Ibdaa Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the Tawaasal platform.

1. Data Controller

Ibdaa Ltd is the data controller for personal data processed through the billing and marketing site. For school-specific data processed within the main application, the school is the data controller and Tawaasal acts as a data processor under a Data Processing Agreement.

2. Data We Collect

Account Data

• Full name, email address, phone number
• Organisation name and country
• Language and theme preferences

Billing Data

• Subscription plan and billing period
• Payment history (processed by Stripe — we do not store card numbers)
• School registrations and provisioning status

Usage Data

• Login timestamps and IP addresses
• Browser type and operating system
• Pages visited and features used

Consent Records

• Records of your acceptance of our Terms of Service, including version, timestamp, and IP address

3. How We Use Your Data

• To provide and maintain the Service
• To process payments and manage subscriptions
• To communicate with you about your account and the Service
• To comply with legal obligations
• To detect and prevent fraud and abuse
• To improve the Service (using aggregated, anonymised data)

4. Legal Basis for Processing

We process your data on the following legal bases under UK GDPR:

• Contract: Processing necessary to provide the Service you have subscribed to.
• Consent: Where you have given explicit consent (e.g., marketing communications, cookie preferences).
• Legitimate Interest: For fraud prevention, security, and service improvement.
• Legal Obligation: To comply with applicable laws and regulations.

5. Data Sharing

We do not sell your personal data. We may share data with:

• Stripe / PayPal: For payment processing
• Cloud infrastructure providers: For hosting and data storage
• Advertising platforms (Google Ads and Meta): Where you have given marketing consent, we share conversion measurement data with Google and Meta — including ad click identifiers and a one-way hashed (irreversible) version of your email address used only for conversion matching. This is sent server-to-server when an order is confirmed so we can measure the effectiveness of our advertising. We never share your raw email address or other contact details with these platforms, and none of this happens without your marketing consent (which you can withdraw at any time).
• Law enforcement: When required by law

All third-party processors are bound by data processing agreements.

6. Data Retention

• Account data: Retained for the duration of your account plus 6 years.
• Billing records: Retained for 7 years as required by financial regulations.
• Consent records: Retained for the duration of the customer relationship plus 6 years.
• Usage logs: Retained for 90 days, then anonymised.

7. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Portability: Receive your data in a machine-readable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interest.

To exercise these rights, visit our Data Rights page or email [email protected].

8. Cookies

We use cookies to provide essential functionality and, with your consent, for analytics and marketing. See our Cookie Policy.

9. Security

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication for admin accounts
• Regular security audits and penetration testing
• Automated daily backups with geo-redundancy

10. International Transfers

Your data may be processed in the United Kingdom and European Economic Area. Any transfers outside these regions are protected by Standard Contractual Clauses.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email.

12. Contact Us

• Data Protection: [email protected]
• General: [email protected]
• Address: Ibdaa Ltd, 128 City Road, London, EC1V 2NX, United Kingdom

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.