Privacy policy

This policy explains how Afaq Digital Ltd collects, uses and protects personal data when you use the Afaq Sites platform, whether you visit the platform's pages or hold an account for your center. We keep it in plain language. If you have any question, email us at info@afaq-digital.com.

01Who we are

The platform is run by Afaq Digital Ltd, a company registered in England and Wales under number 17555266, with its registered office at Office 22136, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.

• Your account, your center's account and your invoices: we are responsible for this data (the controller).
• Data about a center's own customers, such as parents, students and visitors to the center's site: the center is responsible for it, and we process it only on the center's behalf as its service provider, under our data processing agreement. Each center has its own privacy page on its site that explains this to its customers.

02What we collect

• Account details: name, email address, mobile number and center name. Your password is stored as a one-way hash that cannot be read, together with your two-step verification settings if you turn it on.
• Center content: what you add to your site and dashboard, such as text, images, files and operating data like groups, attendance and bookings.
• Billing details: your plan, invoices, amounts and a short reference to the payment method. You enter card details directly on the Stripe payment page; they never reach us and we do not store them.
• Usage and security records: IP address, browser and device type, sign-in times and important account actions such as signing in and changing settings. We use them to protect accounts and detect misuse.
• WhatsApp messages: when your center sends WhatsApp messages from the platform, we keep the recipient's number, the message type, its status and its time.
• Correspondence: what you send us by email or phone, and our replies.
• Visitor statistics: on the platform's public pages only (home, sign-up, pricing and cart), we measure how the pages are used with Live, our own analytics service, which runs on our server. It records your IP address and the approximate location (country and city) our server works out from it, the pages you view and for how long, the referring page, your browser, language, time zone and screen size, how far you scroll, and which outside links you click. To tell one visit from another, it keeps a random ID in your browser's local storage. We do not use these statistics for advertising, do not share them with anyone, and they never run on centers' sites.

03Why we use it and our legal basis

• Providing the service, running your account and billing: to perform our contract with you (UK GDPR Article 6(1)(b)).
• Keeping invoices and accounting records: to meet our legal obligations (Article 6(1)(c)).
• Security, fraud prevention and usage records: our legitimate interests in protecting the platform and our customers' accounts (Article 6(1)(f)).
• Visitor statistics: our legitimate interests in understanding and improving how our pages are used (Article 6(1)(f)). You can turn them off at any time in the box above.
• Service messages: such as email confirmations and billing and security alerts. They are part of the service and cannot be turned off while the account is open. We send marketing messages only if you agree to them.

We do not sell personal data, and we do not use it for automated decisions that affect you.

04Who receives it

We share data only with the service providers we need to run the platform, each of whom is bound to protect it:

• Contabo GmbH: hosts our servers in the European Union.
• Stripe: processes payments.
• Meta (WhatsApp): delivers the WhatsApp messages a center sends, through our own sending service.
• Anthropic: runs the AI assistant on sites whose owners turn it on; it receives only the questions typed in the chat.
• Afaq Digital's email: we send system emails, such as verification codes and invoices, from the company's own email. The provider of that email is named in the privacy policy on the company's website.

We may also disclose data if the law requires it, or to protect our rights in a legal claim.

05International transfers

Our servers are in the EU, which the UK recognises as providing adequate protection. Some of the providers above may process data in other countries, including the United States. In those cases, the transfer relies on the UK Extension to the EU-US Data Privacy Framework or on the contractual clauses approved for transfers from the UK.

06How long we keep it

07Your rights

You can ask for a copy of your data, or ask us to correct it, delete it, restrict or object to its use, or transfer it to someone else in a machine-readable format. Where we rely on your consent, you can withdraw it at any time. Send your request to info@afaq-digital.com and we will reply within 30 days. We may ask you to prove your identity first. The details of deletion are on our data deletion page.

If you are a customer of a center and your question is about data the center entered, please contact the center first, as it is responsible for that data. We will help the center act on your request.

If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority in your country. We would appreciate the chance to put things right first, so please contact us.

08How we protect it

All platform pages use an encrypted connection (HTTPS). Passwords are stored as one-way hashes, two-step verification is available, each center's data is kept apart from the others, staff access is limited to what each role needs, and we take a backup every day. No protection is perfect, but if a breach affects your data we will tell you, and the relevant authority, as the law requires.

09Children

Platform accounts are for people aged 18 or over. A center may enter details of students under that age; in that case the center is responsible for getting a parent's consent where it is needed.

10Changes to this policy

We may update this policy from time to time and show the date of the last update at the top of the page. If a change is significant, we will email account owners before it takes effect.