Privacy policy.

01Who we are

Afghanistan Education Action (AEA) runs free online schools for women and girls from Afghanistan. We are a charitable incorporated organisation registered with the Charity Commission for England and Wales, number 1208464.

We are the data controller for the information described in this policy. You can reach us through the form on this site or by post:

02What we collect

We only ask for what we need, and only when you choose to give it:

• When you contact us — your name, email address, country, the organisation you represent if you tell us, and whatever you write in your message.
• When you apply to volunteer — the details in the application form, described in section 05 below.
• When you sign up as a student — the details in the student sign-up form, described in section 06 below.
• When you donate — your name, email address, postal address where you give it, the amount and date of your gift, and your Gift Aid declaration if you make one.
• When you ask for updates — your name and email address.
• When you visit — basic technical information your browser sends, such as the pages you opened and the kind of device you used.

We do not ask for anything we have no use for, and we never require you to create an account to read this site.

03How we use it

We use your information to reply to you, to process and acknowledge donations, to claim Gift Aid where you have authorised it, to keep the records a UK charity is required to keep, and to send you the updates you asked for.

We rely on your consent for marketing emails, on our legitimate interest as a charity for replying to enquiries and keeping supporter records, and on our legal obligations for financial and Gift Aid records.

We will not use your details for anything you did not expect when you gave them to us.

04Donations and card details

Donations made through this website are paid on a secure page run by Stripe, a regulated payment provider. Your card number never passes through our website and is never stored by us.

We also receive gifts by cheque, by bank transfer and through CAF. Where a gift reaches us through another platform, that platform handles the payment under its own privacy policy and passes us the donor details needed to thank you and to claim Gift Aid.

We can see that you gave, when, and how much. We cannot see your card details.

05Volunteering and identity checks

When you apply to volunteer, we hold the details you give in the application form: your name, contact details, date and place of birth, nationality and country; your qualifications; the role, schools and subjects you are interested in; the languages you work in; your availability; what you tell us about your experience and why you want to volunteer; and a record of the volunteer commitments you accepted, with the date. We use them to assess your application, to give you a volunteer ID and an online volunteer account, and to organise your volunteering. Only the small AEA team that manages volunteers can see them. We rely on our legitimate interest in recruiting and supporting volunteers safely.

Identity checks

Our volunteers work with young people, many of whom face real danger, so before you start we confirm that you are who you say you are. If your application is approved, you complete a short online identity check with our verification partner, Didit (didit.me).

• What Didit collects — a photo of an identity document, such as a passport, national ID card or driving licence; a selfie; and basic information about the device and internet connection you use.
• What Didit does with it — checks that the document is genuine and that your selfie matches the photo on it. Didit acts as our data processor: it may use your information only to carry out the check for us, and it processes it within the European Union.
• What AEA receives — the result (verified or not verified), the date, Didit’s reference number, and from your document only your name as printed on it, the sex shown on it, the country that issued it and the type of document. We use these to confirm that the document matches your application. AEA never receives, sees or stores your document images, your selfie or any other details on the document.
• When it is deleted — Didit keeps your document images and selfie for one month after your check, so that a doubtful result can be reviewed, and then deletes them automatically.

Because the check compares your face with the photo on your document, it involves biometric data, which the law treats as special category data. We only carry out the check with your explicit consent, which you give on the application form. You can withdraw that consent at any time before the check is complete. If you would prefer not to verify your identity online, contact us and we will discuss an alternative with you.

Volunteer agreement

Approved volunteers sign our volunteer agreement online in their volunteer account, by typing their full name and confirming. With your signature we record the version of the agreement you signed, the date and time, your IP address and the type of browser you used, so that we can show what was agreed and when. This record stays on AEA’s own systems, is not shared with any signing service, and is kept with your volunteer record.

06Students of Herat Online School

When a student signs up for Herat Online School on our student sign-up form, we hold the details they give: their name, their father’s and mother’s names, gender, date and place of birth, tazkira number if they give it, province, district and where they live now, their last level of education, email address, phone number and Telegram ID; and the name, relationship and phone number of a family member or other person responsible for their studies. We also record that they accepted the school rules and confirmed their details, when they did so, and the internet address the form was sent from. Once their identity check is complete or under review, each student is given a student ID, such as AEA-H-260001.

We use these details to organise the student’s place at the school, to contact the student and their responsible person about their studies and attendance, and to keep our classes safe. Only the small AEA team that runs the school’s admissions can see them. We rely on our legitimate interest in running a safe school, and on explicit consent for the identity check described below.

We email the student a private link to the page that shows the progress of their sign-up, and later their student ID. The school asks students to send their student ID to the school’s Telegram account; Telegram’s own privacy policy applies to that message.

Identity checks for students

At the end of the form, students confirm their identity with our verification partner, Didit, in the same way as volunteers. Didit collects a photo of the student’s tazkira or passport, a selfie and basic information about their device and connection, and checks that the document is genuine and that the selfie matches it. AEA receives only the result, the date, Didit’s reference number and, from the document, the name as printed on it, the sex shown on it, the country that issued it and the type of document. AEA never receives, sees or stores the document images or the selfie. Didit acts as our data processor and deletes the images as described in section 05.

Because the check involves biometric data, we only carry it out with the explicit consent the student gives on the form, and a student can withdraw it at any time before the check is complete. Students under 18 also confirm that their parent, guardian or responsible person knows about the sign-up and the identity check. If a student would prefer not to verify their identity online, they can tell the school and we will discuss an alternative.

07Emails and updates

We will only email you updates if you have asked us to, by ticking the box on our donation form. We will not spam you and we will not cold call you.

When you tick it, your name and email address go to our team, who send updates from AEA’s own email accounts. To stop them, reply to any of our emails or contact us, and we will take you off our list straight away.

If we move our mailing list to an email service, we will update this page first and name the service here.

08Cookies

This site uses only the cookies it needs to work, plus any set by Stripe's payment page and other content we embed from our service providers. We do not use cookies to build an advertising profile of you, and we do not sell what we learn about your visit.

If we use a website analytics service to understand which pages people find useful, it is configured to report visits in aggregate rather than to identify you.

You can block or delete cookies in your browser settings. aboutcookies.org explains how for every major browser; blocking them may stop the payment page from working.

09Keeping your information safe

This site is served over an encrypted connection, so anything you send us travels privately between your browser and us.

Inside AEA, access to supporter and donor records is limited to the small number of staff and trusted volunteers who need it to do their job. Our records are held in reputable, access-controlled systems, and our payment providers are regulated firms that specialise in handling card data.

10Who we share it with

We never sell, rent or trade your information.

We share it only with the service providers that help us operate — our payment provider (Stripe), our email platform, our identity verification partner (for approved volunteers and for students) and the systems that hold our supporter records — and only so far as they need it to provide that service. They are bound to keep it secure and may not use it for their own purposes.

We may also disclose information where the law requires it, for example to HMRC in support of a Gift Aid claim, or to protect someone from harm.

11How long we keep it

We keep your information only as long as we have a reason to. Enquiries are kept while we are dealing with them and for a short period afterwards. Donation and Gift Aid records are kept for the period HMRC requires of charities. Mailing list details are kept until you unsubscribe or ask us to remove them.

Volunteer applications and records are kept while you volunteer with us and for a limited period afterwards, in line with our safeguarding duties. If your application is not taken forward, we delete it once it is no longer needed. The result of your identity check, with the name, sex, issuing country and type of document it confirmed, is kept with your volunteer record; the documents and selfie themselves are deleted as described in section 05.

Student sign-ups are kept while the student studies with us and for a limited period afterwards, in line with our safeguarding duties. Sign-ups that do not lead to a place at the school are deleted once they are no longer needed.

12Protecting our students

Our students, teachers and volunteers inside Afghanistan face real risk for taking part in education. Their safety comes before our communications.

So we change names, withhold identifying details and do not publish photographs that could identify a student or a classroom. Where a student is quoted on this site under a single name, that name has been changed. Where a photograph shows a classroom, it has been created for us rather than taken in one.

If you work with us as a volunteer or teacher, we will never publish your details without asking you first.

13Your rights

Under UK data protection law you can ask us to:

• tell you what information we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete your information, where we have no continuing reason to keep it;
• stop using it for a particular purpose, or stop emailing you;
• withdraw a consent you gave us earlier.

Just ask, and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

14Changes to this policy

We review this policy from time to time and will post any changes on this page. This version is effective from 3 November 2026, and replaces our previous policy.