Privacy Policy
Last updated 11 November 2026
This policy explains what personal information Al Ansaar collects, why, who can see it, how long we keep it, and your rights.
Al Ansaar is the data controller: we decide how and why your information is used. Charity number 1196233. Registered address: 88 Bernwood Road, Headington, Oxford OX3 9LQ.
Our website is run for us by Apex Designs (ICO registration ZC020147), which acts on our instructions and handles data protection requests on our behalf. To ask about your information, contact info@apexdesigns.org.uk.
What we collect, and why
| When | What | Why we may use it |
|---|---|---|
| Signing up for a class | The participant’s name and date of birth; contact email and phone; for a child, the parent or guardian’s name and relationship; for some sports, height, weight, experience, address and emergency contacts | To provide the class you asked for (contract). Date of birth decides which class someone can join; height and weight help coaches pair people safely. |
| Medical details, where a form asks | Medical conditions and allergies you choose to tell us about | To keep the participant safe in sessions, with your explicit consent. See below. |
| Donating | Name, email, the amount and fund; and, if you add Gift Aid, your home address and declaration | To process and record your gift (contract), and to keep Gift Aid records HMRC requires (legal obligation). |
| Buying from the shop | Name, email, phone, what you ordered | To fulfil your order (contract). |
| Using your account | Your email, your password (stored only in a scrambled form we cannot read back), and a record of sign-ins | To let you manage your classes, memberships and payments (contract), and to keep your account secure (legitimate interests). |
| Joining the mailing list | Email address, and when and how you agreed | To send you news, only with your consent. Unsubscribe at any time. |
We do not use your information for advertising, we do not sell it, and we do not build profiles of you.
If you used our previous website
When we moved to this website in November 2026, we brought across the records from our old one: class sign-ups, memberships, donations, Gift Aid declarations, shop orders and mailing-list choices. We did this so that your history, your subscriptions and your Gift Aid carry on without you having to sign up again. If you had unsubscribed, you stay unsubscribed, and we did not add anyone to the mailing list who had not agreed to it. The same rules, rights and retention periods apply to these records as to any others.
Medical information
Health information is “special category” data, and we treat it with extra care. We only keep it with explicit consent, given separately on the form (by a parent or guardian for under-16s). It is encrypted when stored, can be seen only by the participant’s coaches and our sports managers, and every time someone views it is logged. It is never included in mailing lists, exports or reports. We delete it six months after the participant’s place ends, or sooner if you withdraw consent.
Children
Children under 16 are signed up by a parent or guardian, who manages their information and gives any consent. We never send marketing to children; anything we need to say goes to the parent or guardian. Children’s names are kept in our own records and are not given to our payment processor.
Who else sees it
We use a small number of trusted organisations to run the site, under contract:
- Apex Designs, our web agency, builds and runs the site and answers data protection requests for us.
- Stripe processes card payments. It receives the payer’s name and email, and the card details you type into its secure form, which we never see. Stripe may process data in the United States under approved safeguards.
- Our hosting and database providers store the site and its data in the UK or EU.
- Cloudflare delivers the website to your browser and stores our backups. Backups are encrypted before they leave our systems and are kept in the EU.
- GitHub runs our automated backups. Each backup passes through its systems for a few minutes, which may be in the United States under approved safeguards, before it is encrypted. GitHub does not keep a copy.
- Our email provider sends the emails we send you, such as confirmations, receipts and, if you have agreed, our news.
- YouTube, only if you press play on a video on our videos page. Until then, your browser does not contact YouTube at all.
We share information with others only where the law requires it, for example with HMRC for Gift Aid, or in an emergency to protect someone’s life.
How long we keep it
| Information | Kept for |
|---|---|
| Medical details and emergency contacts | Six months after the place ends |
| Members’ records | While active, then three years after last activity |
| Children’s records | Until 18, then three years, unless still active |
| Donations and payments | Seven years, as charity accounting requires |
| Gift Aid declarations | Six years after the end of the tax year they cover, as HMRC requires |
| Mailing list | Until you unsubscribe |
| Encrypted backups | 30 days; one backup a month is kept for a year |
Where the law requires us to keep financial or Gift Aid records, we keep those records even if you ask us to delete your information, but remove everything else.
If we delete your information, it stays in our encrypted backups until they expire, as above. Backups are never used for anything except recovering from a failure, and if we ever have to restore one, we delete your information again before the restored data is used.
Your rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete your information, subject to the legal records above;
- restrict or object to how we use it;
- withdraw any consent you have given, at any time.
Contact info@apexdesigns.org.uk. We will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
We use only the cookies the site needs to work. See our Cookie Policy.