Privacy policy

This policy explains how Shajara Pathways (“we”, “us”) collects, uses and protects personal information when you use our website, enquire about or join our programmes, or contact us. We handle personal information, and particularly information about children, carefully and in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Who we are

Shajara Pathways is run by Taslima Sheikh, and is the data controller for the personal information described in this policy.

You can contact us about anything in this policy at connect@shajarapathways.com.

Information we collect

When you send an enquiry or apply, we collect:

• The student’s name, age, year group, school or college, and city or region
• A parent or guardian’s name, and an email address and phone number
• The student’s GCSE and A-level subjects and grades (predicted or achieved), the course and universities they are considering, and their application stage
• The support they are looking for, any support they already receive, and how they heard about us (including the name of anyone who referred them)
• Anything else you choose to tell us

To assess eligibility for funded places, we ask about the student’s circumstances: eligibility for free school meals, whether the household receives means-tested benefits, whether they would be the first generation in their family to go to university, the type of school they attend, and anything else they want us to consider. You can answer “Prefer not to say”. If we offer a funded place, we may ask for supporting evidence.

When a student joins a programme, we ask the student and a parent or guardian to complete an onboarding form with further details we need to deliver the programme safely, including consents. If you choose to tell us about a student’s health or additional learning needs, we use that information only to support the student, and only with your explicit consent.

During our programmes, we keep notes about a student’s goals, progress and the support we have provided. We do not record sessions without consent.

When a school or organisation contacts us, we collect the contact person’s name, role, organisation, email address and phone number, and details of what they are interested in.

When you pay, payment is handled by Stripe. We receive confirmation of the payment and your name and email address, but we never see or store your full card details.

We do not ask about religion. However, as our programmes are built around the experiences of Muslim students, the fact that a student has contacted us may suggest their religious beliefs. We treat all the information we hold with particular care for this reason.

How we use your information and our lawful basis

Purpose	Lawful basis
Responding to enquiries and arranging an initial conversation	Taking steps at your request before entering into a contract
Assessing eligibility for funded places	Taking steps at your request before entering into a contract, and legitimate interests in widening access
Delivering mentoring, the Access Programme and workshops, including matching students with mentors	Performance of a contract
Keeping parents and guardians informed	Performance of a contract and legitimate interests
Taking payments and keeping financial records	Performance of a contract and legal obligation
Responding to schools, organisations and general enquiries	Legitimate interests
Safeguarding students	Legal obligation and legitimate interests
Health or additional needs information you choose to share	Explicit consent, which you can withdraw at any time

We do not send newsletters or marketing emails. If that changes, we will only contact you with your consent.

Children’s information

Many of the students we work with are under 18. We ask that students under 16 complete our forms with a parent or guardian, and we always ask for a parent or guardian’s contact details. Parents and guardians of students under 18 are included in communication about their child’s programme. We only collect the information we need to deliver our programmes safely and effectively.

Who we share information with

We do not sell personal information. We share it only where necessary:

• Mentors who are matched with a student see the information they need to mentor that student. Every mentor agrees to our safeguarding requirements and code of conduct.
• Service providers who help us run Shajara Pathways:
  • Google, which provides our online forms (Google Forms) and stores responses (Google Sheets)
  • Stripe, which processes payments
  • Our email provider, for email
  • Zoom and Google Meet, for online sessions
  • WhatsApp, for group messages that include a parent or guardian
  • Cloudflare, which hosts this website

We may also share information where the law requires it or to protect a child’s safety, for example with children’s services or the police.

Some of these providers may process information outside the UK. Where they do, we rely on the safeguards required by UK law, such as adequacy regulations or standard contractual clauses.

How long we keep information

• Enquiries that do not go ahead: 6 months after we last hear from you
• Student and parent records, including onboarding details, progress notes and any evidence for a funded place: 1 year after the student’s programme ends
• Financial records, such as payments and invoices: 6 years, as HMRC requires
• Safeguarding records: if a safeguarding concern is ever recorded, we keep it for longer, in line with safeguarding guidance

After these periods, we securely delete the information.

Keeping information secure

We limit access to personal information to the people who need it, use reputable service providers, and protect our accounts with strong passwords and two-factor authentication. Mentors only see information about the students they work with.

Your rights

Under UK data protection law, you have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct information that is inaccurate or incomplete
• Ask us to delete your information
• Ask us to restrict or stop using your information in certain circumstances
• Object to us using your information based on legitimate interests
• Ask for your information to be transferred to another organisation
• Withdraw consent at any time, where we rely on consent

Parents and guardians can usually exercise these rights on behalf of younger children. Children who are mature enough to understand their rights can also exercise them themselves.

To make a request, email connect@shajarapathways.com. We will respond within one month.

Cookies

This website does not use advertising or analytics cookies. Our forms are embedded from Google Forms, and Google may set cookies needed for the form to work. See Google’s privacy policy.

Complaints

If you have a concern about how we handle personal information, please contact us first and we will do our best to help. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated.