Privacy Policy

Who is responsible for your data

Ajwa Hub is the data controller for the purposes of UK and EU data protection law and the business responsible for the personal information described here under US state privacy law.

Email [email protected] for anything in this policy. We answer rights requests at [email protected], so a request sent through a social media message or a blog comment will be redirected rather than actioned.

What this policy covers

It covers the website at the domain you are reading, including the Arabic section at /ar/, every article, every policy page and the contact form.

It does not cover sites we link to. When you click through to a seller, a research database, a Hadith collection or any other external site, that site’s own privacy policy governs what happens next. We have no visibility into what those sites collect, and linking to a merchant does not make us a joint controller of what the merchant does with your visit. The same applies to any social platform where our pages are shared.

What we collect, and how

Why we use it, and the lawful basis for each purpose

Under UK and EU GDPR every use of personal data needs a lawful basis. This table sets out ours. Where the basis is consent you can withdraw it at any time and we stop; where the basis is legitimate interests you can object and we will weigh your objection against the interest in question and tell you the outcome.

We do not use your data for automated decision-making that has a legal or similarly significant effect on you, and we do not profile readers for credit, insurance, employment or pricing purposes.

Cookies and similar technologies

Cookies, local storage, session storage and pixel tags are all ways of putting information on your device or reading it back. They are covered in detail on the cookie policy and consent page, which describes the cookie types in use, what each type does, and how consent works for each type.

The short version: strictly necessary cookies are set because the site cannot function without them. Everything else, including analytics, preference storage and any advertising technology, waits for your consent. You can change or withdraw that consent at any time from the cookie settings control, and withdrawing it is as easy as giving it.

Advertising and affiliate tracking

Ajwa Hub may earn from affiliate links, and may in future carry display advertising. Both have privacy consequences, so they are described here rather than buried in a commercial page.

An affiliate link usually works by appending an identifier to the destination URL and setting a cookie on the merchant’s domain. That cookie belongs to the merchant or the network, not to us. It records that the visit came from this site so that a commission can be attributed, and it typically expires after a set window. We see the resulting reports as counts, not as a list of people.

Display advertising, if it is introduced, is a bigger step. Behavioural or personalised advertising involves third parties setting their own identifiers and, in some configurations, sharing data for cross-context behavioural advertising, which has a specific meaning under California law. If display advertising is introduced, including through an advertising network such as Google AdSense, ads may be served based on your prior visi to this and other sites, Google and its partners may use cookies for ad delivery and measurement, and you can opt out of personalised advertising through Google Ads Settings and at aboutads.info. No advertising vendor will run on this site before consent is obtained, the vendor will be named in this policy and in the cookie policy before it goes live, and the US state law section below will be revised at the same time.

The commercial side of this, which programmes we are in and how products are chosen, is disclosed separately on the affiliate and advertising disclosure page. That page is about editorial independence. This section is about data.

Service providers we rely on

We use a small number of outside providers to run the site. Under UK and EU GDPR most of them act as processors, meaning they handle data on our instructions and are not free to use it for their own purposes. Analytics and advertising vendors are the usual exception, because some of them act as controllers in their own right for part of what they do.

Any category not actually in use on this site is removed from the table rather than left unexplained. Each provider is engaged under terms that include data protection commitments, and where UK or EU law requires a written processor agreement we have one in place.

We do not sell personal information, and we do not disclose it to anyone outside the categories in the table above except where we are legally required to, for example in response to a valid court order or a lawful request from a regulator.

Sending data outside your country

Some providers in the table above process data outside the country where you are reading. For readers in the UK or the EU this means a restricted international transfer, which is lawful only with a recognised safeguard in place.

The safeguards available are an adequacy decision covering the destination country, the Standard Contractual Clauses for EU transfers, the UK International Data Transfer Agreement or the UK Addendum to the SCCs for UK transfers, and in narrow cases a specific derogation. We rely on one of these for every provider that processes data outside the UK or the EU, and which one applies to which provider is recorded in the vendor block alongside this policy.

If you want to know which safeguard covers a particular provider, ask at [email protected] and we will tell you. Where a safeguard is contractual rather than an adequacy decision, you are entitled to a copy of the relevant clauses with commercially confidential terms redacted.

How long we keep information

The principle is simple: we keep something for as long as the purpose it was collected for still exists, and then we delete it. These are the periods we work to.

Keeping it secure

The site is served over HTTPS. Administrative access is restricted, protected by strong unique credentials and multi-factor authentication where the platform supports it, and the software stack is kept patched. Backups are taken so that the site can be restored after a failure.

No security measure is absolute and we will not pretend otherwise. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe the law requires, and we will notify affected readers directly where the risk is high.

Your rights if you are in the UK or the EU

Under the UK GDPR and the EU GDPR you have the following rights. They are not absolute, and some of them apply only in particular circumstances, but we will always tell you which one we are relying on if we cannot give you what you asked for.

Access

You can ask for confirmation of whether we hold personal data about you, a copy of it, and an explanation of what we do with it.

Rectification

You can have inaccurate data corrected and incomplete data completed.

Erasure

You can ask us to delete data where it is no longer needed for the purpose it was collected for, where you withdraw consent and there is no other basis, or where you successfully object to processing based on legitimate interests. This is a qualified right, not an unconditional one.

Restriction

You can ask us to stop using data, while keeping it, in defined situations such as while a dispute about its accuracy is resolved.

Objection

You can object to processing based on legitimate interests, and you can object at any time to direct marketing, which we will always honour without argument.

Portability

Where processing is based on consent or contract and is carried out by automated means, you can ask for your data in a structured, commonly used, machine-readable format.

Withdrawal of consent

Where we rely on consent, you can withdraw it at any time. Withdrawal does not make the earlier processing unlawful, but it stops any further processing on that basis.

Complaint

You can complain to a supervisory authority. Details are below.

If you are in the United States

Several US states now give residents privacy rights. California’s framework under the CCPA as amended by the CPRA is the most developed, and Virginia, Colorado, Connecticut, Utah and a growing list of other states have their own statutes. Each applies only to businesses that cross defined thresholds, usually based on revenue or on the volume of consumer data handled.

Whether this site meets any of those thresholds is a question of fact about the operator. Where a statute does apply, the following rights are the ones it typically confers, and we will honour them on request regardless of whether we are strictly obliged to:

• The right to know what categories of personal information we collect, the purposes, and the categories of third parties we disclose it to
• The right to access a copy of the specific pieces of personal information we hold
• The right to delete personal information, subject to the exceptions in the statute
• The right to correct inaccurate personal information
• The right to opt out of the sale of personal information and of sharing for cross-context behavioural advertising
• The right to limit the use of sensitive personal information
• The right not to be discriminated against for exercising any of these rights

On the two that cause the most confusion: we do not sell personal information for money. If behavioural advertising is introduced, the data flows it involves may count as a “sale” or as “sharing” under California’s definitions even with no money changing hands, and in that case a “Do Not Sell or Share My Personal Information” link will be added to the site footer and this section will be rewritten before the advertising goes live.

We also accept opt-out preference signals, including Global Privacy Control, where the browser or extension sends one.

An authorised agent may submit a request on your behalf. We will ask for proof that you authorised them.

How to exercise your rights

1. Email [email protected], and say which right you are exercising. “Send me everything you hold” is a valid access request; you do not need to use legal language.
2. Tell us how to identify you in our records. For a newsletter request that means the subscribed email address. For a comment it means the comment and the article. For a server log or analytics request, be aware that we usually cannot link an IP address to you without you telling us when and from where you visited, and we will say so rather than pretend to search.
3. Expect a reply within one month for UK and EU requests, which can be extended by two further months for complex requests, in which case we will tell you inside the first month and explain why. US state statutes generally set 45 days with a permitted extension.
4. There is no fee for a first request. We may charge a reasonable administrative fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain the reason if we ever do.

Children

Ajwa Hub is written for adults. We do not direct any part of the site at children, we do not knowingly collect personal data from children, and nothing on the site requires an account or an age declaration.

Some of our nutrition content discusses dates in children’s diets. That is content written for the adult making the decision, not for the child.

If you believe a child has sent us personal data, for example through the contact form or a comment, email us at [email protected] and we will delete it. We treat a credible report as sufficient reason to delete without requiring proof first.

Where consent is the basis for processing and the reader is a child, UK GDPR sets the age at which a child can consent to information society services at 13, and EU member states set it anywhere between 13 and 16.

Making a complaint

Raise it with us first if you can. Email us at [email protected], say what went wrong, and we will investigate and reply.

You do not have to come to us first, though. If you are in the UK or the EU you have the right to complain directly to a supervisory authority: in the UK that is the Information Commissioner’s Office, and in the EU it is the data protection authority of the country where you live, where you work, or where the alleged infringement took place.

If you are in California you can report a concern to the California Privacy Protection Agency or the California Attorney General. Other states route complaints through their own Attorney General’s office.

You also have the right to seek a judicial remedy, and none of the above takes that away.

Changes to this policy

We update this page when what we do changes, not on a schedule. The triggers are concrete: adding or replacing a service provider, introducing advertising, starting or stopping the newsletter, enabling or disabling comments, changing a retention period, or a change in the law that affects what we have to tell you.

How changes are communicated

• The Last updated date at the top of this page changes on every substantive edit, and the page’s dateModified field changes with it.
• A short summary of what changed is added directly beneath the Last updated line and kept there for at least 30 days, so a returning reader can see the difference without rereading the whole document.
• For a material change, meaning a new category of data, a new purpose, a new third party with access, or anything that would require fresh consent, we give notice before it takes effect: a notice on the site, an email to newsletter subscribers, and where the change affects cookies, a re-prompt of the consent banner so that consent is collected again rather than assumed.
• Typographical corrections that do not change meaning are made without notice.

Earlier versions are kept so that we can say what the policy said on a given date. Ask at [email protected] if you need a copy.

Return to the contents list