Privacy

What this covers

This notice explains what Elite Iqraa Academy Ltd does with personal information given through this website. It applies to this site only.

Browsing the site collects nothing about you beyond what any website needs to deliver a page, such as your IP address, which the companies that host our pages and pictures see when your browser asks for them. There is no advertising network, no cross-site tracking and no third-party analytics profile built from your visit.

What registration asks for

The form asks for what is genuinely needed to place a student in the right class and to contact you about it: the student's name, age, gender, nationality and first language; the school and year group they are in now, if any; the programme, study mode, private or group, and the days you want; how far along they are in Arabic and Qur'an; your own name, relationship to the student, phone number and email address; the name, phone number and relationship of one emergency contact; how you heard about us; and, if you want to tell us, what you would like the student to achieve.

We ask for the student's date of birth so we can work out their age. The date itself is used in your browser and printed on your copy. Only the age in whole years is sent to us. A child's exact date of birth is a useful thing for someone to steal and we have no need for it.

The emergency contact is usually someone other than you. Please make sure they are happy for you to give us their name and number. They have not visited this site and have not seen this notice, so telling them is something only you can do.

Nothing on the form is collected because it might be useful later. If a field is not needed to arrange classes, it is not there.

If you send us a message

The contact form asks for your name, your email address, your message, a phone number only if you would rather we called, and (if you want to say) which programme you are asking about. We also record that you ticked the consent box. Nothing else, and there is no file upload.

We use it to answer you and for nothing else. It is not added to a mailing list, and we do not send marketing.

How long we keep it

Registration submissions and contact messages are both deleted 90 days after they are received. Deleted means the record is removed from the database outright, not hidden behind a flag or marked inactive. The office may print a registration for its paper file, and it destroys that printout under the same rules.

One honest caveat, because the alternative is to imply something we cannot deliver: our database provider keeps encrypted backups so that data can be recovered after a failure. A record you ask us to delete, or one that reaches its 90 days, is removed from the live system straight away, but a copy may persist in those backups until they age out of the provider's own retention window. Nobody at the academy can read those backups in the ordinary course of work.

If a student enrols, their ongoing records are kept by the academy under its own records policy. That is separate from this website and is not governed by this notice.

Who can see it

Only named academy staff who have their own accounts on the academy's private dashboard. We do not sell personal information, and we do not share it with anyone except the companies listed below that run this website for us, or where the law requires it.

They read submissions through that dashboard, which requires a password to reach, and opening it is recorded. For a registration, the log says who signed in, which child's record they opened, and when. For a message sent through the contact form, it records that a member of staff opened the list of messages, not which message they read, because the messages are shown together on one page rather than opened one at a time.

Those entries go into a log the website itself cannot change or delete: the database refuses the attempt, so nobody acting through this dashboard can remove the record of having looked at something. We are not going to claim more than that. The people who hold the database's own master credentials could alter it, as the operators of any system could; what we can honestly promise is that the dashboard gives them no way to.

One more limit, because a promise with an asterisk you cannot see is not a promise. If the database is briefly unreachable at the moment an entry is being written, that entry can be lost while the page still loads. We chose that deliberately: locking the academy out of its own registrations during enrolment would be a worse failure than a rare gap in the log.

The companies that run the website for us

A few companies handle information on our behalf so that the website can work. Neon stores the database that holds registrations and messages. Vercel hosts the website and runs the code that receives the forms. Cloudflare Turnstile is the bot check on the forms. Resend sends the two emails described below. Upstash counts form submissions from each IP address for a short time, so that no single source can flood the forms. It also counts confirmation emails to each email address for a day, so that nobody can use the form to flood someone else's inbox; for that it holds a scrambled, one-way form of the address (a hash), never the address itself. Cloudinary stores and serves the photographs and pictures on the site, and never receives anything you type into a form.

When you register, we send one confirmation email to the address you gave. It carries your reference and the academy's contact details, and nothing else from the form, so a mistyped address reveals nothing about the student. Resend keeps a record of each email it sends, including the address it went to and the reference, for a limited period of its own.

When a registration or a message arrives, the academy's office also receives a short alert email with only its reference and a link to the dashboard. Your details stay in the dashboard and are not copied into either email.

The law we work under

Elite Iqraa Academy Ltd is the data controller for everything described here, and we handle personal information under the Nigeria Data Protection Act 2023.

Our lawful basis for handling registration details, and for the messages you send us through the contact form, is your consent (given when you tick the box on either form) together with the steps we need to take to arrange the classes you are asking for. You can withdraw that consent at any time by contacting us, and we will delete what we hold.

Where the student is a child (which is most of the time), the form is completed by a parent or guardian, and it is their consent we rely on.

Cookies and the bot check

This site sets no advertising or analytics cookies, and builds no profile of your visit.

The only cookie we set ourselves is the session cookie that keeps a member of academy staff signed in to the dashboard. It is never set for ordinary visitors.

Two forms carry one third-party component: the registration form (on the home page and at /register) and the form on the contact page. It is a Cloudflare Turnstile bot check, which stops automated submissions flooding the forms. To do that it sees your IP address and may store a short-lived value in your browser. It is there to protect the forms, not to track you, and it appears nowhere else on the site. We also pass your IP address to Upstash, our rate-limiting service, when you submit, for the same reason and nothing else.

Children

Most students here are children, and the registration form is completed by a parent or guardian rather than by the child. Photographs of students are published only where the academy holds the guardian's written consent.

Your choices

You can ask us what we hold about you or your child. You can also ask for your record to be deleted at any time before its 90 days are up, simply by contacting the academy, and we will delete it. Any paper copy the office printed is destroyed at the same time. The only trace left is an entry in our log saying that the record with your reference was deleted, when, and by which member of staff.

If something you sent is wrong, we correct it by deleting the record and asking you to fill in the form again, so the record only ever holds what you gave us.

Ask through any of the channels on our contact page, and quote the reference the form gave you if you still have it. It makes finding your record immediate rather than a search. If you do not have it, your name and the student's name are enough. We aim to answer within a week.