Privacy Policy
Effective date: 11 May 2026 Last updated: 8 September 2026
This Privacy Policy describes how My Tijarah Ltd ("My Tijarah", "we", "us", "our") collects, uses, and protects your personal data when you use mytijarah.co.uk and the services offered through it (the "Service").
We are the data controller for the personal data described in this Policy.
- Registered name: My Tijarah Ltd
- Company number: 17210223
- Registered office: 20 Wenlock Road, London N1 7GU, United Kingdom
- Contact: support@mytijarah.co.uk
- ICO registration number: 00014052070
1. Personal data we collect
1.1 Information you give us
- Account data: name, email address, password (hashed), date of birth, country, language, and a phone number if you book a free trial lesson (we ask for one at that point so we can message you about the lesson).
- Profile data: for Teachers: biography, photo, languages spoken, subjects taught, qualifications, hourly rate, time zone; for Students: preferred subjects and goals.
- Identity verification data (Teachers only): government-issued ID, proof of address, bank account details, tax residence country.
- Booking data: Lessons booked, times, parties involved, messages exchanged. When you book a free trial lesson we also ask who the lessons are for and what the main goal is, so that your teacher can prepare. Your teacher sees both answers. Your phone number is not shared with them.
- Communications data: messages with our support team, feedback, and reviews.
- Free resource data: if you ask us to send you one of our free ebooks, your email address and which books you asked for. You do not need an account for this, and we hold nothing else about you. Booking a free trial lesson adds your address to the same list, because the guides that come with the booking are delivered through it.
1.2 Information we collect automatically
- Payment data: payment method type, last four digits of card, billing country, and transaction status. Full card details are collected directly by our payment processor (Stripe) and never reach our servers.
- Usage data: pages visited, features used, click events, referrer URL.
- Device data: IP address, browser type and version, operating system, device type, screen size, time zone.
- Lesson attendance data: when you join a lesson's Google Meet video call, we collect attendance information (the display name you join with, and the times you join and leave the call), retrieved via the Google Meet API. We use it to confirm that lessons took place and to help resolve disputes (for example, no-show reports).
- Cookies: see our Cookie Policy.
1.3 Information from third parties
- Sub-processors (Stripe, Wise) provide us with transaction status updates.
- If you sign in with a third-party identity provider (where available), we receive your name and email from that provider.
2. How we use personal data, and the lawful basis
| Purpose | Personal data used | Lawful basis (UK GDPR) |
|---|---|---|
| Provide and operate the Service | Account, profile, booking, communications | Contract performance |
| Schedule lessons, add them to calendars, and generate video-meeting links | Account (name, email), booking | Contract performance |
| Record lesson attendance to confirm lessons and resolve disputes | Attendance, booking | Legitimate interest (confirming service delivery; resolving disputes) |
| Process payments and payouts | Payment, identity, bank account | Contract performance |
| Verify Teacher identity, run sanctions and AML checks | Identity verification | Legal obligation; legitimate interest |
| Send service emails (booking confirmations, payout notifications, password resets) | Account, booking | Contract performance |
| Message you about a lesson you have booked, by email and on WhatsApp (confirmations, reminders, changes of time) | Account (name), phone number, booking, consent record | Contract performance for the messages themselves; consent for the WhatsApp channel, which WhatsApp's own Business Messaging Policy requires before a business may message anyone (you can withdraw it at any time) |
| Send marketing emails | Account, free resource | Consent (you can withdraw at any time) |
| Send you a free ebook you asked for, and later news about our books and lessons | Free resource | Consent (you can withdraw at any time) |
| Detect fraud and abuse | Usage, device, payment | Legitimate interest (protecting our business and users) |
| Analyse and improve the Service | Usage, device | Legitimate interest |
| Measure site usage with analytics cookies (Google Analytics) | Usage, device | Consent (you can withdraw at any time) |
| Advertising measurement and audiences (Meta Pixel) | Usage, device | Consent (you can withdraw at any time) |
| Respond to support requests | Communications, account | Contract performance |
| Comply with tax, accounting, and regulatory obligations | Booking, payment, identity | Legal obligation |
| Defend legal claims | As required | Legitimate interest |
The messaging tick box, and what it does not cover. When you book a free trial lesson we ask you to agree to one sentence: "I agree to My Tijarah contacting me on WhatsApp and by email about my lessons, including confirmations and reminders." That is its entire scope. Everything we send under it is the lesson you booked, which is why we ask for it at the point of booking, and we keep a record of the exact wording you agreed to and when. It is not a marketing consent and we do not use it for marketing. Offers, tips, and news would need a separate consent, freely given, which you are free to refuse without losing anything. To stop the lesson messages, email us at support@mytijarah.co.uk and we will use email alone, or nothing at all if you prefer.
We do not sell personal data and we do not use it to make solely automated decisions that have significant effects on you.
3. Who we share personal data with
We share personal data with the following categories of recipients.
3.1 Service providers (data processors)
- Stripe Payments UK, Ltd: payment processing (UK; some processing in the US under SCCs).
- Wise Payments Ltd: teacher payouts (UK; some processing in the EU and globally for transfer execution).
- Supabase, Inc.: database hosting and authentication (EU/US).
- Vercel Inc.: application hosting (EU/US under SCCs).
- Google (Google Ireland Limited / Google LLC): calendar scheduling and video meetings via Google Workspace (Google Calendar and Google Meet): creating lesson calendar events, generating per-lesson meeting links, and retrieving lesson attendance records (EU/US under SCCs).
- Sentry (Functional Software, Inc.): error and performance monitoring (US under SCCs).
- Resend, Inc.: transactional service emails such as booking confirmations and password resets (US under SCCs).
- Telegram (Telegram Messenger Inc.): internal alerts to our own staff. When you book a free trial lesson we send ourselves a notification carrying your name, email address, phone number and what you told us the lessons are for, so that somebody can answer you quickly. It goes to a private staff channel and to nobody else. Telegram processes these messages on servers outside the UK.
- WhatsApp (Meta Platforms Ireland Ltd): messages about a lesson you have booked, sent only where you have agreed to be contacted on WhatsApp. Your phone number, your name, and the content of those messages are processed by Meta in Ireland, and may be processed by Meta Platforms, Inc. in the US under SCCs. This is a transfer of your phone number out of the UK, and it happens only for lesson messaging.
- Google (Google LLC): anonymous usage analytics via Google Analytics, loaded only after you consent to analytics cookies (US under SCCs).
- Meta Platforms Ireland Ltd: advertising measurement and audiences via the Meta Pixel, loaded only after you consent to marketing cookies (data may be processed by Meta Platforms, Inc. in the US under SCCs).
3.2 Other users
- Teachers see the basic profile information of Students who book them, including name and lesson context.
- Students see the public profile information of Teachers.
- When a lesson is booked, a Google Calendar invitation for that lesson is sent to both the Teacher and the Student, so the lesson appears on each party's calendar with the video-meeting link.
3.3 Authorities
We may disclose personal data to regulators, courts, law enforcement, or other government authorities where we are legally required to do so, or where we believe in good faith that disclosure is necessary to comply with the law or to protect our rights, property, or the safety of any person.
3.4 Corporate transactions
If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred to the relevant party, subject to the protections in this Policy.
4. International transfers
Some of our processors are located outside the UK. Where this is the case, we rely on:
- the UK's data-transfer adequacy decisions (where they apply);
- the UK International Data Transfer Agreement (IDTA); or
- the EU Standard Contractual Clauses with the UK Addendum,
to ensure transfers receive an equivalent level of protection. Copies of the relevant safeguards are available on request at support@mytijarah.co.uk.
5. How long we keep personal data
| Category | Retention |
|---|---|
| Account data | While the account is active, plus 6 years after closure for legal-claim defence |
| Booking and payment data | 7 years (to meet UK accounting and tax-record obligations) |
| Teacher identity-verification data | 5 years after account closure (to meet UK anti-money-laundering obligations) |
| Communications with support | 3 years after the matter is closed |
| Lesson attendance records | Stored with the related booking; retained for the same period as booking data |
| Trial booking answers (who the lessons are for, the main goal) | Stored with the related booking; retained for the same period as booking data |
| Phone number given when booking | While your account is open and we may still need to message you about a lesson. Deleted when you close your account, or sooner if you ask us to stop messaging you |
| Messaging consent record (the wording you agreed to, and when) | 6 years from the date the consent was given or withdrawn. It deliberately outlives the phone number it justifies, because the record is the thing we would have to produce to show that you agreed |
| Cookie and analytics data | Up to 24 months |
| Marketing preferences | Until you withdraw consent |
| Free resource data | Until you unsubscribe. We then keep your address only to avoid emailing you again |
We may keep data longer where the law requires it or where it is needed to defend or pursue a legal claim.
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Rectify inaccurate or incomplete data.
- Erase your data, in some circumstances.
- Restrict processing, in some circumstances.
- Object to processing based on legitimate interest, including for marketing.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw consent where processing is based on consent.
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. We would appreciate the chance to address your concern first, but you can complain to the ICO at any time.
To exercise any of these rights, contact us at support@mytijarah.co.uk. We respond within one month.
7. Children's data
The Service is intended for users aged 16 and over.
If a user is under 18, a parent or legal guardian must agree to our Terms on their behalf and supervise their use of the Service. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe a child under 16 has provided us with personal data, contact us at support@mytijarah.co.uk and we will delete it promptly.
One thing we do collect is data about a child, given to us by an adult. When you book a free trial lesson we ask who the lessons are for, and "My child" is one of the answers. That answer, and the goal you pick alongside it, is information about your child rather than about you. It is a single non-identifying answer: at that point we do not ask for the child's name, age, or contact details, and we ask the child for nothing directly. The account, the phone number, and the messaging agreement all belong to the adult who books.
8. Security
We protect personal data using technical and organisational measures including:
- TLS encryption in transit;
- encryption at rest for sensitive data;
- access control and authentication on internal systems;
- ongoing review and patching of dependencies;
- monitoring for anomalous activity.
No security is perfect. If we become aware of a personal-data breach that is likely to result in risk to your rights and freedoms, we will notify you and the ICO as required by UK GDPR.
9. Cookies
See our Cookie Policy for details on what cookies we use and how to manage them.
10. Changes to this Policy
We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be notified to active users by email or via the Service.
11. Contact
My Tijarah Ltd 20 Wenlock Road London N1 7GU United Kingdom support@mytijarah.co.uk Company number: 17210223