Privacy Policy

Who we are

Tarteel House (“Tarteel House”, “we”, “our”, or “us”) provides online one-to-one Qur’an learning sessions for children.

For the purposes of data protection law, the data controller is:

If you have any questions about this Privacy Policy or how we handle personal data, please contact us using the details above.

Who this policy applies to

This Privacy Policy applies to:

• parents, guardians, and other adults who contact us, book a trial, or purchase lessons;
• children whose lessons are booked and managed by a parent or guardian;
• visitors to our website;
• teachers, tutors, and applicants where relevant.

Our service is intended to be arranged by a parent or legal guardian. We ask adults to provide child information only where they are authorised to do so.

The personal data we collect

Depending on how you use our website and services, we may collect:

a. Information you provide directly

• parent or guardian name;
• child’s first name;
• child’s age or age range;
• child’s current Qur’an level or learning stage;
• preferred teaching language;
• teacher preference, where offered;
• country and city / region;
• email address;
• WhatsApp number or phone number;
• scheduling preferences;
• messages you send us;
• booking details and customer support communications.

b. Lesson and service information

• session dates and times;
• attendance and rescheduling information;
• teacher notes, progress summaries, and parent check-in information;
• service history and purchased bundle information.

c. Payment information

If you make a payment, payment processing is handled by third-party payment providers. We do not store your full card details on our own servers.

d. Technical and website usage information

• IP address;
• browser type and device information;
• pages visited and basic site usage data;
• cookie and consent preferences.

How we use personal data

We use personal data to:

• respond to enquiries and trial requests;
• arrange and deliver trial sessions and ongoing lessons;
• match families with a suitable teacher;
• communicate about bookings, scheduling, rescheduling, and support;
• take payment and maintain transaction records;
• provide progress updates and parent check-ins;
• improve our website, service quality, and operations;
• keep our website secure and prevent misuse;
• comply with legal, tax, accounting, and regulatory obligations;
• establish, exercise, or defend legal claims where necessary.

Our legal bases

We process personal data on one or more of the following legal bases:

a. Steps before a contract and performance of a contract

Where a parent or guardian requests a trial, purchases a bundle, books lessons, or communicates with us about the service, we process relevant personal data to take steps at their request and to provide the service.

b. Legitimate interests

We may process certain data where necessary for our legitimate interests, including:

• operating and improving our services;
• matching families with teachers;
• maintaining service records;
• securing our website and systems;
• handling customer support;
• preventing fraud or misuse;
• keeping internal administrative records.

Where we rely on legitimate interests, we consider the impact on the individual, especially where a child is involved.

c. Consent

We may rely on consent for specific activities, such as:

• non-essential cookies or analytics;
• optional marketing communications, if offered;
• any other optional processing where consent is appropriate.

You can withdraw consent at any time, but this does not affect processing already carried out lawfully before withdrawal.

d. Legal obligations

We may process and retain certain data where necessary to comply with legal obligations, including tax, accounting, and record-keeping requirements.

Children’s data

We provide lessons for children, but bookings and account-level decisions are intended to be made by a parent or legal guardian.

We only ask for child information that is reasonably necessary to arrange and deliver the service, such as first name, age, level, language, scheduling details, and lesson-related notes.

We ask parents and guardians not to send more sensitive child information than is necessary. If you believe a child has provided personal data to us directly without appropriate adult involvement, please contact us and we will review the matter.

Lessons are not recorded by Tarteel House by default. If recording or use of lesson media is ever proposed, the purpose and required permissions will be explained in advance.

YouTube video players load only after you choose to play a video, and the site uses YouTube’s privacy-enhanced embed domain.

Who we share data with

We may share personal data with trusted service providers where necessary to operate Tarteel House, such as:

• website hosting providers;
• email and communications providers;
• payment processors;
• scheduling and calendar tools;
• video lesson platforms;
• analytics providers, if enabled;
• cloud storage or admin tools;
• professional advisers such as accountants, lawyers, or insurers;
• public authorities, regulators, courts, or law enforcement where required by law.

We require service providers to process personal data only on appropriate instructions and with suitable safeguards where required.

International transfers

Some of our service providers may process personal data outside the European Economic Area or the UK.

Where we transfer personal data internationally, we take steps intended to ensure an appropriate level of protection, such as relying on adequacy decisions or appropriate contractual safeguards where required.

If you would like more information about relevant safeguards, please contact us.

Data retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the service, maintain records, resolve disputes, enforce agreements, and comply with legal obligations.

As a general guide:

• enquiry and trial request data: up to 6–12 months if no paid relationship begins;
• customer, booking, and lesson records: for the duration of the relationship and up to 6 years afterwards where needed for business, legal, tax, or accounting reasons;
• payment and invoicing records: for as long as required by applicable tax and accounting laws;
• cookie consent records: for as long as needed to demonstrate consent choices and manage preferences;
• marketing consent records: until you withdraw consent or we no longer use that channel.

We may keep information longer where required by law or where necessary to establish, exercise, or defend legal claims.

Your rights

Depending on applicable law, you may have the right to:

• request access to personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request data portability where applicable;
• lodge a complaint with a supervisory authority.

If you want to exercise any of these rights, please contact us at hello@tarteelhouse.com.

We may need to verify identity before acting on certain requests.

Analytics and cookie choices

Tarteel House uses Google Analytics 4 only to understand website usage and improve the website. Google Analytics is optional: it is not loaded or contacted until you explicitly select “Accept analytics”. The legal basis for optional analytics is your consent.

You may reject analytics without losing access to the website, lesson information, booking form, or any Tarteel House service.

What Google Analytics may collect

When analytics is accepted, Google Analytics 4 may collect:

• page visits and page paths;
• user and session statistics;
• approximate geographic location;
• browser, operating-system, and device information;
• referral information;
• website interaction events.

Google is our analytics provider. Google may process analytics information on servers outside your country. Please see Google’s Privacy Policy and Google’s current information about data-transfer frameworks. We do not independently claim that any particular transfer mechanism guarantees compliance.

Booking-funnel events

When analytics is accepted, we use three custom events to understand how visitors move through the trial-booking funnel:

• trial_cta_click records an internal click leading to the Book Trial page. Its parameters are source_path, destination_path, and cta_text.
• trial_form_start records that someone began interacting with the booking form. Its parameters are source_path and a fixed form_id.
• trial_form_submit_attempt records a valid client-side submission attempt. Its parameters are source_path and a fixed form_id. It does not prove that a booking was confirmed or received by our backend.

We do not intentionally send Google Analytics parent or child names, email addresses, telephone or WhatsApp numbers, ages, city, selected lesson language, learning level, preferred schedule, notes, or any booking-form field value.

Your choice and withdrawal

Your analytics choice is stored locally on your device for 12 months in browser local storage under tarteelhouse.analyticsConsent. This storage remembers whether you accepted or rejected analytics; it is not an advertising profile.

You can change or withdraw your choice at any time using the persistent “Cookie settings” control in the footer. Withdrawing consent applies going forward. When your choice changes from accepted to rejected, our consent implementation attempts to remove first-party Google Analytics cookies for the Tarteel House domain and reloads the page.

Cookies and local storage

This table describes the current configuration. Google could use additional cookies if the Google Analytics configuration changes in the future.

Marketing communications

If we offer newsletters or promotional updates, we will only send them where we have an appropriate legal basis to do so.

You can opt out of marketing emails at any time by using the unsubscribe link or by contacting us directly.

Data security

We take reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

No method of transmission or storage is completely secure, but we work to apply measures appropriate to the nature of the data we handle.

Third-party links

Our website may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to read their privacy notices separately.

Complaints

If you have concerns about how we handle personal data, we would appreciate the opportunity to address them first.

You also have the right to lodge a complaint with the data protection authority in the country where you live, work, or where you believe an infringement has occurred.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the updated “Last updated” date.