Privacy Policy

1. Introduction
Al Ain American School (“the School,” “we,” “us,” or “our”) is committed to safeguarding the privacy and personal data of its students, parents and guardians, employees, visitors, and other stakeholders. This Privacy Policy outlines how the School collects, uses, stores, discloses, and protects personal data in accordance with:
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
- Applicable regulations issued by relevant UAE authorities, including ADEK
- International best practices aligned with American education standards

This Policy applies to all personal data processed by the School in both physical and digital formats.

2. Scope of This Policy
This Privacy Policy applies to:
•    Students (current, former, and prospective)
•    Parents and legal guardians
•    Employees and job applicants
•    Contractors, service providers, and volunteers
•    Visitors to the School premises and website

3. Definitions
For the purposes of this Policy:
•    Personal Data: Any information relating to an identified or identifiable individual.
•    Sensitive Personal Data: Data relating to health, biometric data, special educational needs, or any data classified as sensitive under UAE law.
•    Data Subject: The individual to whom the personal data relates.
•    Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
•    Data Controller: Al Ain American School, which determines the purposes and means of processing personal data.

4. Types of Personal Data We Collect
4.1 Student Personal Data
•    Full name, date of birth, nationality
•    Emirates ID and/or passport details (where required)
•    Academic records, grades, assessments, transcripts
•    Attendance records
•    Behavioral and disciplinary records
•    Health and medical information
•    Special educational needs or learning support information
•    Photographs, videos, and audio recordings
•    Transportation and extracurricular activity records
4.2 Parent/Guardian Personal Data
•    Names and contact details
•    Emirates ID or passport information (where required)
•    Emergency contact information
•    Communication records with the School

4.3 Staff Personal Data
•    Identification and contact details
•    Qualifications, certifications, and employment history
•    Payroll, banking, and benefits information
•    Performance evaluations
•    Background and safeguarding checks as required by law
4.4 Technical and Digital Data
•    Website usage data and cookies
•    Learning Management Systems (LMS) and Student Information Systems (SIS) data
•    Email and portal communications
•    CCTV footage collected on School premises

5. Purpose of Data Collection and Processing
The School collects and processes personal data for the following purposes:
•    Student enrollment, registration, and administration
•    Delivery of academic instruction and assessment
•    Monitoring attendance, behavior, and academic progress
•    Student wellbeing, health, and safeguarding
•    Communication with parents and guardians
•    Compliance with ADEK, Ministry, and legal obligations
•    Operation of transportation, activities, and events
•    Employment administration and human resources management
•    Maintenance of School security and safety
•    Operation of digital platforms and IT systems

6. Legal Basis for Processing
Personal data is processed based on one or more of the following legal grounds:
•    Consent of the data subject or parent/guardian
•    Performance of contractual obligations (e.g., enrollment agreements)
•    Compliance with legal and regulatory requirements
•    Protection of vital interests of students and staff
•    Legitimate interests of the School, including safety and operational needs

7. Consent
Where required, the School obtains clear and informed consent from parents or legal guardians, particularly for:
•    Processing sensitive personal data
•    Use of student images, videos, or recordings
•    Participation in trips and extracurricular activities

Consent may be withdrawn at any time, subject to legal and operational limitations. Withdrawal of consent may affect the School’s ability to provide certain services.

8. Data Sharing and Disclosure
The School may share personal data with:
•    Authorized School employees on a need-to-know basis
•    Government authorities and regulators (e.g., ADEK)
•    Examination boards and accreditation bodies
•    Technology and educational service providers
•    Transportation, medical, and support service providers
All third parties are required to adhere to appropriate data protection and confidentiality obligations.

9. Cross-Border Data Transfers
Some personal data may be transferred outside the UAE, particularly when using international educational platforms or systems. In such cases, the School ensures appropriate safeguards are in place in accordance with UAE PDPL requirements, including contractual protections and secure data transfer mechanisms.

10. Data Retention
The School retains personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Retention periods vary depending on the type of data and regulatory requirements. Data is securely deleted or anonymized once it is no longer required.

11. Data Security
The School implements appropriate technical, administrative, and physical safeguards to protect personal data, including:
•    Secure access controls and authentication
•    Encryption and secure IT systems
•    Restricted access to physical records
•    Staff training on data protection and confidentiality
•    Regular monitoring and review of security measures

12. Rights of Data Subjects
In accordance with UAE PDPL, data subjects (or parents/guardians on behalf of students) have the right to:
•    Request access to personal data
•    Request correction or updating of inaccurate data
•    Request erasure of data where legally permissible
•    Restrict or object to certain processing activities
•    Withdraw consent where processing is based on consent

Requests may be submitted to the School using the contact details provided below.

13. Student Privacy and Safeguarding
The School recognizes that students are minors and affords their personal data enhanced protection. Special care is taken when processing student data, particularly in digital learning environments, media usage, and safeguarding-related matters.

14. CCTV and Monitoring
CCTV systems are used on School premises solely for safety, security, and safeguarding purposes. Access to recordings is strictly limited, and footage is retained only for a defined period unless required for investigation or legal purposes.

15. Website Cookies and Online Services
The School website may use cookies and similar technologies to enhance user experience and monitor website performance. Users may manage cookie preferences through their browser settings.

16. Data Breach Management
In the event of a personal data breach, the School will take prompt action to contain and mitigate the breach and will notify relevant authorities and affected individuals as required by UAE law.

17. Policy Updates
The School reserves the right to update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. Updated versions will be communicated through appropriate channels.