Privacy policy

ISMS UK (“we”, “us”) provides ISMS, online software for mosques, madrasahs, online academies and student consultancies.

For anything in this policy, email hello@ismsuk.com.

For our own website, enquiries and the accounts of the organisations that use ISMS, we are the data controller: we decide how that information is used.

As controller: the name, email, phone number and organisation of people who enquire or book a demo; the name, email, role and sign-in activity of people who use ISMS on behalf of an organisation; newsletter sign-ups; and, only if you accept analytics cookies, anonymous information about how our website is used.

As processor, depending on the organisation: for a mosque or madrasah, details of pupils (who are often children), parents and staff, with attendance, progress, fees and notes; for a student consultancy, details of applicants and students including identity documents such as passports, education history, and visa and immigration records.

Most of this comes from you directly. If you use ISMS on behalf of an organisation, it may have given us your name and email to set up your account.

You do not have to give us any information, but without an email address we cannot set up an account or reply to an enquiry.

To provide, secure and support the service; to manage subscriptions and billing; to answer enquiries and send service emails; and to meet our legal and accounting duties.

We do not sell personal information, and we do not use pupil, family or applicant records for advertising or for any purpose of our own.

We do not make decisions about anyone by automated means alone.

We rely on contract (to provide the service an organisation has signed up for), legitimate interests (to answer enquiries, keep the service secure and improve it), consent (for analytics cookies and newsletters), and legal obligation (for example accounting records).

We use a small number of trusted providers to run ISMS: a hosting provider, an email delivery provider, and a provider of website analytics and optional sign-in. Each is bound by a contract that requires it to protect the data and use it only to provide its service to us. Organisations that use ISMS can ask us for the full list.

If an organisation takes online payments through ISMS, it connects its own payment account (such as Stripe). Payments go straight to that organisation under its own agreement with the provider, and we never see full card details.

We may disclose information where the law requires it.

ISMS and its database are hosted in the United States (US West).

Transfers of personal data from the UK to the United States are protected by the safeguards UK data protection law recognises: our hosting provider's data processing terms include the standard contractual clauses with the UK International Data Transfer Addendum issued by the ICO.

We keep account information for as long as an organisation uses ISMS, and afterwards only as long as we need to for legal and accounting duties. Enquiries that do not lead to an account are not kept longer than we need them.

Records an organisation holds in ISMS are kept according to that organisation's instructions. When it leaves, it can have a copy of its data, and we then delete it as set out in our data processing terms.

Each organisation's data is kept separate at the database level, so one organisation can never see another's records. All connections are encrypted, passwords are stored only in hashed form, sign-in supports two-factor authentication, access depends on each person's role, and sensitive actions are recorded in an audit log.

Information about children is entered by their mosque or madrasah, which is responsible for it and for telling parents how it is used. We do not collect information directly from children, and we use it only to provide the service to that organisation.

You have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to its use, and to have it moved to another service. We will respond within one month.

Where we rely on your consent, for example for analytics cookies or our newsletter, you can withdraw it at any time.

If your details were entered by an organisation that uses ISMS (for example your child's madrasah or your consultancy), please contact that organisation first. We will help them respond.

We may update this policy from time to time. The date at the top shows when it last changed, and we will tell organisations using ISMS about any significant change.