Skip to main content

Privacy Policy

Last updated: 16 May 2026 Status: Draft pending founder sign-off.

Tahawi Institute respects your privacy. This policy explains what personal data we collect when you use this website or contact us, how we use it, and the rights you have under UK GDPR and the Data Protection Act 2018.

Who we are

Tahawi Institute is the educational institute behind this site. Our campus is at Myrdle Street, Whitechapel, London E1 1HL, with teaching on weekday evenings and at weekends. For data-protection enquiries, write to admin@tahawi.org or to the postal address above marked “Data protection”.

What data we collect

We keep the data we hold to the minimum necessary to run the institute. The personal data we may collect from you falls into four categories:

  • Contact form submissions. When you send us a message through the contact form, we receive your name, email address, the subject you selected, and the body of your message. We may also receive your IP address as part of the request, which we use for rate-limiting and spam protection.
  • Enrolment data. When you register your interest in a programme or proceed to enrolment, we collect the details requested on the relevant form — typically name, date of birth, contact details, prior study, and (where applicable) parent or guardian contact details. Enrolment data is held in our admissions records.
  • Email correspondence. When you email us directly at info@tahawi.org or admin@tahawi.org, we keep the correspondence in our mailbox for as long as is needed to respond and for our records.
  • Site analytics. If you consent to analytics cookies, we use Google Analytics 4 to understand how the site is used. The data we receive is aggregated and does not identify you personally. You can refuse or withdraw consent at any time via the cookie banner or the /cookies/ page.

We do not knowingly collect data from children under 13 without a parent or guardian’s involvement.

Why we use your data

We process your personal data for the purposes set out below, relying on the lawful bases listed beside each.

  • To respond to your enquiry — lawful basis: legitimate interest (running the institute and answering people who contact us).
  • To process your enrolment — lawful basis: contract (taking steps prior to entering into a contract with you, then performing that contract).
  • To send you administrative information about a programme you have registered for (e.g. timetable, joining instructions) — lawful basis: legitimate interest.
  • To understand site usage in aggregate — lawful basis: consent (you opt in via the cookie banner).
  • To meet our legal obligations — lawful basis: legal obligation (for example, retention of financial records).

We do not send marketing emails. We do not sell personal data. We do not share personal data with third parties except as described below or as required by law.

Who we share data with

The processors who handle data on our behalf:

  • Resend — email delivery infrastructure for the contact form, resend.com.
  • Cloudflare Turnstile — spam-protection check on the contact form, cloudflare.com.
  • Google Analytics 4 — aggregated site analytics (only if you have given consent).
  • Supabase — our hosting database for enrolment records, hosted in the EU (London region).
  • Vercel — the platform hosting this website.

Each of these is a separate data controller for their own infrastructure and we have appropriate agreements in place. We do not transfer your personal data outside the UK or EEA except where the recipient is bound by an adequacy decision or equivalent safeguards.

How long we keep it

  • Contact-form submissions: 12 months from the date of the last reply, then deleted.
  • Enrolment data: for the duration of your active study with us plus 7 years for academic-record purposes.
  • Email correspondence: for as long as our mailbox retains it; we do not actively prune.
  • Analytics data: retained according to the Google Analytics default of 14 months.

Where you ask us to delete data sooner, we will do so unless we have a legal obligation to retain it.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify data that is incorrect.
  • Erase your data (“the right to be forgotten”), subject to our legal obligations.
  • Restrict or object to our processing.
  • Portability — receive your data in a structured, machine-readable form.
  • Withdraw consent at any time, where the lawful basis is consent.
  • Complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your data.

To exercise any of these rights, email admin@tahawi.org. We will respond within one month.

Cookies

A separate cookies policy is at /cookies/ and describes what cookies the site sets, what each does, and how you can manage them.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent change. Material changes will be flagged on the home page for a reasonable period before they take effect.

Contact

Questions or requests under this policy: admin@tahawi.org.