Privacy Notice
What we collect, why we hold it, who can see it, and how long we keep it.
This notice explains what personal information we collect about students and parents on The Madrasa Project, why we hold it, who can see it, and how long we keep it. It sits alongside Al-Mahdi Institute’s general privacy statement, and it covers both forms — the application form and the enrolment pack that follows an offer.
Version 1.1 · 22 September 2026. Version 1.1 adds the section on cookies and names the company that hosts this website. Nothing about how we use information already given to us has changed. The notice will be reviewed before each cohort, and any change that does affect how we use information already given to us will be notified to parents by email.
Who is responsible
Al-Mahdi Institute, 60 Weoley Park Road, Birmingham B29 6RB, is the data controller for information collected through The Madrasa Project, registered with the Information Commissioner’s Office under reference ZA381777. For anything about your information, write to madrasa@almahdi.edu and mark your message for the Data Protection Officer.
What we collect at application
The student’s name, date of birth, school or college and year group; the student’s own email address and mobile number; a parent or guardian’s name, email address, mobile number and postcode where the student is under eighteen; the two written answers on the form; and how you heard about the programme.
The form may be completed by the student, by a parent or guardian, or by the two together.
No information about health, additional needs or safeguarding is requested at application stage.
What we collect after a place is accepted
- Your photography choice — no images at all, internal use only, or internal use plus AMI social media.
- Who programme correspondence should go to — a parent or guardian, or the student themselves.
- The programme agreement and data protection acknowledgement, with a typed name and date.
Medical and emergency information — on paper only
GP details, conditions, allergies, medication, dietary requirements, additional needs, two emergency contacts and consent for emergency treatment are completed on paper, in person at the welcome day, and before the first session for anyone joining later.
They are not collected through any online form, are not held in any of our systems, and are not emailed. The paper record is kept in a locked cabinet at the Institute and is brought to the room for each session so that it is available if it is needed.
Across the year we also keep an attendance record for each session, and a record of the fee having been paid.
Why we are allowed to hold it
- To provide the programme you have enrolled in — performance of a contract. This covers application, enrolment, the fee and the running of sessions.
- Attendance and duty of care — our legitimate interests in safeguarding, in knowing who is on site, and in keeping a completion record. This is not based on consent, and is recorded here rather than asked for separately.
- Medical, dietary and emergency information — necessary for the contract between us and, because health information requires a further condition, held on the basis of safeguarding children and protecting their vital interests. We ask for it because we cannot safely run a Saturday programme for a student whose allergy or medication we do not know about. That is why the enrolment pack must be completed before the first session.
- Photography — consent, freely given and freely withdrawn.
- Our waiting list — our legitimate interests in filling the next cohort and in contacting families who have already shown interest. This is not consent, and you may object at any time; we will remove the application and it will not affect a future application.
- Safeguarding records — our legal obligations and the substantial public interest in protecting children.
Who can see what
- Applications — a small admissions group at the Institute: the Programme Lead, the programme administrator, and two members of Institute staff who support the programme.
- The student record and attendance — the administrator, the Programme Lead and teaching staff.
- Medical and emergency information — the paper record, seen by the Designated Safeguarding Lead, the Programme Lead and the programme administrator. Where a member of staff needs to know one thing in order to keep a student safe on the day — an allergy, for example — they are told that one thing and nothing else.
- Safeguarding records — the Designated Safeguarding Lead only. These are held on paper, separately from the student record.
We do not sell personal information, we do not use it for advertising, and we do not add anyone to a marketing list from these forms.
Cookies
This website sets no cookies. It does not use Google Analytics or any other analytics service, it carries no advertising or tracking pixels, and it stores nothing in your browser. That is why you have not been asked to accept anything. Fonts and other files are served from this site itself rather than from another company’s network.
When you click through to apply, you leave this website and arrive at a form hosted by Microsoft. Microsoft sets its own cookies there, and that page is covered by Microsoft’s privacy notice as well as this one. The same is true of the links to our Facebook, Instagram and TikTok pages.
Who else is involved
Forms and records are held inside Al-Mahdi Institute’s own Microsoft 365 environment. Card payments are taken by Stripe, our payment provider — we receive confirmation that a payment has been made and a reference, and we never see or store card details. This website is hosted by Netlify, whose servers keep a short-lived log of visits, including the IP address the request came from, so that the site can be kept available and secure.
How long we keep it
- Applications that are not offered a place — kept on our waiting list for twelve months from the decision, so that we can contact you when applications open for the next cohort, and destroyed at the end of that period. You can ask us to delete it sooner, at any time.
- Student records, attendance, consent and the paper medical record — three years after the programme ends.
- Safeguarding records — twenty-five years from the student’s eighteenth birthday.
- Financial records — as required for accounting and tax purposes.
Your rights
You can ask to see the information we hold, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive a copy in a portable form. Where we rely on your consent — photography — you can withdraw it at any time, and doing so will not affect the student’s place on the programme.
Withdrawing consent does not undo what was lawfully done beforehand, and some records we are obliged to keep cannot be erased on request — safeguarding records in particular.
Write to madrasa@almahdi.edu for any of these. We will respond within one month.
Complaints
If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Students’ own rights
Students aged 16 to 18 have these rights over their own information in their own right. Where a student asks us directly, we will deal with them directly.
At a glance
No medical information online, at any stage. Health details are taken on paper, in person, and kept on paper.
Photography is optional. Declining does not affect a student’s place or participation.
Medical records are paper and kept in a locked cabinet, seen only by those who require them.
Safeguarding records are held separately — on paper, for twenty-five years.