Privacy Policy

We apply the principle of data minimisation — collecting only what is strictly necessary. Categories of personal data we may collect:

We do not collect Sensitive Special Category data (health, ethnicity, religion, biometrics) unless explicitly provided with separate consent.

Under EU/UK GDPR, every act of processing must rest on a documented lawful basis. We rely on the following:

Your data is used solely for the following documented, legitimate purposes — never for any purpose incompatible with the original basis of collection:

• ✓ Processing and responding to enrolment enquiries and formal admission applications.
• ✓ Scheduling and coordinating free trial sessions and ongoing 1-on-1 academic classes.
• ✓ Sending transactional communications: class confirmations, scheduling updates, academic notices.
• ✓ Academic updates, new course announcements, and institutional news — only where prior consent has been given.
• ✓ Improving and maintaining website performance and security through anonymised analytics.
• ✓ Complying with legal obligations and responding to lawful requests from competent authorities.
• ✓ Processing referrals where a student nominates a friend, with both parties' knowledge.

We will never use your data for automated decision-making or profiling that produces legal or similarly significant effects without explicit consent.

We retain personal data only as long as necessary for its stated purpose or as required by law:

On expiry, data is securely and permanently deleted or irreversibly anonymised. You may request early deletion under the Right to Erasure (Section 9).

We use the following categories of cookies:

We do not use advertising, third-party tracking, or data-broker cookies. Manage preferences via your browser settings or by contacting us.

We engage only a minimal set of trusted processors. Where they handle personal data on our behalf, appropriate Data Processing Agreements (DPAs) are in place:

We do not embed advertising networks, social media trackers, data brokers, or affiliate marketing scripts.

As a global academy serving students across UK, USA, Canada, Australia, Europe, and beyond, data may be processed across jurisdictions. All cross-border transfers are protected by:

• ✓ Standard Contractual Clauses (SCCs): EU-approved clauses for all transfers to third countries without an adequacy decision.
• ✓ Adequacy Decisions: Where the European Commission recognises adequate protection in the destination country.
• ✓ Processor DPAs: Binding agreements with all processors confirming GDPR-equivalent standards.
• ✓ TLS 1.2+ Encryption: All transmissions encrypted regardless of destination jurisdiction.

We implement technical and organisational security measures proportionate to the risk:

In the unlikely event of a breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours (GDPR Art. 33–34).

We respond to all verified requests within 30 days (extendable to 3 months for complex cases, with notice):

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by CPRA grants you additional rights:

• ✓ Right to Know: Categories and specific pieces of personal information collected and from which sources.
• ✓ Right to Delete: Request deletion of personal information, subject to limited legal exceptions.
• ✓ Right to Opt-Out of Sale / Sharing: We do not sell or share your personal information for cross-context behavioural advertising.
• ✓ Right to Correct: Request correction of inaccurate personal information we maintain.
• ✓ Right to Limit Sensitive Data Use: Restrict use of sensitive personal information to purposes strictly necessary for service delivery.
• ✓ Right to Non-Discrimination: You will not receive discriminatory service or pricing for exercising CCPA rights.

Submit verified CCPA requests to info@kanzulilm.com with subject "CCPA Privacy Request". We respond within 45 calendar days.

Kanzulilm International welcomes students of all ages within a safe, supervised academic environment:

• ✓ For students under 13 (USA — COPPA) or under 16 (EU/UK — GDPR), verifiable parental or guardian consent is required before processing any personal data.
• ✓ All enrolment enquiries for minor students must be submitted by a parent or legal guardian.
• ✓ Children's data is handled with enhanced confidentiality and never used for marketing or profiling.
• ✓ Parents and guardians may access, correct, or request deletion of their child's data at any time via info@kanzulilm.com.
• ✓ If we discover data has been collected from a minor without appropriate consent, we will delete it promptly.

In the unlikely event of a personal data breach, our response protocol:

We take all privacy concerns seriously. If dissatisfied with our handling of your data:

• 1. Contact us first at info@kanzulilm.com — we will investigate and respond within 30 days.
• 2. If unresolved, lodge a complaint with your national Data Protection Authority:

This Policy is updated whenever material changes occur to our data practices, legal landscape, or third-party integrations. We notify you of significant changes by:

• ✓ Sending email notification to enrolled students and active enquirers where changes are material.
• ✓ Displaying a site-wide notice for 14 days following any substantive revision.

15. Contact Us & Data Protection Officer

For all privacy enquiries, Subject Access Requests, deletion requests, or concerns regarding this Policy, contact our designated privacy team:

Kanzulilm International · Est. 2009 · Serving the global Muslim community with authentic Islamic education.
This Policy was prepared in accordance with GDPR (EU) 2016/679, UK GDPR, CCPA (California Civil Code § 1798.100 et seq.), PIPEDA, the Australian Privacy Act 1988, and Pakistan's PDPA framework.