Who we are
The International Islamic College Ltd ("the College", "we") is the data controller for your information. We are a company limited by guarantee, no. 16790844, based in Leicester, United Kingdom. Contact for anything in this notice: info@theiic.uk. Our named data-protection lead responds to all data queries.
What we collect, and when
- When you apply: your name, date of birth, contact details, town, the riwāyah you recite, a short account of your ḥifẓ, your referee's name and contact, and — if you choose to give it — a link to a recitation recording and any accessibility needs.
- At assessment: notes of your oral assessment and, where made with advance notice, a recording of the assessment call.
- If you enrol: your enrolment agreement, payment records (programme fees are paid by bank transfer to the College's account — we see the payer name and reference on our bank statement, nothing more), your session-by-session recitation record (the Sijill), and your award record.
- By its nature, holding this data indicates your religion. UK law treats that as special-category data, and we handle it under the conditions described below.
Why we use it — our lawful bases
We process your application, assessment, enrolment, teaching and award because that is what you have asked us to do — in legal terms, steps necessary for a contract with you (UK GDPR Article 6(1)(b)). Payment and accounting records are kept because the law requires it (Article 6(1)(c)). For the religious dimension inherent in all of this, we rely on the condition for not-for-profit bodies with a religious aim processing the data of their members and those in regular contact with them (Article 9(2)(d)) — with strict safeguards: your data is not disclosed outside the College without your consent, access is limited to those who need it, and retention is limited as set out below.
We never make entry to a programme conditional on 'consent' for processing the programme genuinely requires — that would be an empty consent, and we do not ask for it. Consent is reserved for the genuinely optional things below, and you can withdraw it at any time.
The Shaykh in Kuwait — an international disclosure you control
Our Resident Musnid, Shaykh Magdy Mahmoud Badir, lives in Kuwait, which does not hold a UK adequacy decision. Before he travels to the UK, sharing your recitation sample or assessment details with him is an international transfer — so we ask your explicit consent for it on the application form, name him and the country there, and it is genuinely optional: if you prefer, you are simply assessed live. Where you consent, the transfer is protected by the ICO's International Data Transfer Agreement signed with the Shaykh, view-only access to UK-hosted material, and deletion once assessment concludes. During his residency in the UK, he teaches here and no international transfer arises.
Who else receives your data
Service providers who process data on our instructions under contract: Vercel (website hosting), Resend (email), and our database and storage hosts. (Stripe processes card payments for other College services — it is not used for this programme's fees, which are paid by bank transfer.) We do not sell data, we do not run advertising lists, and we do not disclose your data to anyone else without your consent unless the law requires it.
How long we keep it
| Record | Kept for |
|---|---|
| Unsuccessful applications | 12 months after the admissions cycle |
| Student files (incl. the Sijill) | 6 years after you leave |
| Assessment recordings | Deleted once the result is confirmed and the appeal window closes (at most 12 months) |
| Award verification register | Permanent — minimal data only (name, award, date, number, status) |
| Financial records | 6 years plus the current year (legal requirement) |
The verification register
Every certificate we issue carries a unique number and QR code. Entering that exact number at theiic.uk/verify shows the certificate's holder name, award, date and status — nothing more. There is no public list and no search by name; the register only answers a number someone already holds, which is how employers verify certificates without the College publishing its graduates. This is part of your enrolment agreement.
Your rights
You may ask for a copy of your data, correction of anything inaccurate, deletion where we no longer need it, restriction or objection, and a portable copy — write to info@theiic.uk and we respond within one month. Where processing rests on consent, you may withdraw it at any time without affecting anything already lawfully done. If you are unhappy with our answer, you may complain to the Information Commissioner's Office at ico.org.uk — though we would ask for the chance to put things right first.
Changes
If this notice changes materially, we tell applicants and students directly by email. This version: 1.0, issued 11 August 2026.