Privacy Policy

Who we are
Data we collect
Legal basis for processing
How we use your data
Data retention
Data sharing & third parties
Security measures
Your rights (GDPR)
Cookies
Contact us

1Who We Are

Nour-Elm is an Islamic education management platform designed for mosques and Islamic schools operating in the Netherlands. The platform enables mosque administrators and teachers to manage student registrations, attendance records, Quranic progress, quizzes, and parent communications.

For the purposes of GDPR, the data controller is the mosque or Islamic educational institution that operates a tenant account on the Nour-Elm platform. Nour-Elm acts as a data processor on behalf of each mosque.

The mosque administration using this platform is responsible for determining the purposes and means of processing personal data of students and parents. Nour-Elm processes this data solely on the instructions of the mosque.

2Data We Collect

The following categories of personal data may be collected and stored through the Nour-Elm platform:

Category	Data Fields	Who it concerns
Student data	Full name (Arabic & Dutch), date of birth, gender, class/level	Students
Parent/Guardian data	Parent name, phone number, email address	Parents / Guardians
Attendance records	Presence/absence status per date per student	Students
Progress records	Quranic progress category, rating, date, teacher notes	Students
Teacher data	Full name, email, phone, VOG certificate status	Teachers
Account data	Email address, hashed password, tenant association	Administrators

We do not collect sensitive personal data such as racial origin, health data, political opinions, or biometric data.

3Legal Basis for Processing

All personal data processed through Nour-Elm is based on one or more of the following legal bases under Article 6 GDPR:

Consent (Art. 6(1)(a)) — Parental or guardian consent collected during student enrollment.
Contract (Art. 6(1)(b)) — Processing necessary to provide the education management services agreed upon with the mosque.
Legitimate interest (Art. 6(1)(f)) — Maintaining attendance and progress records for educational continuity.
Legal obligation (Art. 6(1)(c)) — Retaining VOG (Verklaring Omtrent het Gedrag) records as required by Dutch law for persons working with children.

4How We Use Your Data

Registering and managing student enrolments
Recording daily attendance and generating attendance reports
Tracking Quranic and Islamic studies progress per student
Administering quizzes and recording results
Sending announcements and notifications to parents
Managing teacher profiles and VOG compliance records
Providing administrators with dashboard analytics and reports

Your data is never used for advertising, profiling, or sold to third parties.

Fair Use Monitoring. We monitor usage patterns to ensure fair and equitable access to AI features. Free-tier and trial-tier accounts are subject to a daily quota of 100 aggregate inferences per calendar day (UTC). Accounts consistently exceeding fair-use limits may receive up to 3 warnings. After 3 documented violations, we may temporarily suspend AI access for that account (typically 24 hours) to prevent resource exhaustion. Institutional subscription accounts operate under separate service-level agreements with custom quotas.

5Data Retention

We retain personal data only as long as necessary for the stated purpose or as required by law:

Student and attendance records: retained for the duration of enrollment + 2 years after departure
Progress and quiz records: retained for the duration of enrollment + 2 years
Parent contact data: retained while the student is enrolled
Teacher VOG records: retained for 5 years as required by Dutch child protection law
Account login data: deleted within 30 days of account termination

After expiry, data is permanently deleted from all systems and backups.

6Data Sharing & Third Parties

Nour-Elm does not sell or share personal data with third parties except in the following limited cases:

Hosting provider — Our server infrastructure is hosted on secure EU-based servers. The provider processes data solely on our instructions.
Database provider — PostgreSQL database hosted within the EU.
Legal obligation — We may disclose data if required by Dutch authorities or courts.

All third-party processors are bound by Data Processing Agreements (DPAs) in accordance with Art. 28 GDPR.

Data is stored exclusively on servers within the European Economic Area (EEA). No transfers to third countries (outside EEA) take place.

7Security Measures

Passwords are stored using industry-standard hashing (bcrypt)
All data transmissions are encrypted via HTTPS / TLS
Each mosque's data is strictly isolated through multi-tenant architecture (tenant_id on every record)
Access to the database requires authenticated sessions validated server-side
Regular security reviews and dependency updates applied

8Your Rights (GDPR / AVG)

Under the GDPR and the Dutch AVG (Algemene Verordening Gegevensbescherming), you have the following rights regarding your personal data:

Right of access (Art. 15) — You may request a copy of all personal data we hold about you.
Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17) — You may request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
Right to restriction (Art. 18) — You may request limited processing of your data in certain circumstances.
Right to data portability (Art. 20) — You may request your data in a structured, machine-readable format.
Right to object (Art. 21) — You may object to processing based on legitimate interest.
Right to lodge a complaint — You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise any of these rights, contact the mosque administration or reach us at the contact details below. Requests are handled within 30 days.

9Cookies

Nour-Elm uses only strictly necessary functional cookies for session authentication. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required as no non-essential cookies are set.

10Contact Us

For privacy-related inquiries, data subject requests, or questions about this policy:

Nour-Elm Privacy Contact

Platform: nour-elm.app

Data rights requests: contact your mosque admin or the platform administrator

Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl

Contents