1Who we are
Madinah College Portal (“the Portal”, “we”, “us”) is the online learning platform operated by Madinah College. This policy covers mclportal.com and every page and lesson behind a Portal login.
We are the data controller for the personal information described here. For any question about this policy, or to exercise any of the rights set out below, email info@madinahcollege.uk and mark your message “Data protection”. If you need our postal details for a formal request, ask and we will provide them.
2What we collect
We only collect what the Portal needs in order to run. That falls into four groups.
Information you give us
- Your name and email address, when you register.
- A password, which we store only as a one-way hash — never as readable text. Accounts migrated from the old WordPress site keep their existing hash until the first successful sign-in, at which point it is replaced and the old one deleted.
- Anything you write into the Portal: lesson notes, answers submitted for an Alimiyyah exam, and messages you send us for support.
Information about your membership
- Which plan you are on, when the current period started and ends, whether you are in a free trial, and your renewal date.
- A record of each payment and each attempted payment, including the amount, currency, date and outcome.
- An identifier issued by Stripe that links your account to your customer record with them. We never receive or store your full card number, expiry date or security code.
Information about your studying
- Which courses and lessons you have opened, and where you left off in each one.
- Notes you keep private, and notes you choose to share with other students on a lesson. Shared notes are visible to other members alongside the name on your account.
- Exam requests, marks and certificates.
Information we collect automatically
- Standard server log data: IP address, browser and device type, the pages requested and when. Logs let us keep the Portal secure and diagnose faults.
- A session cookie that keeps you signed in. It is essential to the Portal working and cannot be turned off while you are logged in.
3Why we use it, and our lawful basis
Under UK GDPR every use of your information needs a lawful basis. Ours are these:
- To give you the Portal — your account, your courses, your progress and your notes. Basis: performance of our contract with you.
- To take payment, manage renewals, apply trials and discounts, and retry a failed payment. Basis: performance of our contract with you.
- To email you about your account: receipts, renewal reminders, failed payments, password resets, exam results. Basis: performance of our contract with you.
- To keep the Portal secure, prevent abuse of accounts and shared credentials, and fix faults. Basis: our legitimate interests.
- To keep financial and tax records. Basis: our legal obligations.
- To send you news about new courses and offers, where you have asked for it. Basis: your consent, withdrawable at any time from the link in every such email.
We do not sell your personal information, and we do not use it for advertising profiling.
5How long we keep it
- Your account, notes and progress: for as long as your account exists. Close your account and we delete or anonymise them, except where a point below applies.
- Payment and invoice records: six years after the transaction, as UK tax law requires.
- Exam papers, marks and certificate records: kept while a certificate remains verifiable, so that we can confirm it if you or an institution asks.
- Server logs: normally no more than 12 months.
- Notes you chose to share with other students: these stay on the lesson unless you delete them, or ask us to.
6Your rights
You can ask us at any time to:
- give you a copy of the personal information we hold about you;
- correct anything inaccurate;
- delete your information, where we have no continuing reason to keep it;
- restrict or object to a particular use;
- send your information to you, or to another provider, in a portable format;
- stop sending you marketing email.
Email info@madinahcollege.uk and we will respond within one month. There is no charge. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.
7Security and international transfers
Passwords are stored only as hashes, traffic to the Portal is encrypted in transit, and access to production data is limited to the people who need it to run the service. No online service can promise absolute security, but we take these measures seriously and review them.
Some of our providers, including Stripe and our video hosts, process data outside the UK. Where they do, the transfer relies on the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.
8Children
Some courses are suitable for children, but a Portal account is for adults. If you are under 16, a parent or guardian should hold the account and supervise its use. If we learn that a child holds an account without that consent, we will remove it.
9Changes to this policy
We update this policy when the Portal changes. The date at the top always shows the current version. If a change materially affects how we use your information we will tell you by email before it takes effect. Questions to info@madinahcollege.uk.