Privacy policy

1. Who we are

Riwaq is operated by AML SOLUTIONS LTD, company number 17075113, registered in England and Wales. Our registered office is 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. Contact us at contact@riwaq.uk or by post at that address for privacy questions. This policy covers our public website, accounts and service where it is linked. Our data processing agreement explains how we handle customer-controlled records.

For our website, customer accounts, subscriptions, support and our own business records, AML SOLUTIONS LTD is the data controller. Each subscribing madrasa or school normally controls the pupil, parent, staff and safeguarding information it collects through Riwaq. We process that information on its instructions. That organisation should provide its own privacy information and decide its lawful bases, special-category conditions and any additional retention duties.

2. Information we handle

We handle account holders’ names, contact and organisation details, login and security records, enquiries, support communications, plan and transaction information, and limited use of our public website. A customer may use Riwaq for pupil and family registrations, addresses, emergency contacts, attendance, lessons, progress, payments, messages, medical and learning needs, behaviour, and safeguarding records. Some of this can be sensitive information about children, health or religion. Safeguarding records may contain allegations or criminal-offence information. Support records can include pictures you upload, replies, request status and notification records. Share only information needed to explain a request and avoid unnecessary pupil or safeguarding details.

We also handle technical and security information such as IP address, browser and device information, sign-in times and session records. An approximate country can select a regional page; we do not ask for precise device location. Payment credentials are collected through the payment provider’s form; Riwaq uses payment references, status and limited payment-method details to administer billing.

Information comes from you, your madrasa or school, an authorised member of staff, a parent or guardian, and service providers that return payment or delivery status. A parent may provide an emergency contact’s details. Customers should explain that collection to those contacts where required.

3. Why we use it and our lawful bases

• To provide accounts, the service, subscriptions and support: performance of our contract with the customer, or legitimate interests where an individual is acting for the customer.
• To answer enquiries, prevent misuse, protect accounts and improve the public website: our legitimate interests, balanced against individuals’ rights.
• To keep accounting and other records required by law and respond to legal requests: legal obligation.

The customer is responsible for selecting and communicating the lawful basis for its pupil, parent and staff records, including a separate Article 9 condition where special-category information is used. Riwaq does not use those records for its own advertising or sell them. We do not share personal information for cross-context behavioural advertising or use customer records for general-purpose AI model training. Required account and billing details are needed to provide the relevant service. Optional support attachments should be limited to what is necessary. Choosing not to provide required information may prevent us from completing the requested account, payment or support action.

4. Who can receive information

Authorised users of the relevant customer can access information according to their roles. Restricted Riwaq support access is logged. We use third-party service providers for website and application hosting, data storage, account authentication and security, payment processing, email and SMS delivery, and public website statistics. A payment provider may act as an independent controller for its own transaction records and provide its own privacy notice. We may disclose information where required by law or needed to protect people. Professional advisers may receive information where necessary for legal, accounting or insurance work and subject to confidentiality. In a genuine business transfer, relevant information may be shared subject to lawful safeguards and continued protection; a change of ownership does not authorise unrelated use of school records.

Private Help & Support conversations and pictures are available to the requester and authorised Riwaq staff. They are not included in a school-wide export. A school’s ordinary user permissions do not grant access to another person’s private Riwaq support conversation.

Providers may process information outside the UK. Where a restricted transfer occurs, we use a lawful transfer mechanism and appropriate safeguards. For clarification or details of our current third-party providers, their roles, processing locations and transfer safeguards, email contact@riwaq.uk.

5. Retention and customer departure

During an active subscription, we keep customer data to provide Riwaq, subject to the customer’s instructions and applicable law. When the subscription ends, we email a private link to a CSV export to the verified administrator who set up the account. Download and check it within 30 days. Our daily retention process erases pupil and parent operational records, including attachments, attendance, reports, messages and safeguarding records, after 30 days from the subscription ending, and other operational customer records after one year. If export delivery is delayed, we allow a full 30-day download window before erasure. We temporarily delay erasure to resolve an undelivered export, unclear ownership, an unresolved payment or a documented legal hold. Exclusive logins are removed; logins still used by another customer are preserved. Personal details are removed from retained payment records.

We return customer-controlled records to the customer through the export process. The customer must download, verify and securely keep or transfer records that its own legal, educational or safeguarding duties require. Registered schools can have longer duties for pupil, attendance and child-protection records. We retain only information we need for our own legal obligations, an unresolved payment, claim or documented legal hold; access to such records is restricted and they are erased when the reason ends. Our own company accounting records are generally retained for six years after the end of the relevant financial year. Backup copies are put beyond routine use and removed on their normal expiry cycle.

For introductory-offer eligibility checks, we retain an email fingerprint and its claim date after account or subscription deletion for as long as we offer introductory offers. This limited record does not contain your email address, password or pupil records. It is used only to check introductory-offer eligibility.

Direct Riwaq support records are kept while needed to investigate and resolve the request, maintain a necessary support history, protect accounts or address a legal claim. Access is restricted. Email us about deletion or the retention applicable to a particular request; a school-wide export does not include these private conversations.

Unfinished registration forms that have not begun payment are deleted after 30 days. Forms linked to a payment attempt are held until the payment outcome is resolved. Payment providers and other independent controllers apply their own retention rules to records they hold.

6. Security and website statistics

We use access controls, organisation-scoped checks, restricted support access and audit records. Our public website uses a third-party statistics service only for public marketing pages. Private portal paths, identifiers, query strings and payment return details are excluded. You can turn site statistics off or on using the control in the footer. Essential account and security storage remains necessary for the service. Read our cookie notice for the technologies, purposes, duration and controls. No internet service can guarantee absolute security.

7. Your rights and complaints

Depending on the circumstances, you may request access, correction, deletion, restriction, objection or data portability. Where consent is used, you may withdraw it. Email contact@riwaq.uk. For pupil or parent records controlled by a madrasa or school, contact that organisation first; we will assist it. We may verify identity and explain any lawful reason why a request cannot be met in full.

Where UK or EU data protection law applies, we normally respond to rights requests within one month, and will explain any lawful extension or refusal. You may also complain to the supervisory authority where you live, work or consider an infringement occurred. We do not use your privacy choice as permission for a new purpose.

You can complain to the Information Commissioner’s Office. You can also read our customer terms.

8. Children and education records

Riwaq supports records about children; its accounts and portals are intended for authorised staff, parents and guardians. The school controls educational and safeguarding records and must explain its collection, uses and retention to families and identify any required permission. Contact the school for those records or contact us if you believe a child’s information has been provided unlawfully. We will coordinate with the school and meet duties that apply directly to us. We do not use children’s records for our own targeted advertising.

9. Other sites and services

External links and payment-provider pages may have their own privacy notices. Read those notices before submitting information. Our duties for providers processing personal data on our behalf remain set out in the DPA.

10. Changes

We will update this page when our practices change and give notice of material changes where appropriate.