Last updated: 9 August 2026 · See also our Terms of Service and Privacy Policy
This is IlmFlow’s standard Data Processing Agreement (DPA) under UK GDPR Article 28(3), setting out how we process personal data on a madrasah’s behalf as its data processor. It applies automatically to every madrasah using the Services, alongside our Terms of Service, no request or separate signature needed, though we’re happy to provide a countersigned copy on request (see Section 15). IlmFlow is a trading name of ILMFLOW LTD, a company registered in England and Wales (company number 17434787).
This Data Processing Agreement ("DPA") is between the madrasah or other organisation using IlmFlow ("Controller", "you") and IlmFlow ("Processor", "we", "us"). It applies wherever we process Personal Data on your behalf in connection with the Services described in our Terms of Service.
We process Personal Data on your behalf for the duration of your subscription to the Services, for the purpose of providing the IlmFlow platform: running your attendance register, Qur’an/Hifz and dua tracking, exams and report cards, fee records, staff records and, where you enable it, UK payroll, and the admin, teacher and parent portals that support those functions.
The nature of the processing is electronic storage, retrieval, organisation, and display of the records you and your Authorized Users enter, plus the specific operations needed to run each feature (for example, calculating a payslip, generating a report card, or sending an absence notification). We do not process this data for our own purposes, and we do not sell it or use it for advertising.
The categories of Data Subjects and Personal Data are set out in full in Section 3 of our Privacy Policy, and in summary are:
Some madrasahs also record, at their own discretion as Controller, a staff member’s DBS (criminal record check) reference and expiry date and right-to-work/visa status. These are criminal offence data and, in the case of visa/immigration status, may reveal other protected characteristics; we only process them on your documented instructions, for the safeguarding and right-to-work purposes you set. Separately, because IlmFlow is used by Islamic supplementary schools, attendance and progress data recorded against Qur’an or Hifz classes can, by its nature, reveal or suggest a Data Subject’s religious belief, a special category of data under Article 9 UK GDPR. You are responsible, as Controller, for having an appropriate condition under Article 9 or Article 10 UK GDPR (as applicable) for holding this data; we process it only as your instructions direct.
We will only process Personal Data on your documented instructions, including regarding transfers to a country outside the UK, unless we are required to do otherwise by UK or EU law, in which case we will tell you before processing (unless the law prohibits this for important reasons of public interest). Your use of the Services’ ordinary functionality, and any written communication from an Authorized User with account permissions to give it, counts as a documented instruction. If we believe an instruction breaches UK GDPR or other data protection law, we will tell you immediately.
We ensure that anyone we authorise to process Personal Data (including any employee, contractor, or Sub-processor) is subject to a binding duty of confidentiality, whether contractual or statutory, and only processes that data as needed to provide the Services.
We take technical and organisational measures appropriate to the risk, as required by Article 32 UK GDPR, including:
No method of transmission or storage is completely secure, and we do not represent that these measures make a breach impossible. We keep our security measures under review as the Services and known risks develop.
You give us general written authorisation to engage the Sub-processors listed below, each of which processes Personal Data only for the specific purpose stated, and, other than our hosting and email providers, only where the madrasah has enabled the relevant feature:
If we add a new Sub-processor or replace an existing one in a way that materially changes how your Personal Data is processed, we will update this page and give existing customers reasonable notice, in line with Section 16 of our Terms of Service, so you can raise any objection before the change takes effect. We remain responsible to you for each Sub-processor’s performance of its data protection obligations under a written contract that imposes terms no less protective than this DPA.
Taking into account the nature of the processing, we will provide appropriate technical and organisational measures to help you respond to requests from Data Subjects exercising their rights under UK GDPR Chapter III (for example, access, rectification, erasure, or portability requests), including through the Services’ own export and edit functionality. Where we receive a Data Subject request directly relating to your madrasah’s data, we will pass it to you promptly and will not respond to it ourselves, since you are the Controller.
Taking into account the nature of the processing and the information available to us, we will help you comply with your own obligations under Articles 32 to 36 UK GDPR, including security of processing, notifying Personal Data Breaches, and, where you ask, providing information reasonably needed for a Data Protection Impact Assessment or prior consultation with the Information Commissioner’s Office.
If we become aware of a Personal Data Breach affecting your Personal Data, we will notify you without undue delay and, where reasonably practicable, within 72 hours of becoming aware of it, and provide the information you reasonably need to meet your own notification duties to the Information Commissioner’s Office and affected individuals. This is in addition to, and does not replace, the breach response commitments in Section 9 of our Privacy Policy.
Our own hosting is within the European Union, which UK data protection law treats as offering an adequate level of protection. Where a Sub-processor listed in Section 7 is based, or processes data, outside the UK and EU (for example, in the United States), we rely on the safeguards recognised under UK data protection law for international transfers, such as the UK’s International Data Transfer Addendum, standard contractual clauses, or the provider’s own equivalent commitments, before any Personal Data is transferred there.
We will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for, and contribute to, audits or inspections conducted by you or an auditor you mandate, on reasonable prior written notice, no more than once in any 12-month period (except where a regulator or a suspected Personal Data Breach requires otherwise), during business hours, and subject to reasonable confidentiality safeguards for our systems and other customers’ data.
At your choice, at the end of the provision of the Services relating to processing, we will make your Personal Data available for you to export, and will then delete it, except to the extent UK or EU law requires us to keep it (for example, HMRC’s requirement to retain payroll records for at least three years). This reflects the process already set out in Section 5 of our Terms of Service.
Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in Section 13 of our Terms of Service, which this DPA does not expand.
This DPA takes effect automatically, and is incorporated into and forms part of, our Terms of Service, from the point a madrasah begins using the Services, for as long as that agreement continues. No separate signature is required for this DPA to apply. If a madrasah’s own compliance records need a countersigned copy, contact us at hello@ilmflow.co.uk and we will provide one on the same terms set out here. If anything in this DPA conflicts with the Terms of Service on a matter this DPA specifically covers, this DPA takes precedence for that matter; otherwise the Terms of Service apply.
Questions about this DPA, or requests for a countersigned copy? Email hello@ilmflow.co.uk.
This document is a general template and has not yet been reviewed by a solicitor. Because IlmFlow processes children’s and staff data, it should not be relied on as final legal advice until that review is complete.