Privacy Policy
Privacy Policy
Contents
- Introduction and scope
- Who is responsible
- Personal data we collect
- How we use personal data, and why we may
- Artificial intelligence and your data
- WhatsApp and messaging
- Sharing and sub-processors
- Hosting and data residency
- International transfers
- Retention
- Security
- Children
- Your rights
- How to exercise your rights
- Do Not Track and automated decisions
- Changes to this Policy
- Contact and complaints
1. Introduction and scope
This Privacy Policy explains how [legal entity name] ("we", "us") collects, uses, shares, and protects personal data on this website (the "Website"). It applies to visitors and to people who submit our demo or contact forms.
It does not govern data processed inside the SchoolOS platform on behalf of customer schools — including student, parent, and staff records. For platform data, each school is the data controller and the Operator acts as a data processor under that school's Data Processing Agreement ("DPA"), which prevails for that data.
2. Who is responsible
For Website data, the controller is [legal entity name], [registered address]. Privacy contact: [privacy contact email]. [Counsel to confirm whether a Data Protection Officer or India DPDP Grievance Officer must be designated and named here.]
3. Personal data we collect
3.1 Data you give us
When you submit the demo form: your name, role, school name, country, approximate student count, WhatsApp number, work email address, preferred demo language and time, and any free-text notes you add. When you correspond with us by email, phone, or WhatsApp: the content of those communications.
3.2 Data collected automatically
Standard technical data that web infrastructure logs for security and reliability, such as IP address, browser type and version, device type, referring page, pages requested, and timestamps. See our Cookie Policy for cookies and similar technologies — currently, this Website sets no advertising or analytics cookies.
3.3 Data we do not collect here
We do not knowingly collect data about children on this Website, and we do not collect special-category/sensitive data here. Please do not include student names or other children's data in the free-text field.
4. How we use personal data, and why we may
| Purpose | Data used | Legal basis [per applicable regime — counsel to finalise] |
|---|---|---|
| Responding to your enquiry and arranging your demo | Form data; communications | Consent / steps prior to a contract / legitimate interests |
| Following up about SchoolOS after your enquiry | Form data | Consent / legitimate interests [confirm soft opt-in rules per market] |
| Security, abuse prevention, and reliability of the Website | Technical logs | Legitimate interests / legal obligation |
| Complying with law and enforcing our terms | Any of the above as required | Legal obligation / legitimate interests |
We do not sell personal data, and we do not use Website data for third-party advertising.
5. Artificial intelligence and your data
Personal data submitted on this Website is never used to train AI models. For customer schools: student and staff data processed in the SchoolOS platform is likewise never used to train SchoolOS AI models, and AI-generated content concerning a child is released to parents only after review and approval by school staff, as set out in the applicable DPA and product documentation.
6. WhatsApp and messaging
If you give us a WhatsApp number, we will use it to respond to your enquiry and coordinate your demo. WhatsApp is operated by a third party under its own terms and privacy policy; message metadata and content are processed by that platform in accordance with its policies. You can ask us to switch to email at any time.
7. Sharing and sub-processors
We share Website personal data only with: (a) service providers who help us operate — such as form/CRM tooling, email delivery, and hosting — bound by confidentiality and data-protection obligations; (b) professional advisers under confidentiality; (c) authorities where disclosure is required by law; and (d) a successor entity in a merger, acquisition, or reorganisation, subject to this Policy. [Counsel to attach the sub-processor list at launch and confirm onward-transfer terms.]
8. Hosting and data residency
Customer platform data is hosted in the GCC region by default, or within a school's own private cloud in any region the school requires, as specified in that school's Customer Agreement. Website enquiry data is stored in [confirm hosting location of the form backend at launch].
9. International transfers
Because we operate across India and the GCC, Website enquiry data may be transferred across borders. Where a transfer is regulated, we will use lawful transfer mechanisms appropriate to the exporting regime [counsel to document: KSA PDPL transfer rules, UAE PDPL Articles 22–23, GDPR SCCs/adequacy, India DPDP s.16].
10. Retention
| Data | Retention period |
|---|---|
| Demo/enquiry form data | [e.g., 24 months from last contact — counsel to set] |
| Email/WhatsApp correspondence | [e.g., 24 months from closure of enquiry] |
| Security logs | [e.g., 12 months] |
After the applicable period we delete or irreversibly anonymise the data, unless longer retention is required by law or to establish, exercise, or defend legal claims.
11. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls on a need-to-know basis, environment separation, and vendor due diligence. No system is perfectly secure; if we become aware of a breach affecting your data, we will act in accordance with applicable breach-notification laws [counsel to map notification duties: SDAIA (KSA), UAE Data Office, GDPR 72-hour rule, India DPDP/CERT-In].
12. Children
This Website is directed at school decision-makers, not children, and we do not knowingly collect children's personal data through it. If you believe a child has submitted data here, contact us and we will delete it.
Within the SchoolOS platform, children's data is processed only on the documented instructions of the customer school under its DPA, with safeguards including role-based access, teacher-in-the-loop review of AI-generated content about students, and hosting choices controlled by the school. [Counsel to verify parental-consent and children\u2019s-data provisions per market: India DPDP s.9, KSA PDPL, UAE PDPL, GDPR Art. 8.]
13. Your rights
Depending on where you live, you may have rights including: access to your personal data; correction of inaccurate data; deletion/erasure; objection to or restriction of processing; withdrawal of consent at any time (without affecting prior processing); portability; and the right not to be subject to solely automated decisions with legal or similar effects (we make none on this Website).
By regime [counsel to finalise the mapping below]
- Saudi Arabia (PDPL): rights of access, correction, destruction, and withdrawal of consent, exercisable with the controller and, on escalation, with the competent authority (SDAIA).
- UAE (Federal PDPL): rights of access, rectification, erasure, restriction, objection, and portability, with escalation to the UAE Data Office.
- EU/UK (GDPR/UK GDPR): the full set of Articles 15–22 rights, with complaint to your supervisory authority.
- India (DPDP Act 2023): rights of access, correction and erasure, grievance redressal, and nomination; complaints may be escalated to the Data Protection Board of India.
14. How to exercise your rights
Write to [privacy contact email] with your request. We may need to verify your identity before acting. We aim to respond within the timelines required by the applicable law [e.g., 30 days GDPR; counsel to set per regime]. Exercising your rights is free of charge except where the law permits a reasonable fee for manifestly excessive requests.
15. Do Not Track and automated decisions
This Website does not track visitors across third-party sites and therefore does not respond differently to browser "Do Not Track" signals. We carry out no automated decision-making or profiling with legal or similarly significant effects on Website visitors.
16. Changes to this Policy
We may update this Policy from time to time; the version on this page applies from its effective date. Material changes will be flagged prominently where reasonably practicable.
17. Contact and complaints
Privacy questions, requests, or complaints: [privacy contact email] · [legal entity name], [registered address]. If you are unsatisfied with our response, you may complain to the supervisory authority in your jurisdiction, including those listed in section 13.