Privacy Policy

1. Who we are

Hattat Ibrahim is a school of classical Arabic calligraphy led by Hattat Ibrahim Jum'ah and operating in the United Kingdom. For the purposes of UK data protection law, Hattat Ibrahim is the data controller of the personal data described in this policy.

You can contact us about any privacy matter by WhatsApp on 07438 752958 or through the enquiry forms on this website.

2. Personal data we collect

We collect only the information we need. Depending on how you interact with us, this may include:

• Identity and contact data: name, email address, telephone number, town or city, and (for organisations) the name of your school, mosque or organisation.
• Enquiry and learning data: the pathway you are interested in, your current level, availability, learning aims and any information you choose to include in a message.
• Booking and transaction data: details of lessons, workshops, events or artworks booked or purchased, and records of payments (we do not store full card details).
• Information about children: where a parent, guardian or organisation books on behalf of a child, the child's first name, age or school year and any relevant needs supplied by the adult making the booking.
• Technical data: basic, non-identifying information automatically collected when you visit the website, such as browser type, device type and pages visited, used to keep the site secure and working properly.

3. How we use your personal data

• To respond to your enquiry and recommend a suitable learning pathway.
• To arrange, deliver and administer lessons, courses, homeschool cohorts, workshops, demonstrations and events.
• To manage waitlists and notify you when a place becomes available.
• To process commissions and artwork purchases, including delivery.
• To meet our legal, accounting, insurance and safeguarding obligations.
• Where you have given consent, to send occasional news about classes, workshops and new works. You may unsubscribe at any time.

4. Lawful bases for processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract — where processing is necessary to provide services you have booked, or to take steps at your request before entering into a contract.
• Legitimate interests — to respond to enquiries, run and improve the Academy and keep records, where those interests are not overridden by your rights.
• Legal obligation — to comply with tax, accounting, safeguarding and other legal requirements.
• Consent — for optional marketing communications. You may withdraw consent at any time without affecting prior processing.

5. How your data is stored and kept secure

Enquiries submitted through this website are stored in a secure, access-controlled cloud database used solely by the Academy. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, and restrict access to those who need it to run the Academy.

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement.

6. Sharing your data

We never sell your personal data. We share it only where necessary with trusted service providers who act on our instructions (for example website hosting, database, messaging, payment and delivery providers), with host organisations where you attend an event they have arranged, or where required by law, regulators or for safeguarding purposes.

7. How long we keep your data

• Enquiries that do not lead to a booking: up to 24 months, then deleted.
• Student and booking records: for the duration of study and up to 6 years afterwards for accounting and legal purposes.
• Safeguarding records: retained in line with statutory guidance.
• Marketing preferences: until you unsubscribe or withdraw consent.

8. Children's data

Our services for under-18s are booked by a parent, guardian, school or other responsible organisation. We collect only the minimum information needed about a child, and we do not publish photographs or work of identifiable children without explicit written consent from a parent or guardian.

9. Cookies

Our website uses only the essential cookies and similar technologies needed for it to function. Please see our Cookie Policy for details.

10. Your rights

Under UK data protection law you have the right to:

• be informed about how your data is used;
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to processing;
• data portability; and
• withdraw consent at any time where processing is based on consent.

11. Exercising your rights and complaints

To exercise any of your rights, please contact us using the details above. We will respond within one month. There is normally no charge.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. We would, however, appreciate the chance to address your concerns first.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with the date of the most recent revision.