Privacy Policy

1. Introduction

Shah Walayat Foundation ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile app, or take part in anything we run.

We are a UK registered charity (Charity No: 1093750) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We may collect the following types of information:

• -Personal Information: Name, email address, phone number, and postal address when you register, donate, or contact us.
• -Payment Information: When you make donations, we collect payment details through secure payment processors.
• -Booking Information: Details of room bookings and event registrations.
• -Usage Data: Information about how you use our website and app, including IP address, browser type, and pages visited.
• -App Information: If you allow notifications, a device token so we can send them. If you attach a photo, the image you choose. We do not collect your location.
• -Class Records: For anyone enrolled in our classes, including children: enrolment details, attendance, progress, assessment results, and safeguarding records where we are required to keep them.

3. How We Use Your Information

We use your information to:

• -Process donations and provide tax receipts where applicable
• -Manage event registrations and room bookings
• -Send you updates about our activities and charitable work (with your consent)
• -Respond to your enquiries and provide customer support
• -Improve our website and services
• -Comply with legal obligations

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• -Consent: Where you have given us explicit consent to process your data.
• -Contract: Where processing is necessary to fulfil a contract with you (e.g., room bookings).
• -Legitimate Interests: Where processing is necessary for our legitimate interests as a charity.
• -Legal Obligation: Where we are required to process data by law.

5. Data Sharing

We do not sell your personal information. We may share your data with:

• -Stripe, our payment processor, to handle donations and payments securely. We never see or store your full card details.
• -Service providers who help us operate our website and services
• -Legal authorities when required by law

6. Data Retention

We keep your personal data only as long as we need it for the purpose we collected it, or as long as the law requires us to.

Where we claim Gift Aid, HMRC requires us to keep the donor's name and address for six years after the end of the accounting period the claim falls in. Financial records — donation amounts, dates, references, payments, refunds and receipts — are kept in full for the same reason.

7. Deleting Your Account

You can delete your account yourself, at any time, without asking us. In the app it is under Profile → Account, and on the web it is at theswf.net/account/delete. You have 30 days to change your mind, and we email you a link to stop it.

Deleting your account removes your personal details and signs you out everywhere. Some records survive it, because removing them would either break somebody else's record or breach a legal duty. Where that happens the record stays and your name is removed from it, so a message shows as from a deleted user and a donation still counts toward a total.

The deletion page lists exactly what is kept and why, before you confirm anything.

8. Children and Young People

Children attend our classes, and we hold records about them. We follow the Information Commissioner's Age Appropriate Design Code and collect the least we can.

• -A child is enrolled by a parent or guardian, who holds the account and gives consent on the child's behalf.
• -We hold a child's name, date of birth, attendance, progress and any medical or safeguarding information a parent tells us we need.
• -A parent or guardian can see, correct or ask us to delete their child's records, and can withdraw them from a class at any time.
• -We do not profile children, advertise to them, or share their information with anyone outside the charity except where safeguarding law requires it.

Safeguarding records are kept for as long as our safeguarding duties require, which can be longer than other records. If you want to know what we hold about your child, please contact us using the details below.

9. The Mobile App

Our app shows the same site you are reading now, with a few things your phone can do that a browser cannot. It asks permission before using any of them, and you can withdraw that permission in your device settings at any time.

• -Notifications: if you allow them, we store a device token so we can send prayer reminders, announcements and messages. Turning them off deletes the token.
• -Camera and photos: used only when you attach a photo to a message, an assignment or a volunteer task. We receive the image you choose and nothing else.

Donations are not taken inside the app. Tapping Donate opens our website in your browser, and the payment happens there.

10. Your Rights

Under UK GDPR, you have the right to:

• -Access the personal data we hold about you
• -Request correction of inaccurate data
• -Request deletion of your data, or delete your account yourself at any time (subject to the legal requirements described in section 6)
• -Object to processing of your data
• -Request data portability
• -Withdraw consent at any time

11. Cookies

Our website uses cookies to improve your experience. Essential cookies are necessary for the website to function properly. We also use analytics cookies to understand how visitors interact with our website. You can manage cookie preferences through your browser settings.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All payment transactions are encrypted using SSL technology.