Privacy and cookies
Kadim helps UK mosques run their volunteer rotas. Looking after your details carefully is part of that trust, so here is the plain-English version of what we collect, why, and the choices you have. We do not sell your data and we run no advertising or tracking.
Who we are
Kadim is the data controller for the details described in this notice. You can reach us about anything on this page by emailing salaam@kadim.co.uk. Our registered name and postal address will be confirmed here before the service opens to the public.
Who this covers
This notice covers everyone whose details we handle: volunteers who claim slots through a share link, the coordinators and trustees who run a mosque's rota, and anyone who asks for a walkthrough through our website.
What we collect
- Volunteers
- Your name, your UK mobile number (used to send the one-time code that signs you in), the slots you claim, and, where your mosque records them, the skills and availability you choose to share.
- Coordinators and trustees
- Your name, your email address, the sign-in identity your mosque's identity provider gives us, and the role you hold at the mosque.
- Walkthrough enquiries
- Whatever you type into the "Book a walkthrough" form: your mosque's name, your name, your email, and, if you choose to share them, a phone number, your role and a message.
Why we are allowed to use it
- Consent covers walkthrough enquiries and the sign-in text messages we send volunteers. You can withdraw it at any time.
- Our legitimate interest in helping a mosque coordinate its volunteers, together with the agreement we hold with the mosque, covers the rota, its slots and its reminders.
- A legal obligation, and the substantial public interest in safeguarding, covers the DBS status we hold for roles that need it.
Safeguarding and DBS data
We treat safeguarding information with extra care, because it is the most sensitive thing we hold. For a DBS check we store five facts only: the status, the certificate number, the issue date, the level and the workforce type.
We never store the contents of a DBS certificate. Every one of those fields is encrypted where it is kept, and every time someone opens a safeguarding record we write a line to an audit log that cannot be edited or deleted.
A volunteer can carry an existing check between mosques only with their own consent, through a status check against the DBS Update Service. We never share one mosque's safeguarding records with another.
Text messages and opting out
We use text messages for two things: the one-time code that signs a volunteer in, and reminders or gap alerts about slots. The sign-in code is needed to use your account.
Kadim's texts arrive from the name Kadim rather than from a phone number, so replying to one does not reach us. To stop the texts, ask a coordinator at your mosque to take you off the team and to release any slots you are still holding. That ends the reminders, the gap alerts, the rota shares and the thank-you messages. A sign-in code is only ever sent when you ask to sign in, so nothing arrives unless you start it.
Who we share it with
We do not sell your data, and we run no third-party analytics, advertising or tracking. To run the service we rely on a small number of trusted suppliers, our sub-processors:
- Microsoft Azure (UK South) hosts the service and stores the database, our secrets and the encryption keys.
- Auth0 handles coordinator and trustee sign-in through standard OpenID Connect. We keep this provider swappable, so it can be replaced without changing your experience.
- Twilio (or Azure Communication Services) delivers our text messages. Only the mobile number is shared, and only to send the message.
- Stripe will process card payments when paid plans go live. It is not in use yet.
Your data is held in the United Kingdom (Azure UK South). If that ever changes, we will update this notice and keep the protections the law requires.
Product feedback
Signed-in users can send us product feedback from inside the app. When you do, we attach a short usage profile so we can weigh the feedback properly: the page you were on, your role and mosque, how long you have been registered, your language setting, and a summary of how much you have used Kadim (counts of actions such as rotas published or shifts claimed). It never includes safeguarding or DBS information, your phone number or your email address.
Our lawful basis is legitimate interests: understanding feedback in context is how we improve a service mosques rely on. Your feedback and its profile are read only by the Kadim team, are never shared between mosques, and are deleted within 24 months, or straight away if you ask.
How long we keep it
We keep walkthrough enquiry details only while we are in touch, then delete them, or straight away if you ask. Volunteer and safeguarding records are kept only for as long as the mosque needs them to run safely. The exact retention periods are being set with our advisers and will be published here before launch.
Your rights
You can ask us to give you access to the data we hold about you, to correct it, to delete it (erasure), or to send you a copy to take elsewhere (portability). To exercise any of these, email salaam@kadim.co.uk. If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office (the ICO), the UK regulator, at ico.org.uk.
Changes to this notice
If we change how we handle your data, we will update this page and, where it matters, tell you directly.