Qardhasan Privacy policy

QardHasan is a registered trademark of EdAid Ltd. All references to EdAid Ltd. in this policy also apply to QardHasan and any other related trademarks, copyrights, or brands owned by EdAid Ltd.

‍Last updated: 12 August 2024

Our contact details
‍Name: EdAid Limited
Address: 1 Poultry, London, EC2R 8EJ
E-mail: team@edaid.com

‍Name: EdAid Limited
Address: 160 Varick Street, New York, NY 10013
E-mail: team@edaid.com

‍Name: EdAid Limited
Address: 100 University Avenue, Toronto, ON, M5J 1V6
E-mail: team@edaid.com

‍QardHasan is a registered trademark of EdAid Ltd. EdAid Limited and its affiliates and associated and sister companies (collectively, “EdAid”, “we”, “us” and “our”) respect your privacy. We offer services that administer payment options for tuition, together with our education provider partners. We offer apprenticeship services including referrals onto a range of apprenticeships delivered by partner education providers and affiliated companies. We also operate as a Flex-Job Apprenticeship Agency, providing recruitment services to businesses and apprentices in England. This Privacy Policy describes how EdAid collects, uses, and discloses information, and what rights and choices you have with respect to the information.When we refer to “EdAid”, “we”, “us” or “our”, we mean the EdAid entity that acts as the controller or processor of your information.
‍
Information We Collect & Receive
‍EdAid obtains personal information about you from various sources to provide our services and to manage our website and platform, including:

Website Visit. When you visit the EdAid website, we collect your IP address.

Registration and Contact Information. When an education provider refers a student to EdAid, they will provide certain information the student provided to them, such as the individual’s name and email address so that EdAid can contact the student in connection with potential interest in paying tuition through EdAid. In addition, we collect information about you when you (a) register to use EdAid’s services and (b) otherwise provide contact information to us via our chat service or complete one of our enquiry forms. This information you provide may include but is not limited to, first and last name, email address, date of birth, mailing address, phone number, and any student identification number, as applicable.

Identity Document information. We may collect your National Insurance number or Social Security Numbers (or other equivalent identifiers by jurisdiction) and copies of identity documents, such as passports or driving licenses, as part of the registration process for administering payment plans. We only collect this information where it is necessary and lawful to do so, and we ensure that appropriate safeguards are in place to protect your personal data.

Financial Information. As part of the registration process, we may collect information about your income, savings, existing loans, or credit cards.

Credit File Information. In the process of determining whether you are eligible to participate in one of our payment plans, we may collect information from credit reference, consumer reporting, or other similar agencies in relevant jurisdictions (“CRAs”). See the section on Credit Reference Agencies below.Banking Information. We may ask you to connect your bank account to your EdAid profile via third-party partners (currently, EdAid uses Plaid). Depending on your payment option, the data requested may include the name of the account holder, contact information of the account holder (such as address, email address and/or phone number), a list of your banking transactions, details of your payment history, outstanding balances, and identity confirmation.

Account Information. We will keep information regarding your EdAid account, including details of your payment history, outstanding balances, and any changes to your account.Education and Employment Information. We may ask you to provide information on your previous education and current and prior employment. This may include employment contracts, offer or termination letters, certificates achieved, and contact information of your employer. Communications Information. We will collect information regarding contacts between you and EdAid, including the content of those contacts.

Technical, Usage, and Location Information. We automatically collect information on how you interact with edaid.com, such as the IP address from which you access edaid.com, date and time, information about your browser, operating system, and computer or device, pages viewed, and items clicked. We may also collect location information, including location information automatically provided by your computer or device. We use cookies and similar technologies to collect some of this information. For more information, please see EdAid’s Cookie Policy.

For users registered prior to April 2018. We have historically collected information relating to your work experience, education, photo identification, and university identifiers. This information was collected to fulfill our contractual and legal obligations to provide funding and to pursue the legitimate interests of EdAid providing a job-matching service to its users. This information is no longer requested from new users and will be held only in line with our standard data retention periods as listed below.

Other Information. We may collect other information from you that is not specifically listed here. We may use any such information in accordance with this Privacy Policy or as otherwise permitted by you.North West Education and Training (NWEAT). We may ask you for consent to share your data with NWEAT, an EdAid-affiliated company, in order to provide services appropriate to you. NWEAT’s privacy policy can be found by visiting: https://www.nweat.co.uk/_files/ugd/df83d0_496e15854f814a09950e575d1a21c24c.pdf

‍How We Use Your Information
‍We process your personal data for the purposes described in this Privacy Policy. We only collect the minimum amount of personal data needed to perform the specific processing activity for which the personal data was collected. We process personal data about you on the following legal basis:

with your consent;
to perform our contractual obligations to you or your education provider;
to comply with our legal obligations, e.g. relating to fraud, anti-money laundering, and other applicable regulations; or
to pursue legitimate interests, including:

education provider’s legitimate interest in fulfilling its duties under a payment plan or other services concluded with you, using our service, by which we have enabled the education provider to offer a payment option or other educational service to you;
EdAid’s legitimate interest in providing its services to the education provider, as contemplated in the terms of your payment or education option;
improving the EdAid service experience;developing new EdAid products and service features; and
providing information to our users about other EdAid products and services.

This may include keeping some information after you have deactivated your account for the period of time required for EdAid to conduct audits, comply with legal obligations, resolve disputes, and enforce our contracts.

This may also include processing your personal data to help you manage your payment or education option and execute our services for the education provider as set out in the terms of your payment plan or enrolment agreement, i.e. to support the education provider in managing the payment options. We also process your contact information data to send emails and other communications. There are some messages that we will need to send you. We may send you service, technical, and other administrative emails, messages, texts, phone calls, and other types of communications. We may also contact you to inform you about changes in our services and important services-related notices, such as security and fraud notices. These communications are considered part of the services and you may not opt out of them.

In addition, we may send emails about new product features, promotional communications, or other news about EdAid. As marketing messages, EdAid will ensure you have control over whether you receive such marketing emails as required by law.

We may also use your personal information in the following ways:

to identify, prevent, detect, or tackle fraud, money laundering, and other crime;
to carry out regulatory checks;
to update your records;
to assess eligibility for our products; or
to keep you informed about your account and use of the platform.

EdAid may communicate with you with respect to your payment plan or education option, including communications as a debt collector, through phone calls, emails, text messages, or through communications within our EdAid portal. By agreeing to the Terms of Service and Privacy Policy or providing a phone number, email address, or other address for communication, you are providing your express consent to receive communications from EdAid with respect to your account (including debt collections) through such email addresses, phone numbers and other methods. If others have access to any such address or phone number, the communications may be seen by those other people.

‍Information We Share
Personal Information
EdAid does not sell or rent your personal information to marketers or unaffiliated third parties. We will keep the personal information you share with us confidential and only disclose it to trusted third parties as set forth below:

to your education provider to facilitate the administration of your payment or education option;
if you ask us to or give us or your education provider your permission to do so;
to other EdAid entities in order to provide our services and for internal administration purposes;
to a credit reference agency as more fully described in the section “Credit Reference Agency” below;
to our payment partners, agents, and subcontractors, acting for us, to use for the purpose of operating our service, including the EdAid platform and obtaining payment;
to partner businesses or external companies related to recruitment and placement services;
to government bodies, including the Department for Education in relation to services administered or regulated by those bodies;
to a fraud prevention agency or agencies as outlined below in “Fraud Prevention”;
to trace debtors and recover debt;
to meet our obligations to any relevant regulatory authority or taxing authority;
if we have to by law, the law allows it, or it is in the public interest; or
if all of the assets which we use to operate our business (or substantially all of such assets) are acquired by a third party, we may transfer personal information we hold to that party so that the acquirer can continue to operate the EdAid business.

Fraud Prevention
‍Depending upon the EdAid service being provided to you, we may check your details with a fraud prevention agency or agencies, and/or share information via an organisation which provides a centralised application matching service for the purpose of preventing and detecting fraud.If you give us false or inaccurate information and we suspect fraud, we will provide details to fraud prevention agencies. We and other organisations (including law enforcement agencies) may use, search, and access the information in these records from your country of origin and other countries to investigate, prevent, or detect fraud or carry out checks against money laundering, including to:

check details on applications for credit and credit-related or other facilities;
manage credit and credit-related accounts or facilities;
recover debt;
check details on proposals and claims for all types of insurance; and
check details of job applicants and employees.

Please email team@edaid.com if you want to receive details of the relevant fraud prevention agencies.

Credit Reference Agencies
When you apply for a deferred payment product or service offered and/or administered by EdAid or guarantee any such product, we may perform credit and identity checks on you with one or more CRAs. We may also make periodic searches to the CRAs to manage your account with us or to fulfill our service obligations.

To do this, we will supply your personal information to one or more CRAs and they will give us information about you. We may share information that you give to us, information about your account, information about how you use our products and services, and information about your financial situation and financial history. CRAs will supply us with both public and shared credit, financial history, and fraud prevention information.

We will use this information to:

Confirm your identity and prevent criminal activity, fraud and money laundering;
Verify the accuracy of the data you have provided to us;
Assess your creditworthiness and whether the applicable product or service is affordable for you;
Manage your account; and
Trace and recover debts.

When CRAs receive an application search from us, they will place a search footprint on your credit file that may be seen by other third parties, including lenders. After application, we may continue to exchange information about you with the CRAs while you have a relationship with us. When this is the case, CRAs will record your outstanding debts and this information may be supplied to other organizations by CRAs.

In addition, we may request information from CRAs about changes in your circumstances that might affect your ability to repay us. This is to help us monitor your situation so we can take early action to help you manage your repayments to us. Information we may get includes any recent bankruptcies or other similar public records, any missed payments, or significant changes in your debt (including with other credit providers), together with scores created by the CRAs relating to your continuing ability to repay your borrowing.

More information about the CRAs we work with, the data they hold, the ways in which they use and share personal information, data retention periods, and your data protection rights with the CRAs can be obtained from:

UK:
TransUnion - https://www.transunion.co.uk/legal/crain-retention
‍Equifax - https://www.equifax.co.uk/crain
‍
‍US:
Equifax - https://www.equifax.com/personal/credit-report-services/
‍
‍Canada:
Equifax - https://www.consumer.equifax.ca/personal/

‍EdAid may use additional CRAs in the future to the extent necessary as we provide our services in new global markets.

‍Other EdAid Customers/Credit Providers
‍We do not disclose your personal information to any other third parties interacting with EdAid unless it is necessary to enforce your contractual obligations or you have given your consent. If you receive such information about another EdAid user, you are not permitted to use it directly, other than in communication with us about the relevant EdAid service.

In the course of generating and managing the applicable payment plans and options, and managing EdAid accounts, the EdAid platform may need to send certain transactional information to the credit provider, guarantor, or education provider (and/or their assignees) regarding the relevant payment option. We will not be liable for any use or misuse of the transactional data by others, but you must inform us of any misuse of the EdAid platform of which you are aware.

‍Payment Information
‍Generally, students make payments via credit card or direct debit automatic payments, or automated transfers. When you authorise a payment, any bank account or banking card information you provide as part of your payment information is collected and processed directly by our payment partners, currently Stripe, Dwolla, GoCardless, and Wise (formerly, Transferwise), through their checkout services. We never receive or store your full bank account or card information. These providers may use your payment information in accordance with their own privacy policies (links are below).

‍https://stripe.com/privacy
‍https://www.dwolla.com/legal/privacy/
‍https://wise.com/gb/legal/global-privacy-policy-en
‍https://gocardless.com/legal/
‍https://mercury.com/legal/privacy

‍Third-Party Service Providers
‍EdAid currently uses third-party subprocessors to provide infrastructure services, and to help us provide customer support and email notifications. Prior to engaging any third-party subprocessor, EdAid carefully vets third-party service providers and aims to select best-in-class providers, and enters into an agreement implementing the provider’s obligations. Information regarding our current subprocessors is listed here:

‍Microsoft Azure (to host customer data or provide other infrastructure that helps with the delivery of our services) Information about how Microsoft complies with privacy and data protection regulations can be found at https:privacy.microsoft.com/en-us/PrivacyStatement.

‍Amazon Web Services, Inc. (to host customer data or provide other infrastructure that helps with delivery of our services) Information about how AWS complies with privacy and data protection regulations can be found at https://aws.amazon.com/compliance/gdpr-center/.

‍Intercom, Inc. (to provide customer support and email notifications. We use third-party analytics services to help understand your usage of our services). In particular, we provide a limited amount of your information (such as the sign-up date and some personal information like your email address) to Intercom, Inc. (“Intercom”) and utilize Intercom to collect data for analytics purposes when you visit our website or use our product. As a data processor acting on our behalf, Intercom analyzes your use of our website and/or product and tracks our relationship by way of cookies and similar technologies so that we can improve our service to you.
‍
For more information on Intercom's use of cookies, please visit https://www.intercom.com/legal/cookie-policy.

We may also use Intercom as a medium for communications, either through email, or through messages within our product(s).

As part of our service agreements, Intercom collects publicly available contact and social information related to you, including, but not limited to, your email address, location, and URLs, to enhance your user experience.

For more information on the privacy practices of Intercom, please visit https://www.intercom.com/legal/privacy.

Intercom’s services are governed by Intercom’s terms of use which can be found at https://www.intercom.com/terms-and-policies#terms.

If you would like to opt out of having this information collected by or submitted to Intercom, please contact us.

‍AirCall UK Ltd provides customer support via voice calls and text messaging. A limited amount of data is shared with AirCall (such as phone number, name, location). For information about AirCall’s privacy policy, please visit https://aircall.io/privacy/.

‍MailChimp provides customer support, communication, and marketing via surveys. A limited amount of data is shared with MailChimp for both transactional and marketing communications (such as sign-up information, name, and email address) MailChimp’s services are governed by MailChimp’s terms of use which can be found at https://mailchimp.com/legal/.

‍Osano (Osano UK Compliance LTD) is a third-party cookie consent management service we use to ensure compliance with privacy regulations. For more information on how Osano tracks and uses your information please visit https://osano.trusthub.com/dpa.

‍Stripe / Dwolla / GoCardless / Transferwise is our payment service provider (an intermediary between users and EdAid for all payments). More information is in the ‘Payment Information’ section above.

‍Plaid is our Account Information Service Provider (AISP). To view the privacy policy, go to https://plaid.com/legal/.

‍Dropbox Sign (formerly known as HelloSign) is used to send, receive, and manage legally binding electronic signatures. Dropbox Sign Privacy Policy and Terms of Service can be found at https://www.dropboxsign.com/about/privacy and https://www.dropboxsign.com/about/terms.Twilio SMS and SendGrid provide services for customer notifications using email and SMS). A limited amount of data is shared with Twilio such as your phone number, email, and the content of the notification. Twilio's Privacy Policy can be found at https://www.twilio.com/en-us/legal/privacy and Terms of Service at https://www.twilio.com/en-us/legal/tos.

‍Sopro (Prospect Global Ltd) provides enterprise marketing and outreach services. A limited amount of data is shared with Sopro such as your name, email, and location. You can contact Sopro and view their privacy policy here: http://sopro.io/legal.

‍Data Retention
‍We will hold your information for as long as you have a relationship with us, e.g. you’ve applied for a payment option or you’re an existing customer with us, and for a period of time after our relationship has ended, e.g. we’ve declined your application, or you’ve closed your account. How long we’ll keep your information for will depend on the nature of our relationship, the type of information, and the purposes for which we hold it.

We’ll retain information that helps us to:

comply with legal and regulatory requirements, e.g. anti-money laundering laws and laws that require us to keep details of transactions we’ve been a party to (loan repayments, investor payments);
establish, exercise, and defend legal claims;
prevent and detect fraud;
pursue our (or a third party’s) legitimate interests, e.g. developing and improving credit risk models to help us make better lending decisions;
deal with any complaints regarding the services we’ve provided;
ensure we don’t send marketing to people who have opted out; and
maintain business records for analysis and audit purposes.

If we retain data, we do so in accordance with any limitation periods and records obligations imposed by applicable law.

‍Monitoring and Recording
‍We may monitor, record, store, and use any telephone, email, or other communication with you in order to check any instructions given to us, for training purposes, for crime prevention and to improve the quality of our customer service.

‍Security
‍We make reasonable efforts to ensure a level of security appropriate to the risk associated with the processing of personal data. We maintain organizational, technical, and administrative measures designed to protect personal data within our organization against unauthorized access, destruction, loss, alteration, or misuse. We also enter into confidentiality and data processing terms with partners to ensure they comply with high levels of confidentiality and best practices in privacy and security standards.

Specifically:

We use SSL (Secure Sockets Layer) to securely establish an encrypted connection between our users’ web browsers and our web server. This allows the user data to remain private as it gets transferred to our servers.
We use cryptography to protect users’ confidential data.
Users’ data is held on secure platforms such as AWS and Microsoft Azure, which follow strict security procedures.
Auditing is used to monitor changes to users’ data. This allows us to keep track of changes in users’ data and who made the change and when.

Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that any interaction with us is no longer secure, please contact us immediately.

‍International Data Transfers
‍EdAid is a growing global business. We may transfer, store, and process your personal information in any country where we have operations or where we engage service providers, including countries other than the country in which the information was originally collected. These countries may have data protection laws that are different from those of your country. If so, we will ensure the information is held securely in accordance with applicable law and the standards as set out in this policy.

If you are located in the EU/EEA, we do not process your personal data outside the EU/EEA, unless adequate safeguards are in place for business purposes.

‍Your Rights (Accessing Your Information)
‍Depending on your location and subject to applicable law, individuals may have certain statutory rights in relation to the personal data we have about you, including, the right to request access to your information, as well as to seek to update, delete, or correct this information, the right to opt-out of marketing-related emails. You can make any such request in writing by contacting us at team@edaid.com.

You have the following rights if you are located within the EU/EEA:

Request access to your personal data in order to receive a copy of the personal data we hold about you.
Request correction of the personal data that we hold about you in order to have any incomplete or inaccurate information corrected, though we may need to verify the accuracy of the new information you provide to us.
Request erasure of your personal data in order to ask us to delete or remove personal data where there is not a good reason or legitimate interest for us to continue processing it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. For example, where we have a legal obligation to retain and store your personal data.
Request restriction of processing of your personal data in order to ask us to suspend the processing of your personal data.
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data which you initially provided consent for us to use or where we used the personal data to perform a contract with or provide services to you.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms. You may, in particular, control the extent to which we market to you and you have the right to request that we stop sending you marketing messages at any time.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. In particular, you may opt out of receiving promotional emails from us by following the instructions in those emails. If you opt-out, we may still send you non-promotional emails, such as emails about our ongoing business relations.
Contact your local supervisory authority, the government agency charged with the enforcement of privacy laws, for information about your rights as a data subject and, in certain circumstances, seek redress for violations of your privacy rights.

Use by Minors
‍The services provided by EdAid are not directed to individuals under the age of thirteen (13) and we request that any such persons not provide any personal information through our service or platform. If we learn that a child under the age of thirteen (13) has provided information, we will promptly take all reasonable steps to delete such data from our system.

‍Changes to the Privacy Policy
‍EdAid may change this Privacy Policy from time to time to reflect new services, changes in our data protection practices, or relevant laws, regulations, and industry standards. We will post the changes to this page and encourage you to review our Privacy Policy to stay informed. If we make changes that materially alter your privacy rights, EdAid will send a notice of this change to all of our users. Any changes are effective when we post the revised Privacy Policy.

‍Links to Other Websites
‍The EdAid platform or website may provide the ability to connect to other websites. These websites may operate independently from us and may have their own privacy notices or policies. We strongly suggest you review such notices or policies as EdAid is not responsible for the content or any use or any privacy practices of the operator of any such website not owned or controlled by us.

‍Data Protection Authority
‍Subject to applicable law, you also have the right to (i) restrict EdAid's use of information that constitutes your personal information and (ii) lodge a complaint with your local data protection authority.

‍Jurisdiction-specific Provisions
‍Australian residents. The EdAid entity that provides services in Australia is EdAid AU Pty. Ltd. Please see our Australian Privacy Policy. Residents of the European Economic Area (EEA), the UK and Switzerland. The entity responsible for the collection and processing of personal data for residents of the EEA and the UK is EdAid Ltd. If you are a resident of the EEA and believe we maintain your personal information within the scope of the General Data Protection Regulation (GDPR), you may direct questions or complaints to your local data protection authority. If you are a resident of the UK, you may direct your questions or concerns to the UK Information Commissioner's Office.

‍Contacting EdAid
‍Please feel free to contact EdAid if you have any questions about this Privacy Policy or EdAid’s practices, or if you are seeking to exercise any of your statutory rights. You may contact us at team@edaid.com.

QardHasan Privacy Policy

Our offices

London

New York

Toronto