·
DA
Dette dokument vises på engelsk. En godkendt dansk version foreligger endnu ikke
Published:
Sunnah Remedies is a trading name of HOUSE OF SUNNAH REMEDIES LIMITED, a company registered in England and Wales with company number 17472667. Our registered office is 2 Frederick Street, London, WC1X 0ND, United Kingdom.
HOUSE OF SUNNAH REMEDIES LIMITED is the controller responsible for the personal information described in this notice. You can contact us at support@sunnahremedies.co.uk or write to our registered office, marked for the attention of the Privacy Team.
This notice explains how we use personal information in connection with the Sunnah Remedies website, enquiries, applications and expressions of interest, email subscriptions, Academy programme applications and payments, and related complaints.
Online purchasing and appointment booking are not currently available through this website, except for the application deposit for the Aarhus Hijama Practitioner Programme described below. Before introducing other activities that involve different uses of personal information, we will provide the relevant privacy information.
We collect the information you give us when you contact us, complete an available form, apply or express interest in an educational activity, subscribe to emails or raise a complaint. Depending on your request, this includes your name, email address, other contact details you choose to provide, your message and relevant application information.
For email subscriptions, we keep the email address, subscription status, confirmation and unsubscribe records, and evidence of when and how consent was given or withdrawn. Email delivery services also provide delivery, bounce and complaint information needed to manage our communications.
Our hosting and security systems process technical information needed to serve and protect the website, such as IP addresses, request information, timestamps and diagnostic records.
If you consent to analytics, Google Analytics 4 collects information about website usage, including pages visited, interactions, approximate location, browser and device information, and identifiers used to distinguish visits. We do not load Google Analytics or send analytics measurements to Google before you consent.
The information described above comes from you, your browser or device, and the service providers involved in delivering the website and our communications.
When you apply for an Academy programme, we may collect and use the information you provide in the application form, including your name, email address, phone number, country, city, gender (if you choose to provide it), occupation, prior relevant experience, Islamic studies background, application answers, acknowledgements and consent choices.
We use this information to receive and review your application, arrange or manage an interview, assess suitability for the programme, communicate with you about your application, manage admissions decisions, process payments, keep appropriate records and protect the integrity and safety of the programme.
Application deposits and course payments are processed through Stripe. We do not store your full card details. Stripe may process your payment information in accordance with its own terms and privacy information.
We may store payment-related records such as the Stripe checkout session ID, payment intent ID, payment status, payment amount, currency, refund status and related webhook event records.
We may keep records of your application status, interview status, admissions decision, balance due, balance paid status and related administration notes. These records are used to manage the admissions process and programme administration.
| Purpose | Legal basis |
|---|---|
| Responding to general enquiries and correspondence | Our legitimate interests in communicating with people who contact us and administering our activities |
| Considering an application or expression of interest, including an Academy programme application | Taking steps at your request before entering into a contract, where that basis applies; otherwise our legitimate interests in administering and responding to your request |
| Processing application deposits and related payment records through Stripe | Taking steps at your request before entering into a contract, and our legitimate interests in receiving payment and keeping finance records; compliance with a legal obligation where applicable |
| Sending marketing emails you have requested | Your consent |
| Analysing website use through optional analytics | Your consent |
| Operating, securing and troubleshooting the website | Our legitimate interests in providing a reliable service, detecting misuse and protecting information |
| Recording privacy choices and managing opt-outs | Compliance with applicable data protection and electronic communications obligations, and our legitimate interests in maintaining reliable records and preventing unwanted communications |
| Handling privacy rights requests and data protection complaints | Compliance with our legal obligations |
| Handling accessibility requests and complaints | Compliance with applicable equality and accessibility obligations, and our legitimate interests in helping people use our website |
| Establishing, exercising or defending legal claims | Our legitimate interests in protecting our legal rights, and compliance with a legal obligation where applicable |
Where we rely on legitimate interests, we consider the need for the processing and its impact on your rights and interests. Where a legal obligation applies, it includes relevant duties under data protection, electronic communications, equality or accessibility law and binding legal requirements.
Providing information is voluntary. However, we may be unable to respond to an enquiry or consider an application if information reasonably needed for that purpose is missing.
Submitting an enquiry or application does not automatically subscribe you to marketing. We send marketing emails only where you have opted in.
If you choose to receive updates about a programme or related Academy announcements, we will use your contact details for that purpose. You can withdraw marketing consent at any time.
You can unsubscribe using the link in our emails or by contacting support@sunnahremedies.co.uk. We stop further marketing when you withdraw consent, although a message already transmitted may still arrive.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We may retain a minimal suppression record to respect your decision not to receive marketing.
Please do not include medical records, detailed health information or other sensitive personal information in general enquiries or expressions of interest. For an accessibility request, tell us about the adjustment or format you need; you do not need to provide a diagnosis or medical records.
The application form should not be used to send medical information. Where free-text fields are provided, applicants are asked not to include medical information. If you choose to provide information that appears to be special category data, we will only use it where necessary for reviewing your application, programme safety, legal obligations or another lawful basis that applies.
If sensitive information is needed for a particular purpose, we will explain why, provide an appropriate collection route and identify the relevant legal basis and additional condition required by data protection law before collecting it for that purpose.
We use specialist service providers to operate our website and communications. These include Vercel for website hosting, Neon for database services, Resend for email delivery and subscription management, Stripe for payment processing, and Google for Google Analytics 4. Our business email service also processes messages you send to us and our replies.
Google Analytics 4 receives analytics information only after you consent to analytics. Hosting providers process technical request information needed to operate the site. Database and email providers process relevant enquiry, subscription, consent and communication records where those functions use their services. Payment processing is handled by Stripe.
Service providers receive information needed for their functions. Where they process personal information on our behalf, we require appropriate contractual protections, security measures and restrictions on its use. Where a recipient acts as an independent controller for a separate purpose, its own privacy information explains that processing.
We may share limited information with service providers who help operate the website, payment processing, email delivery, database hosting, analytics where consent applies, legal/compliance support and programme administration.
We may disclose relevant information to professional advisers, regulators, courts or public authorities where necessary and lawful, including to obtain advice, meet a legal obligation or establish, exercise or defend legal claims.
We do not sell your personal information.
Some of our service providers process personal information outside the United Kingdom or the European Economic Area, including in the United States.
Where a transfer is subject to UK or EU international-transfer rules, we ensure that an applicable legal transfer mechanism is in place. This may be an adequacy decision or adequacy regulations covering the destination and recipient, or approved contractual safeguards.
For UK transfers, contractual safeguards may include the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. For transfers subject to EU law, we use the applicable EU safeguards. Where we rely on contractual safeguards, we assess the protection available in the destination and implement additional measures where necessary.
We rely on the EU-US Data Privacy Framework or its UK Extension only where the recipient's current participation covers the relevant transfer.
Contact support@sunnahremedies.co.uk for information about the safeguards relevant to your personal information and how to obtain a copy, subject to appropriate protection of confidential information.
We keep personal information only for as long as reasonably necessary for its purpose, using the following retention periods. We delete information sooner where it is no longer needed.
| Information | Retention period |
|---|---|
| General enquiries | Up to 12 months after the enquiry closes |
| Unsuccessful or withdrawn Academy applications | Up to 6 months after the decision or withdrawal |
| Course expressions of interest | Until the relevant intake closes or 12 months after the last substantive contact, whichever occurs first |
| Unconfirmed newsletter requests | Confirmation expires after 7 days; the pending record is deleted within the following 24 hours |
| Active newsletter details | While the subscription remains active, with annual review of continued necessity |
| Evidence of marketing consent and withdrawal | Up to 3 years after the last marketing communication or withdrawal, whichever is later |
| Marketing suppression records | The minimum information necessary for as long as needed to prevent unwanted marketing, with annual review |
| Routine website security and diagnostic logs under our control | Up to 30 days, unless selected records are needed for an identified incident |
| Routine privacy and accessibility complaint records | Up to 3 years after closure, with unnecessary sensitive details removed sooner |
| GA4 user-level and event-level data | A two-month retention setting, followed by Google's scheduled deletion process |
| Backup copies under our control | A rolling expiry of no more than 90 days |
Application and payment records for Academy programmes, including the Aarhus Hijama Practitioner Programme, are kept only for as long as needed for admissions, finance, legal, tax, dispute handling, safeguarding, compliance and legitimate business record purposes.
Where particular records are necessary for an unresolved complaint, investigation, legal obligation or legal claim, we retain only the relevant information for the necessary period and restrict its use.
The Google Analytics retention setting does not apply to standard aggregated reports. Information that has been genuinely anonymised and can no longer identify anyone may be retained for statistical purposes.
Deleted information may remain temporarily in restricted backup copies until those backups expire. Backups are not used for routine business purposes. If a backup is restored, relevant deletion and suppression instructions are reapplied.
We use appropriate technical and organisational measures to protect personal information and limit access to people and service providers who need it for their responsibilities. No method of transmission or storage can be guaranteed completely secure.
Depending on the circumstances and the applicable law, you may have rights to access your personal information, correct it, request its deletion, restrict its use or receive a portable copy.
You may object to processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing.
Where we rely on consent, you may withdraw it at any time. You can change analytics consent using Cookie settings and withdraw marketing consent using an unsubscribe link or by contacting us.
To exercise a right, email support@sunnahremedies.co.uk. We may request proportionate information needed to verify your identity. We respond within the time limits required by applicable law, normally within one month. If a lawful extension applies, we will explain it.
We do not make decisions about applications that produce legal or similarly significant effects based solely on automated processing.
To complain about our handling of your personal information, email support@sunnahremedies.co.uk or write to our registered office. You do not need to use a particular subject line or form for us to consider a data protection complaint.
We will acknowledge a data protection complaint within 30 days of receiving it. We will investigate without undue delay, keep you appropriately informed and communicate the outcome without undue delay.
You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint. Where EU data protection law applies, you may also complain to the relevant supervisory authority, including the authority where you habitually live or work or where the alleged infringement occurred. In Denmark, this is Datatilsynet: https://www.datatilsynet.dk/english/file-a-complaint.
We may update this notice to reflect changes to our activities or applicable requirements. We will publish the updated notice with its revision date and provide further information or seek fresh consent where required before introducing a new use of information.