Privacy Policy
This policy describes what BEM Academy collects about you, why, how long we keep it, and what
rights you have. It is written from what the system actually does — not from a template.
Version 2026-09.1 · last updated 17. september 2026
Who is responsible
Book en Muslim is the data controller for personal data processed in BEM
Academy. You can reach us at hello@bookenmuslim.dk —
including to exercise any of the rights below.
What we collect
Only what the course needs in order to work.
- Your account: name, email address, phone number, and a hashed password.
We can never see your password.
- Your student profile: gender, date of birth, and your reason for
applying. Gender is used because class groups are gender-separated.
- Your billing address: for paid courses only, collected by Stripe on
their payment page when you provide your card, so we can issue invoices for your
payments. We store it on your student profile. We do not ask for it if you never
pay.
- Your participation: which class group you joined, your attendance for
each session (present, excused or absent), and when you enrolled. If your place on a
course ends, we record when it ended and, where the academy ended it, a short reason
(for example non-payment, conduct, or other) as part of the academy's own records.
- Your work: the answers you submit, whether they passed, and your
teacher's feedback.
- Messages: the notifications you have received in the app and — if you
allowed push — an anonymous device token so the message can reach your phone.
- Consent: which version of this policy you accepted, and when.
- Audit trail: a minimal record of administrative actions on personal data
— creation, suspension, deletion and consent.
We do not collect location data, we do not track you across other apps or
websites, and we do not use your data for advertising. There are no third-party analytics in
the app.
Why we process it
- To run the course: enrolment, class groups, attendance, access to
material and marking of work. Without this, the teaching cannot happen.
- To give you the right material: class material unlocks based on your own
attendance, so we have to record it.
- To keep you informed: reminders about classes, new material, results and
announcements from the academy.
- To contact you: email and phone are used for practical messages about
your course — never for marketing.
We process this on the basis of your consent, given at registration, and
because it is necessary to deliver the teaching you signed up for.
Who can see it
- Your teacher sees only the class groups, modules or individual sessions
they are assigned to — not the rest of the academy.
- Your teacher can also see your name and phone number — but only if you
are a student in a class they teach. This is so they can reach you about the teaching
itself: that a session has moved, or that you were marked absent. They see no other
contact details about you, and they cannot see the contact details of any student in a
class they do not teach.
- Administrators at Book en Muslim can see and manage accounts and
enrolments.
- Other students cannot see your details, your attendance or your work.
Processors
We use four providers, all of them bound by their own contractual terms to process your data
only on our instructions. We are in the process of putting a formal Data Processing
Agreement in place with each of them.
- Amazon Web Services (AWS) — hosting and backups. Data is held in
Stockholm, EU (eu-north-1). Backups are encrypted before they leave the
server.
- Postmark — sending email, such as password resets and invitations.
Receives your email address and the message content.
- Google Firebase Cloud Messaging — push notifications to your phone.
Receives a device token and the message title and body.
- Stripe — collecting payment, for paid courses only. Receives your name,
email address and the course you are paying for, and collects your billing
address on its own payment page and returns it to us, which we store so we can
issue invoices for your payments. We never see or store your card
details — those go directly to Stripe, and what we keep is the amount, the date
and whether it succeeded.
Payment
For paid courses we record which months you have paid for, so the academy knows who to
follow up with.
Getting started. Applying is free, and the academy decides on your
application before any payment is involved. Payment is required for a paid
course: once you have been accepted, your course content opens when your first
payment is made. Until then you have your place, but the sessions, materials and
assignments are not open.
Later payments. A failed or missed monthly payment does not
automatically withdraw your access. The system records the failure and notifies
the academy so that a person can contact you; any decision about your place on the course
is made by the academy, not by an automated process.
How long we keep it
- While you are enrolled: for as long as you take part in the course.
- After the course: enrolment, attendance and results are kept as the
academy's own record for 24 months after the course ends. They are then
anonymised automatically: the figures remain as statistics with no name attached and
cannot be traced back to you.
- Backups: encrypted copies expire automatically after 30 days.
- If you ask to be deleted: see below.
Deletion — what actually happens
You can ask to be deleted at any time from Profile → Delete my account in the app, or
by writing to hello@bookenmuslim.dk. When we carry
the request out:
- Deleted: your profile, your contact details, your notifications, your
devices, your sessions, your waiting-list entries, the answers you submitted
and your teacher's feedback on them. Your account is renamed to a pseudonym and you can no
longer sign in.
- Kept, with no name attached: that one person was enrolled in the class
group, the attendance register for each session, and whether a piece of work passed. That
is the academy's own record, and it is also the other students': a register with holes in
it is no longer a register. After deletion none of it can be traced back to you.
- Consent and audit records are kept as evidence that the processing was
lawful — and that the deletion actually happened.
Deletion cannot be undone.
Your rights
Under the GDPR you have the right to:
- Access — to know what we hold about you and receive a copy.
- Rectification — to have inaccurate data corrected.
- Erasure — as described above.
- Restriction — to ask us to pause our use of your data.
- Portability — to receive your data in a common format.
- Objection — to certain kinds of processing.
- Withdraw consent — at any time. This does not affect the lawfulness of
processing before you withdrew it.
Write to hello@bookenmuslim.dk and we will respond
within one month. If you are unhappy with our response you can complain to the Danish Data
Protection Agency, Datatilsynet.
Security
- All traffic between the app and the server is encrypted (HTTPS).
- Passwords are stored hashed and cannot be read — not even by us.
- Course material is served through short-lived, signed links.
- Access is role-based and enforced on the server, not only in the app.
- Backups are encrypted before they leave the server.
Age
For this period BEM Academy is open only to adults aged 18 and over. This is
checked at registration, so we do not process the data of children or young people.
Changes
If we change this policy materially it receives a new version number and you will be asked to
accept it again. We record which version you accepted.