How we handle your information
Plain language, and specific to this website. If something here is unclear, ask us — we would rather explain it than have you guess.
This text was written against what the website actually does with your information, but nobody at VCan Academy has reviewed or signed it off, and no lawyer has checked it. The project brief requires a named person at the academy to own and approve this page before launch. Until then, treat it as a working draft rather than a statement you can rely on.
What this covers
VCan Academy runs this website and the admissions system behind it. This page explains what personal information the site collects, why we collect it, who else handles it, and how long we keep it. It covers the website. What happens on paper at a campus is not described here.
What we collect
Only what you give us, plus a small amount your browser sends with it.
- Enquiry form — your name, phone number, email address, the campus and course you asked about, how you heard about us, and anything you write in the message box.
- Sent automatically with an enquiry — the page you sent it from, the language you were reading in, any campaign tags in the link you followed, and a one-way hash of your IP address used only to stop automated abuse.
- Event registration — your name, phone number, email address if you give one, and how many people you are bringing.
- Placement test — your name, phone number, email address and preferred campus before the test begins, then your answers, your score and how long you took.
- Newsletter — your email address, the language you signed up in, and where on the site you signed up.
- Students and guardians — once someone enrols we hold their name, phone, email, campus and the batches they joined. Where the student is under eighteen we also hold a guardian's name, relationship, phone and email.
We never ask for a CNIC number, and this website takes no payments, so we hold no card or bank details.
Students under eighteen
Where a student is recorded as a minor, service messages about their classes — a cancellation, a change of schedule, a batch starting — go to their guardian rather than to them. Permission to publish a photograph or a testimonial of a minor is the guardian's to give, and we record who gave it. If you are a parent or guardian and want to see, correct or remove what we hold about your child, write to us.
What we use it for
To reply to you, to send the confirmation email that follows an enquiry, to run admissions and enrolment, and to send enrolled students service messages about their own classes. Enquiries are worked by staff at the campus you chose: staff at one campus cannot open another campus's enquiries.
Marketing email
The enquiry form has an optional box for occasional news about courses and events. Leave it unticked and we will only contact you about your enquiry. The newsletter is double opt-in: we store your address unconfirmed, email you a confirmation link, and add you to the list only when you click it. Every newsletter carries an unsubscribe link, and unsubscribing is recorded here as well as with our email provider.
Who else handles it
We use a small number of service providers. They process your information on our instructions, and for no purpose of their own.
- Neon — the database that stores the records described above.
- Vercel — hosting for the website and its scheduled jobs.
- Brevo — sends our email, and will send SMS to enrolled students once sender registration is complete.
- Cloudinary — stores and serves the images and documents you see on the site.
- Google — only for academy staff who sign in with a Google account. Visitors never sign in.
Their servers are outside Pakistan, so your information is transferred and stored abroad.
Analytics and advertising
The academy plans to use Google Analytics, to see which pages bring in enquiries, and the Meta (Facebook) Pixel, to measure its Facebook advertising. Neither is switched on. Nothing on this site loads a Google or Meta script today, and no analytics or advertising cookie is set. When they are switched on, a consent banner will ask first, nothing will load until you answer it, and this page will be updated to say what each one stores.
Cookies
Academy staff who sign in to the admin get a session cookie; it keeps them signed in and is cleared when the session ends. Nothing else on the site needs a cookie from an ordinary visitor today. Analytics and advertising cookies, if they are ever switched on, will be set only after you accept them.
Messages we keep
Every email, SMS and WhatsApp message we send about your enquiry or your enrolment is written to a message log, so staff can see what has already been said to you. One honest caveat about WhatsApp: we can only record that a member of staff opened a WhatsApp conversation. We cannot record whether the message was delivered or read.
How long we keep it
Records are removed, or stripped of names, on this schedule:
- Enquiries — 24 months from the last contact, after which the name, phone and email are cleared. The campus, course and source stay, with no name attached, so the academy can still see where its students come from.
- Students and enrolments — while the student is active, and for 36 months after their last enrolment ends.
- Message logs — 24 months.
- Placement test submissions — 12 months.
- The hashed IP address stored with an enquiry — 30 days.
- Anything deleted in the admin sits in a trash bin for 30 days, then goes for good.
These periods are proposed and have not yet been confirmed by the academy. Until they are, the job that applies them runs in report-only mode: it counts what would be removed and removes nothing.
Your rights, and how to reach us
You can ask to see what we hold about you, to have it corrected, or to have it deleted. Speak to any campus, or write to us. We will need to be reasonably sure who you are before we act, and where the request concerns a student under eighteen it should come from their guardian.
Changes to this page
We will update this page when what we do changes, and the date at the top will change with it.