at-Taʾṣīl (التأصيل) · Foundation Diploma in Islamic Studies · International Islamic College, Leicester
Ref: TSL-POL-010 · Version: 1.0 (draft) · Date: 7 September 2026 · Owner: Programme Lead (Ustādh Emran Ahmed) · Review: before the Programme opens, then annually.
1. What this notice is
This notice explains, in plain English, how the International Islamic College ("the College", "we") uses personal data when you enrol on the Foundation Diploma. It is written for students and, where the student is 16 or 17, for parents and guardians too. Please read it before you enrol; if anything is unclear, ask us.
2. Who is responsible for your data
The controller of your personal data is the International Islamic College, Leicester. Classes take place at Masjid Fida, but the masjid is the venue only: the College alone is responsible for the Programme, your enrolment and your data.
For anything in this notice, contact info@theiic.uk (mark your message "Data protection") or 07436 436363. The Programme Lead is responsible for keeping this notice accurate.
3. What we collect
We collect only what the Programme needs:
- your name and contact details (phone, email, and address if you give it);
- your date of birth, used to confirm you are 16 or over and, for 16–17-year-olds, to apply the extra arrangements below;
- for students under 18, a parent or guardian's name and contact details, and their written consent;
- for students under 18, an emergency contact and the going-home arrangement — collected by a parent or named adult, or travelling home alone with the parent's written permission;
- any medical or access-needs information a student or parent chooses to give us — this is always voluntary, and is used only to keep sessions safe and to adjust teaching;
- your attendance record;
- your assessment records — tasmīʿ results, examination marks, weekly assignments, termly essays, the portfolio, and your final grade;
- safeguarding records, only if a concern ever arises;
- photographs, only ever with your consent (and a parent's consent for under-18s).
We take these details from you directly at enrolment.
4. Why we use it, and our lawful bases
A place on the Programme is never conditional on consent. Consent is asked only for genuinely optional things, such as photographs, and refusing changes nothing else.
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Enrol you, teach you, keep the attendance and assessment records, send the termly record, and award the Diploma | Article 6(1)(b) — our contract with you |
| Keep records of the fees you pay and any refunds | Article 6(1)(c) — legal obligation (accounting law) |
| Tell the parents of an under-18 about every absence, send them the termly record, and contact them about conduct or welfare | Article 6(1)(b) — this reporting is part of the enrolment terms for 16–17-year-olds |
| Hold the safeguarding and welfare arrangements — the under-18 emergency contact and going-home permission, and any medical or access-needs information volunteered | Article 6(1)(f) — our legitimate interest in keeping students safe; Article 6(1)(d) — vital interests in an emergency; with Article 9(2)(a) — explicit consent — for the health information you choose to give us. Retention: see section 8 |
| Act on a safeguarding concern | Article 6(1)(f) — our legitimate interest in protecting children and adults at risk; Article 6(1)(d) — vital interests where someone's safety is at immediate risk; Article 6(1)(c) only where a specific legal duty genuinely applies (for example, a referral the College must make to the Disclosure and Barring Service); with the substantial-public-interest safeguarding condition in the Data Protection Act 2018, Schedule 1, for any sensitive detail — relied on under the College's Appropriate Policy Document (TSL-POL-012), which Schedule 1 Part 4 requires. Retention: see section 8 |
| Take or publish photographs | Article 6(1)(a) and 9(2)(a) — your consent, which you may withdraw at any time |
5. Religious data
Enrolling on an Islamic studies programme inherently says something about your religion, so much of this data is special-category data. We rely on Article 9(2)(d): the College is a not-for-profit body with a religious aim TBCLEGAL-FORM-TBC — confirm and state the College's legal form here before publication; if the College is not constituted as a not-for-profit body, this section must rely on explicit consent under Article 9(2)(a) instead, we process this data only about our own students and regular contacts, and we do not disclose it outside the College without your consent. Where that condition does not fit a particular use, we ask for your explicit consent instead. Applicants who do not enrol are neither members nor regular contacts, so for them we rely on explicit consent, asked for at first contact; the details of an applicant who does not enrol are deleted within six months of the decision.
6. Students aged 16 and 17
A student aged 16 or 17 joins with written parental consent. Their parent or guardian is told of every absence, receives the termly one-page record of what has been memorised, heard and assessed, and is contacted about any conduct or welfare matter. A 16–17-year-old still holds their own data-protection rights, and we deal with them directly as a student.
7. Who sees your data
We never sell your data, never use it for third-party marketing, and your data is not transferred overseas.
- Within the College: the teacher and Programme Lead; and the Academic Lead, who sees sampled essays and examinations for moderation, and the material of any complaint or appeal he hears. Safeguarding records are seen only by those who must act on them, including Ustādh Emran Ahmed, the Programme's safeguarding lead; a record of a concern that involves the lead himself is held by the Academic Lead instead, and the lead has no access to it.
- The masjid: nothing, beyond the minimum safety requires — for example, who is in the building during an emergency.
- Service providers, who process data only on our instructions and under contract: Stripe (payments — card and Direct Debit; Stripe receives the name, email address and payment details you give it at checkout, and the College never sees your card number), Resend (sending the College's emails), Supabase (hosting the College's database, where your records are stored) and Vercel (hosting the website and the student portal). No other provider receives your data.
- The authorities: where the law requires it — for example, a safeguarding referral to the local authority or police.
8. How long we keep it
Marked essays and the termly records sent home are yours to keep.
| Record | How long |
|---|---|
| Enrolment record and the assessment register (name, dates, marks, final award) | Permanently, in minimal form, so the College can verify your Diploma in years to come |
| Financial records | 6 years, as accounting law requires |
| Safeguarding records | In line with statutory safeguarding guidance for the type of record |
| Everything else — contact details, parent details, coursework and essays, attendance detail | Deleted within 12 months of the end of the Programme |
| Emergency contacts and volunteered medical or access-needs information | Deleted within 12 months of the end of the Programme — unless linked to a safeguarding record, in which case kept with that record |
| Parental-consent and travel-home permission forms for under-18s | Deleted within 12 months of the end of the Programme; where a safeguarding concern arose, kept with the safeguarding records — until the person's 25th birthday, or longer where abuse is alleged |
| Photographs | Used only while your consent stands; removed from College use when you withdraw it |
| Photo-consent forms | Kept for as long as the photograph remains in College use, plus 12 months — so the consent a photo rests on can always be evidenced |
9. Your rights
You have all UK GDPR rights: to access a copy of your data, to have it corrected, to have it erased, to restrict or object to its use, to portability, and to withdraw consent at any time (which does not affect what was done while consent stood). Some rights apply only in certain circumstances — for example, we cannot erase safeguarding records or the minimal award register before the retention periods in section 8 end, however the request is made. No decision about you is made by purely automated means.
To use any right, contact info@theiic.uk — no form is needed. We respond within one calendar month.
10. Complaints
If you are unhappy with how we handle your data, please tell us first and give us the chance to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
Registration
ICO registration of the College: TBCICO-REGISTRATION-TBC — legally required before applicant data flows; ~£52/yr.
Revision history
International Islamic College, Leicester · 07436 436363 · info@theiic.uk · theiic.uk
| Version | Date | Change | Approved by |
|---|---|---|---|
| 1.0 | 7 September 2026 | First draft | Programme Lead |