Privacy Policy

What personal information we hold about your child and you, why we hold it, who we share it with, how long we keep it, and the rights you have over it.

Who we are

Al-Madinah Schools (AMS) is a weekend madrasah running across five London branches, teaching around 190 children aged 4 to 16.

When you give us information about your child or yourself, AMS is what the law calls the data controller. That means the organisation decides what is collected and what happens to it, and the organisation carries the responsibility for it, not an individual teacher or admin.

How to reach us about anything in this notice:

• Phone or WhatsApp: 020 7183 5404
• Email: info@almadinahschools.com
• Post: AMS, London WC2A 1HR
• Ask for the Headteacher, who is accountable for data protection across AMS.

AMS is registered with the Information Commissioner’s Office, the UK data protection regulator. Our registration number is ZC237024.

What we hold about your child and about you

• Enrolment details: your child’s name, date of birth, home address, the school they attend, your name and contact details, and emergency contacts.
• Who may collect your child, and whether they are allowed to leave at break or go home alone.
• Medical information: allergies, conditions, any medicine we hold for your child and your consent to give it.
• Attendance, recorded on the online register every session.
• Records of anything that happens: injuries and first aid, any medicine given, and behaviour incidents where there has been one.
• Safeguarding records, where we have had a concern about a child’s welfare or safety. These are kept separately and seen by far fewer people.
• Photographs, where you have given consent.
• Anything you send us: messages, questions, and complaints.

Some of this is what the law calls special category information, which simply means it needs more care and a stronger reason to hold. Health information is the main one for us, and anything that reveals religious belief counts too. In practice these are the records that never go on a personal phone, never go in a group chat, and are seen by the fewest people who can still do the job properly.

Where we get it from

Almost all of it comes from you, on the enrolment form or the enquiry form on our website, or from what you tell us during the year. The rest comes from our own staff recording what happened in a session.

Occasionally information comes from somewhere else. If children’s social care, the local authority or the police contact us about a child, they may tell us things. That is rare and it is always about keeping a child safe.

Why we hold it, and what allows us to

The law says we need a reason for every use. Ours are:

• To run the class and keep in touch with you. This is us carrying out our agreement with you when you enrol your child, and it covers the register, the timetable, fees and the messages we send you.
• To keep your child safe. Safeguarding is a recognised reason in its own right under the Data (Use and Access) Act 2025, which means we do not have to weigh it against anything else. It also covers passing information to children’s social care, the local authority designated officer or the police, because they need it to do their own job.
• In an emergency. If your child is seriously hurt or unwell, we will use and share whatever is needed to get them treated. That includes telling the ambulance service about an allergy or a condition.
• Because the law requires it. Accident records, checks on the people we employ, and our duty to handle a data protection complaint properly.
• Because we need to look into something. A complaint, a claim, or a concern about a member of staff’s conduct. We only hold what the matter is actually about.
• Because you agreed. Photographs are the main one. Consent is yours to give and yours to take back at any time.

Who we share it with, and who we don’t

We do not sell your information, we do not pass it to advertisers, and we do not hand it to other parents.

We share it in a small number of situations:

• Children’s social care, the local authority designated officer, or the police, where we are worried about a child’s safety. We will normally tell you when we do this, but not where telling you would put a child at greater risk or get in the way of an investigation. That is set out in our Child Safeguarding Policy.
• The ambulance service, or a hospital, in a medical emergency.
• Your child’s teacher, who is told about a medical condition or allergy affecting a child in their class. That is not a breach of confidence. It is how we keep them safe.
• The schools whose buildings we hire. We do not give them information about your child as a matter of course. If one asks us for something, it goes to the Headteacher rather than being answered at the door.

Where a company provides a service we use, such as the system holding our records, they hold the information on our behalf and under our instructions, and they cannot use it for their own purposes.

How long we keep it

• Safeguarding records: until your child’s 25th birthday, then reviewed rather than deleted automatically.
• Anything in a safeguarding record about child sexual abuse: until your child’s 75th birthday, following the recommendation of the Independent Inquiry into Child Sexual Abuse.
• Medical information, medication records, accident and first aid records: until your child’s 25th birthday.
• Behaviour records: for the time your child is at AMS, plus 3 years.
• Enrolment form and consents: while your child attends, then securely destroyed. Medical information follows the rule above.
• Attendance register: the current year plus 3 years.
• Complaints: 6 years from the outcome.
• Photographs: for the period stated in the consent you gave, and no longer.
• Enquiries submitted through our website: until the end of the academic year. They are cleared out each July.

We keep some of this longer than the bare legal minimum on purpose. A single date across a child’s accident, medical and safeguarding records is one rule our admin team can actually apply, and three different dates is three chances to destroy the wrong thing.

Photographs

We ask for your consent to photograph your child on the enrolment form, and we ask again each year.

• You can agree to some uses and refuse others. Agreeing to a photo on a certificate is not agreeing to a post on our public Instagram account.
• Photos are taken on an AMS device, never on a member of staff’s personal phone.
• We do not publish children’s names alongside images on public channels.
• You can withdraw consent at any time and we will stop using the image. What we cannot do is take back something already shared publicly by someone else, and it is fairer to say that than to promise otherwise.
• Families photographing their own children at an event is normal and we are not policing it. We do ask that you do not publish images of other people’s children.

Where it’s kept and how it’s protected

Records are held in the organisation’s Google Workspace account, which AMS controls. Enrolment forms and the branch logs are on paper at each branch. Safeguarding records are kept separately from everything else.

When you fill in the enquiry form on our website, what you send arrives in two places: a spreadsheet in that same Workspace account, and an email to our info mailbox. Both are cleared out at the end of each academic year, in July.

Staff can only look at what they need for their job, and we have rules they follow about paper, personal devices and group chats. There are no class or branch WhatsApp groups at AMS, deliberately, because anything posted to one has gone to every phone in it. Anything about your child comes to you one to one from the AMS number.

Your rights

You have the right to:

• Be told what we hold and why. That is this notice.
• See what we hold about your child or about you. You can ask any way you like, including by just asking us, and we have one month to respond. It is free.
• Have wrong information corrected.
• Have information deleted, in some circumstances. This one is not absolute. It does not apply where we have a legal reason to keep something, which covers most safeguarding and health records.
• Object to how we use it, and to withdraw consent where we relied on it.

Who can ask: you can normally make a request on behalf of a younger child. An older child can make their own, and the test is whether they understand what they are asking for rather than a fixed age. From around 12 upwards that is usually the case.

To make a request, contact the Headteacher using the details above. Please do not ask a teacher or an admin at the door to hand something over, because two things have to be checked first: that you are who you say you are, and that the file does not contain information about another child that has to come out before we release it.

Complaining about how we’ve handled your information

Come to us first. Contact the Headteacher using the details above. You can complain however suits you, including by phone, email or WhatsApp. We will acknowledge it within 30 days and tell you what we are doing about it. This runs through our normal complaints procedure, which you can ask us for.

Then the ICO, if you are not happy with our answer. The Information Commissioner’s Office is the UK regulator for data protection. You can complain to them at any point without coming to us first, though it is usually quicker if we get the chance to sort it out.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

Changes to this notice

We review this notice every year and whenever the law or our practice changes. The current version is the one dated at the bottom of this page, and we will tell you if anything significant changes.

Reviewed October 2026

Back to policies