Effective 18 October 2026 · Template written for UK GDPR, the ICO Children’s Code (Age Appropriate Design Code) and EU GDPR children’s data. The owner should review it before launch.

Privacy Policy

[COMPANY-LEGAL-NAME] (company number [COMPANY-NUMBER]) of High Rd, Buckhurst Hill, Essex, IG9 5HT is the controller of personal data described here. Write to hello@noorharf.com or WhatsApp +447832621244.

Children and parental consent

We teach children through a parent account. We do not offer an account to a child acting alone. For children under 13 in the United Kingdom we rely on a parent or guardian’s consent (and that parent stays nearby during class). For children under 16 in the European Union we rely on a parent or guardian’s consent, as required by EU GDPR. The trial form asks for the child’s first name, age and course so we can place the class. We do not use children’s data for advertising, profiling for marketing, or sale to third parties.

What we collect from children, and why

• First name, age, course, level, preferred teacher gender and class times — to run the lesson and match a teacher.
• Join and leave times, progress notes and parent notes — to teach, safeguard and keep a record of the class.
• We do not ask children for a phone number, email or WhatsApp. Teachers never see parent phone, email or WhatsApp.

What we collect from parents and teachers

• Trial and contact forms: name, email, WhatsApp, country, timezone, children’s first names and ages, course choices, preferred days and how you heard about us.
• Portal accounts: parent and teacher names, emails, timezones, student first names, ages, course and level, class times stored in UTC.
• Payments: invoice number, amount, currency, PayPal order id or Wise reference, status.
• Reviews you submit, until you ask us to delete them.

Lawful basis

• Contract — to provide the trial, the class and the parent portal you asked for.
• Consent — parental consent for children’s data as set out above, and optional gifts or reviews.
• Legitimate interests — academy operations, teacher pay, and a limited record of classes, balanced against the child’s interests under the Children’s Code.
• Legal obligation — tax, safeguarding referrals and records we must keep.

Retention

We keep class logs and notes while the student is enrolled and then for as long as payroll, safeguarding or tax law requires, then delete or anonymise them. Payment records are kept for the period required for accounts. Trial leads that do not enrol are reviewed and deleted when they are no longer needed to reply to you. You can ask us to delete data sooner where the law allows.

Class recording policy

Join times may be logged. Classes may be reviewed for quality and safeguarding. We do not send families a downloadable recording as part of the normal class. Video is provided by the configured provider (Jitsi, Daily or Zoom Video SDK) so that provider may process a live stream. See Processors below.

Processors

These organisations only receive what they need to run the class or the payment:

• PayPal — card and PayPal checkout.
• Wise — bank-transfer invoices.
• Video provider — Jitsi, Daily or Zoom Video SDK, as set by the owner.
• Hosting — the owner’s Hostinger account that serves this website and database.

International transfers

Some processors are outside the UK. Where that happens we rely on the transfer tools those processors publish (for example standard contractual clauses) or a UK adequacy decision. A live class may be taught by a teacher in another country; the parent chooses that arrangement when they book.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction, or to object. A parent may exercise these rights for their child. Email hello@noorharf.com. You also have the right to complain to the Information Commissioner’s Office (ICO) in the UK, or to your local EU supervisory authority if you live in the EEA.