Privacy policy

This Privacy Policy explains how personal data is collected, used, protected and shared on the platform operated by Kirca IT Services (Chamber of Commerce number 91781418, VAT number NL004915794B15, Amsterdam, the Netherlands) under the trade name Aqlemy. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act. What this document is — and what it is not. This is an information document (GDPR articles 12 to 14), not a consent form. Reading it does not give consent, and neither does using the platform. Where we do rely on consent, we ask for it separately and you can withdraw it separately. That distinction is stated up front because privacy statements often blur it — and consent presented as a condition of the service is not valid consent (GDPR article 7(4)). Two different roles — and it matters which one applies. For the data of members, students, parents and teachers, the organisation using the platform is the controller: it determines the purposes for which that data is processed. We act as processor on that organisation's behalf. Questions about that data should therefore be addressed first to your own organisation; our relationship is set out in the data processing agreement. In addition, we are ourselves the controller for our own customer relationship: the organisation's contact person, invoicing, visitors to our website, and our own security and system logging. Article 2 sets out that division situation by situation, including the borderline cases. Legal basis. Most of the processing described here rests not on consent but on the performance of a contract (the membership or the educational relationship), on a legal obligation, or on a legitimate interest. We use consent only where you genuinely have a free choice — for example for sharing photographs. You can withdraw that consent at any time; this does not affect the lawfulness of processing before withdrawal. Scope. This policy applies to the administration portal, the mobile applications, the public organisation pages, the information screens and our own website aqlemy.com. For cookies and similar techniques on the website, the Cookie Policy applies in addition. Version. This policy carries a version number and an effective date. We inform you of a change as described in article 18; we do not ask for renewed acceptance, because an information document does not need to be accepted — doing so would wrongly suggest that consent is the legal basis. No data protection officer, but a fixed point of contact. We are not required to appoint a data protection officer (GDPR article 37): we are not a public authority, and our core activity does not consist of large-scale regular and systematic monitoring or large-scale processing of special categories of data. There is however a single fixed point of contact for privacy questions: privacy@aqlemy.com. Your own organisation may be required to appoint an officer on account of its own size or nature; that is separate from us.

The application requests only permissions it actually uses. Below is what each permission is for and what happens to the data. You can refuse or later withdraw every permission via your phone's settings; the associated function will then not work, while the rest of the app will. Location. For calculating prayer times for your location and for the qibla direction. The coordinates are used on your device and not transmitted to our servers. If you refuse this permission you can set the location manually; the compass will not work. Camera. For taking a photograph for a homework assignment or a profile picture. The photograph only goes to the platform if you send it yourself. Photo library. For choosing an existing photograph for your profile or as an attachment. The app receives only the photographs you select yourself, not your entire library. Calendar. For adding prayer times, lessons and events to your own calendar. The app also requests read access, and that deserves explanation: it is needed to be able to *show* which calendar is being written to, so that you can choose. Your existing appointments are not read, not transmitted and not stored. Notifications. For reminders of prayer times, announcements from your organisation, events and security warnings. To deliver a push message, a device token from your phone is passed to the notification service; that token identifies the device, not you personally. If you switch notifications off, you receive them in the app itself and by email. Motion and magnetic field sensor. Solely for the qibla compass. Nothing is recorded or transmitted from it. Storage. For storing attachments you download and your preferences and temporary files on the device itself. Biometric unlock. You can unlock the app with face or fingerprint recognition. This runs entirely through your phone's secure facility: the biometric characteristic does not leave your device and never reaches our servers. We only receive confirmation that the unlock succeeded. What the app does NOT do. - No background location, no movement profile, no record of where you have been. - No advertising identifier, no tracking pixel, no advertising network. - No access to your contacts, your messages or your phone calls. - No QR code scanning and no offline audio; those functions are not in the app. Withdrawing a permission. Via your phone's settings, per app and per permission. The app does not ask again.