role-based access controls;
• session controls;
• logical separation of institutions;
• tenant restrictions;
• two-factor authentication for administrators;
• restricted administrative access;
• security monitoring;
• audit and security logging; and
• controlled access to administrative functions.

Users are automatically logged out after a configured period of inactivity, so they do not remain signed in indefinitely. This helps protect personal information if a device is left unattended.

Parents and guardians are restricted to the family information they are authorised to access.

Teachers and other staff receive access appropriate to their assigned classes and responsibilities.

Administrators receive access according to their role and operational requirements.

Authorised MMD platform staff may have privileged access where necessary to operate, secure, troubleshoot and support the platform. Such access is restricted to legitimate operational purposes and relevant security events may be logged.

No online system can guarantee absolute security. Users should keep their passwords and account information confidential and should sign out when using shared or public devices.

08Our role as controller and processor

A Madrasah using MMD is normally the data controller for the personal information it enters into the platform.

The Madrasah decides:

• what information is collected;
• why it is collected;
• how it is used;
• the appropriate lawful basis; and
• how long particular institutional records should be retained, subject to applicable law and the terms of its arrangements with MMD.

MMD normally acts as the data processor for these records.

MMD may act as a controller for information it processes for its own purposes, including platform registration, subscriptions, billing, security, support and legal compliance.

Institutions are logically separated. Ordinary users from one Madrasah cannot access the records of another Madrasah.

09Who we share personal data with

We never sell personal information.

Personal information may be shared where necessary with:

• authorised users and recipients selected by the relevant Madrasah;
• hosting providers;
• database and infrastructure providers;
• payment providers;
• email providers;
• notification providers;
• Microsoft or Google where the relevant integration is configured;
• SMTP providers;
• optional AI providers where the relevant Madrasah has enabled the integration;
• analytics and performance service providers;
• professional advisers;
• regulators;
• safeguarding authorities;
• law-enforcement bodies where required or reasonably necessary; and
• an organisation involved in a future sale, transfer or reorganisation of MMD, subject to appropriate safeguards.

MMD may use service providers including Vercel for hosting and performance services, Supabase for database infrastructure, and GoCardless for subscription payment processing, where those services are applicable.

Where a third party processes personal information on our behalf, we require appropriate contractual and security protections and require that information to be processed only for authorised purposes.

A Madrasah may export information from MMD. Once information has been exported, the Madrasah is responsible for protecting the exported copy.

10Payment information

The Madrasah may use MMD to administer:

• subscriptions;
• MC payments;
• donations;
• Gift Aid;
• receipts; and
• related financial records.

MMD does not collect, store or retain personal payment-card details.

We do not hold:

• full card numbers;
• card expiry dates;
• CVV/security codes; or
• equivalent card-security information.

Where online payments are offered, card information is entered directly with the relevant payment provider and is processed by that provider.

MMD may receive limited information necessary to record and reconcile a payment, such as:

• payment amount;
• payment date;
• payment status; and
• transaction or payment reference.

11Where your information is stored and transferred

MMD uses cloud infrastructure and security controls designed to protect personal information.

Most institutional records are stored using secure infrastructure within Europe.

Some service providers may process limited information outside the UK. Where personal information is transferred internationally, appropriate safeguards and lawful transfer mechanisms will be used where required.

These may include UK adequacy regulations or approved contractual transfer mechanisms.

You may contact us for further information about relevant international transfers and safeguards.

12How long we keep personal data

We retain information only for as long as there is a legitimate, educational, operational, legal, safeguarding or historical reason to do so.

Different categories of information may therefore have different retention periods.

Pupil and educational records

Core educational records may be retained permanently where there is a continuing educational, historical or verification purpose.

These records may include:

• enrolment history;
• dates of attendance;
• classes;
• assessments;
• educational achievements;
• certificates;
• significant educational records; and
• other information necessary to establish a person's educational history.

Retaining core educational records allows the Madrasah to verify a former pupil's relationship with the institution, attendance, achievements and educational history many years after they have left.

Alumni information

Where appropriate, limited information about former pupils and members of the Madrasah community may be retained indefinitely to support an ongoing relationship.

This may include:

• name;
• contact details;
• dates of attendance;
• achievements;
• alumni status;
• communications preferences;
• participation in alumni activities;
• engagement history; and
• donation or fundraising information where applicable.

The purpose of retaining alumni information may include:

• maintaining lifelong relationships;
• communicating with former pupils;
• inviting alumni to events and activities;
• providing relevant news and updates;
• maintaining historical institutional records; and
• fundraising and supporting the Madrasah where appropriate.

Alumni information will be reviewed periodically and should not be retained where there is no continuing lawful or legitimate purpose.

Individuals may exercise their applicable data protection rights, including objecting to certain communications or requesting correction of their information.

Safeguarding records

Safeguarding information may be retained for longer periods where necessary to comply with legal, regulatory or safeguarding requirements, or where necessary to protect individuals.

Staff records

Core staff records may be retained permanently where there is a continuing institutional, historical or verification purpose. These may include names, roles, dates of employment or service and significant contributions to the Madrasah.

Where appropriate, limited information about former teachers, staff and volunteers, including contact details and communications preferences, may be retained indefinitely to maintain an ongoing relationship with the Madrasah, in the same way as alumni information.

This information will be reviewed periodically and should not be retained where there is no continuing lawful or legitimate purpose. Individuals may exercise their applicable data protection rights.

Financial and Gift Aid records

Financial, donation and Gift Aid records may be retained for the period required by applicable tax, accounting and legal obligations.

Applications

Information relating to unsuccessful applications will normally be deleted within 30 days, unless there is a lawful reason to retain it for longer.

MMD operational records

MMD's own subscription, billing, support, security, audit and compliance records are retained only for as long as necessary for the relevant purpose or as required by law.

When information is no longer required, it will be securely deleted or anonymised where appropriate, subject to any continuing legal, safeguarding or legitimate historical requirement.

13Your data protection rights

Depending on the circumstances, you may have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Request deletion of your information where there is no lawful reason for us to continue processing it;
• Restrict how your information is processed;
• Object to certain processing;
• Data portability, where applicable;
• Withdraw consent where consent is the lawful basis for processing; and
• complain to the Information Commissioner's Office (ICO).

These rights are subject to certain legal conditions and exceptions.

For pupil, parent, guardian and institutional records held by MMD on behalf of a Madrasah, please contact the Madrasah directly, as it is normally the data controller.

For information controlled directly by MMD, please contact:

support@mmdatabase.org.uk

14Log files

Like most online services, our hosting and infrastructure providers may maintain standard technical log files.

These may record information such as:

• IP address;
• browser type;
• device information;
• date and time of access;
• login activity; and
• technical or security events.

Log information may be used to:

• maintain platform security;
• investigate suspected misuse;
• diagnose technical problems;
• maintain reliability;
• monitor performance; and
• improve the MMD platform.

Log information is not used for advertising purposes.

15Cookies and similar technologies

MMD uses essential cookies and secure browser storage where necessary to:

• keep users signed in;
• authenticate users;
• maintain secure sessions;
• remember preferences; and
• operate the application.

The MMD website may also use Vercel Analytics and Speed Insights to understand performance, reliability and technical usage.

We do not currently use advertising cookies.

We do not use third-party advertising services to track users for advertising purposes.

You can manage or block cookies through your browser settings. However, blocking essential cookies or browser storage may prevent parts of MMD from functioning correctly.

16Third-party services

MMD uses trusted third-party service providers where necessary to operate the platform.

Depending on the features used by a Madrasah, these may include providers for:

• cloud hosting;
• database infrastructure;
• email;
• payments;
• notifications;
• performance monitoring;
• analytics; and
• optional AI functionality.

Optional integrations, including AI services, are used only where they have been configured and enabled by the relevant Madrasah.

Where a third party processes information on our behalf, appropriate contractual and security protections are required.

17Automated decision-making and AI

MMD does not use solely automated decision-making to make decisions that have a legal or similarly significant effect on an individual.

Where optional AI functionality is enabled by a Madrasah, the relevant service is used only for the purpose for which it has been configured.

AI tools do not replace the responsibility of the Madrasah or its authorised staff to make appropriate decisions concerning pupils, parents, families or staff.

18Complaints

If you have concerns about how your personal information has been collected, used or handled, we encourage you to contact your Madrasah first.

Where the matter relates to information for which MMD is the controller, please contact:

support@mmdatabase.org.uk

If you remain dissatisfied, you may complain to the Information Commissioner's Office (ICO) through its complaints service.

19Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to the MMD platform;
• changes to the services we use;
• changes in applicable law;
• changes to our data-processing practices; or
• improvements to the way we explain our privacy practices.

The latest version will always be displayed on this page together with the date it was last updated.