Privacy Policy

Last updated: 29 September 2026

Tarbiyyah Global Academy, part of the Tarbiyyah Education Trust, is the data controller for the personal data collected through this website. This notice explains what we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

What we collect, and why

• Registering interest or applying: your name, contact details, and information about your child, so we can process your enquiry or application. Lawful basis: taking steps at your request before entering into a contract with you.
• Booking an admissions call or open evening: your name, email and the time you booked, so we can arrange and manage that meeting. Lawful basis: contract / legitimate interest in running our admissions process.
• The family-fit eligibility check: your answers, so we can give you a personalised result and, if you consent, follow up. Lawful basis: consent.
• Signing in to a staff, teacher, parent or student account: your account details and activity within that account, to provide the service and keep it secure. Lawful basis: contract / legitimate interest in running the school safely.

Children's data

Where a form asks about your child, you are providing that information as their parent or guardian. We collect the minimum needed for admissions and, once enrolled, safeguarding and education — never more than the purpose requires, in line with the ICO's Children's Code.

Who we share data with

We use a small number of processors to run this website and its systems, each bound by a data processing agreement: Supabase (database, authentication and booking systems), Sanity (website content management), and, where enabled, Resend (transactional email) and Plausible (cookieless analytics — see our Cookie Policy). We do not sell personal data, and we only share it with anyone else where the law requires it or you've asked us to.

How long we keep it

We keep personal data only for as long as necessary for the purpose it was collected for, in line with the school's retention schedule — for example, an unsuccessful application is not kept indefinitely. Contact us for specifics about any particular record.

Your rights

Under UK GDPR you can ask us to: confirm what data we hold about you or your child, correct it, delete it, restrict or object to its use, or provide it to you in a portable format. To exercise any of these, or if you have a concern about how we've handled your data, contact us at [email protected]. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).