Privacy Policy

Effective date: 22 August 2026 | Last updated: 22 August 2026

This policy explains how As-Suffa Trust ("As-Suffa", "we", "us" or "our") collects, uses, stores and shares personal information when authorized users use the AS-SUFFA EMS mobile application and web portal (the "Service").

1. Who we are

AS-SUFFA EMS is provided by As-Suffa Trust, a UK registered charity (charity number 1106270). Our registered address is 25 Park Lane, Aston, Birmingham, B6 5DA. Our main correspondence address is 156 High Street, Aston, Birmingham, B6 4UX.

For information managed by an educational organization through the Service, that organization may determine why and how its school records are processed. As-Suffa Trust operates the Service and processes information to provide and administer it. Questions can be sent to info@as-suffa.org or raised by telephone on 0121 285 2777.

2. Information we collect

The information processed depends on a user's role and the features used. It may include:

Account and identity information, including name, username, email address, telephone number, role, profile image and login identifiers.
Student information, including date of birth, gender, address, postcode, year group, department, subjects and enrolment details.
Family and contact information, including parents, guardians, carers, emergency contacts and collection permissions.
Health, allergy, medical, wellbeing, consent and safeguarding information supplied through enrolment or school administration.
Education records, including attendance, timetable, assignments, tests, progress, diary entries, class sessions, Hifz and Namaz records.
Communications and user content, including chat messages, notes, comments, files, images, documents and audio recordings.
Administrative and financial information, including invoices, donations, payment evidence and related records where applicable.
Technical information, including device type, operating system, app version, IP address, notification token and security or diagnostic logs.

3. How we receive information

Information may be provided by the user, a parent or guardian, a teacher, authorized school staff, an administrator or another organization using the Service. Information is also created when users perform actions in the Service. AS-SUFFA EMS does not offer public self-registration; accounts are normally provisioned by an authorized organization.

4. How and why we use information

To authenticate users and provide secure, role-based access.
To administer students, staff, parents, donors, classes, attendance, learning and school operations.
To support communication between authorized users and deliver service notifications.
To manage enrolment, safeguarding, wellbeing, educational progress and statutory school records.
To process invoices, donations and associated administration where these features are used.
To prevent misuse, investigate incidents, maintain audit records and protect the Service.
To troubleshoot, maintain and improve performance and accessibility.
To comply with legal, regulatory, contractual and safeguarding obligations.

Our legal bases may include consent, performance of a contract, compliance with legal obligations and legitimate interests in operating educational, charitable and administrative services. Where special category information is processed, it is handled only where an additional lawful condition applies.

5. Children and student information

The Service is designed for education administration and may process information about children. Accounts and access are controlled by authorized organizations. Children should use the Service under the arrangements established by their school, parent or guardian. Parents, guardians and eligible students may contact their organization or As-Suffa to exercise applicable privacy rights.

6. When information is shared

Information may be shared only where necessary with:

Authorized administrators, teachers, parents, students and other role-based users within the relevant organization.
Contracted technology providers that support hosting, secure storage, file delivery, communications, monitoring and maintenance.
Google Firebase for push-notification delivery and related device-token processing.
Payment processors or financial institutions where an applicable payment, invoice or donation feature requires them.
Professional advisers, safeguarding bodies, regulators, law enforcement or public authorities where disclosure is required or lawfully necessary.

We do not sell personal information and do not use student information for behavioral advertising. Service providers are permitted to process information only for the services they provide to us or the relevant organization.

7. International processing

Some contracted technology providers may process information outside the United Kingdom. Where an international transfer occurs, we use contractual and other safeguards required by applicable UK data-protection law.

8. How long information is kept

We retain personal information only for as long as it is necessary for the activity for which it was collected and to satisfy applicable legal, safeguarding, financial, educational, contractual and audit requirements. Retention therefore varies by record type. When information is no longer required, it is deleted or irreversibly anonymized.

Some school, attendance, safeguarding, financial and audit records may need to remain after an account is closed. Such records are restricted and retained only for the applicable lawful purpose and retention period.

9. Security

We use reasonable organizational and technical safeguards, including encrypted network transmission, authenticated access, role-based permissions and protected local credential storage. Access is limited to users and providers who require it for their duties. No internet service can guarantee absolute security, and users must keep login details private.

10. Your rights

Subject to applicable law, individuals may have rights to access, correct, delete, restrict or object to processing, receive a portable copy of information and withdraw consent where processing relies on consent. Requests can be made to the relevant organization or to info@as-suffa.org.

Account and associated-data deletion can be requested through our Account and Data Deletion page. We may need to verify identity and authority before acting on a request.

11. Complaints

Please contact As-Suffa first so we can investigate any concern. Individuals also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

12. Notifications, microphone and files

Users can control notifications through device settings. Microphone access is requested only when a user chooses an audio-recording feature. Android file and media selection uses the operating system picker, which gives the app access only to files selected by the user.

13. External links

The Service may contain links to websites or services operated by third parties. Their privacy practices are governed by their own policies. Users should review those policies before providing information.

14. Changes to this policy

We may update this policy when the Service, our practices or legal requirements change. The current version and updated date will remain available on this page. This application policy supplements the wider As-Suffa Trust Privacy Statement.

15. Contact us

As-Suffa Trust
156 High Street, Aston, Birmingham, B6 4UX
Email: info@as-suffa.org
Telephone: 0121 285 2777
Website: https://as-suffa.org/

Page updated

Google Sites

Report abuse