LEGAL

Student Safety & Data Protection Policy

HifzPro is used by institutions that serve children and young people. We take our responsibility to protect them with the utmost seriousness.

🛡️ Effective Date: 1 June 2026 · Last Updated: 1 June 2026

Because HifzPro serves Hifz educational institutions where many students are minors, we have developed this dedicated Student Safety and Data Protection Policy. This document supplements our Privacy Policy and Terms of Service.

Our Core Commitment

The safety, wellbeing, and privacy of every student enrolled in a HifzPro-managed institution is our absolute priority. Every feature we build, every data decision we make, and every third-party service we integrate is evaluated through the lens of student safety first.

Five Core Safety Guarantees

  • No advertising: Student data is never used to serve advertisements to anyone. HifzPro has no advertising business model.
  • No data selling: We never sell, rent, or trade student data to any third party under any circumstances.
  • No data mining: We do not analyse student data to build commercial profiles or conduct behavioural research for any purpose other than operating the service.
  • Parental rights: Parents and guardians have the right to access, correct, and request deletion of their child's data at any time.
  • Encrypted storage: All student data is encrypted at rest and in transit using industry-standard encryption.

Data Minimisation

We collect only the minimum data necessary to operate the educational management service. For student profiles, this includes name, guardian contact information, and academic records (lesson progress, attendance, test results). We do not require or store sensitive personal data such as national ID numbers, biometric data, or financial account details.

Access Controls

Student data is protected by strict role-based access controls:

  • Institution administrators can access all data for students enrolled at their institution only
  • Asatidha (teachers) can access only the records of students assigned to their Halqa
  • Parents and guardians can access only the records of their own children via the Parent Portal
  • HifzPro staff can access institution data only when required for technical support, and only with the institution's knowledge
  • No user can access data belonging to a different institution

Parental Consent

It is the responsibility of the enrolled institution to obtain appropriate parental consent before entering a minor's data into HifzPro. By enrolling a student, the institution represents that it has obtained all necessary consents from the student's parent or guardian. HifzPro provides institutions with consent template language upon request — contact info@i9experts.com.

WhatsApp Communications

HifzPro's WhatsApp integration sends automated messages to parents and guardians about their child's academic progress. These messages are:

  • Sent only to numbers provided and authorised by the institution
  • Strictly limited to educational content (lesson records, attendance, test results, fee reminders, certificates)
  • Never used to send advertising, promotional content, or third-party messages
  • Opt-out capable — parents may ask the institution to remove their number from automated messaging at any time

Third-Party Services

We use a small number of carefully selected third-party services:

  • Cloudinary — Image and document storage. Data is stored in encrypted cloud infrastructure. Cloudinary does not use uploaded content for any commercial purpose.
  • WhatsApp / Meta Cloud API / UltraMsg — Messaging delivery only. Message content is not stored beyond delivery.
  • Railway — Cloud hosting. All data is stored in encrypted PostgreSQL databases.
  • Stripe — Payment processing for international plans. Stripe is PCI-DSS compliant. Card details never pass through HifzPro servers.

Data Breach Response

In the event of a suspected or confirmed data breach:

  • We will investigate and contain the breach within 24 hours of discovery
  • Affected institutions will be notified within 72 hours with details of the breach and affected data
  • We will cooperate fully with Pakistani data protection authorities
  • A post-incident review will be conducted and remediation measures implemented

Reporting a Safety Concern

If you have a concern about the safety or privacy of a student's data, please contact us immediately:

  • Email: info@i9experts.com
  • WhatsApp (urgent concerns): +92-300-2517280
  • Post: i9 Experts Private Limited, D-8/5, Shahrah-e-Jahangir, Gulberg Town, Karachi, Sindh, Pakistan

All safety concerns are treated with the highest priority and will receive a response within 4 business hours (Monday–Friday, 10am–6pm PKT).

Compliance

This policy is designed to comply with:

  • The Prevention of Electronic Crimes Act 2016 (PECA), Pakistan
  • The Personal Data Protection Bill (Pakistan)
  • Applicable international best practices for children's data protection, including principles from the UK Children's Code and GDPR Article 8 where relevant to international users