Privacy Policy

This policy explains how [LEGAL ENTITY NAME] ("Plus Up", "we") handles personal data. It covers two situations:

• Data inside a school's workspace. When a school uses Plus Up, the school is the data controller and we are its data processor. We act on the school's instructions under the Data Processing Agreement. Sections 2 to 6 and 11 describe this.
• Our own data. For visitors to https://plusup.net, people who contact us, and the representatives of schools that buy the Service, we are the controller. Section 7 describes this.

We comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (the "PDPL") and the regulations issued under it.

1. Who we are

[LEGAL ENTITY NAME], licence [TRADE LICENCE NO.], Umm Al Quwain Free Trade Zone, [REGISTERED ADDRESS], Umm Al Quwain, United Arab Emirates. Questions about this policy and requests about personal data: privacy@plusup.net. General support: support@plusup.net.

2. Data we process on behalf of schools

A school enters the data it needs to run. Depending on the features it uses, this includes:

• Learners: name in English and Arabic, student number, class, date of birth, gender, nationality, religion, learner category (for example special educational needs), medical status with any condition and the instructions staff must follow, office notes, profile photo if one is added, courses and timetable, attendance and lateness for each lesson, hall passes, marks, term grades and teachers' comments, assignments, quiz answers and submitted work, Pluses (reward points), behaviour incidents and positive reports, meetings about the learner, messages with staff (and with classmates, if the school turns that on), the guardian link requests they accept or decline, and the day they left the school. Health, religion and behaviour information is sensitive data; religion, medical details, office notes, behaviour descriptions and message texts are protected with additional encryption.
• Parents, guardians and other family contacts: name, relationship, phone numbers, email, country, sign-in username, the learners they are linked to and their requests to be linked (with the school office's decision), meeting requests, and messages with staff (and with other families of the class, if the school turns that on). The religion of parents and other family contacts is not collected.
• Staff: name, work email, username, role, department, profile photo, timetable, lesson plans and weekly overviews, meetings and their minutes, messages, absences and the type of leave recorded to arrange cover, the cover lessons they take, and the actions they take in the Service (audit log).
• Files: documents, images and videos uploaded by staff, learners or guardians (lesson materials, homework, announcements, message attachments, the school calendar, class rosters).
• Technical records: sign-in history, session and device information, IP addresses and timestamps, kept for security.

3. Why and on what basis

The school decides the purposes: teaching, assessment, attendance and safeguarding, communication with families, and the record-keeping its regulator requires. The school is responsible for its lawful basis, including any consent it needs from guardians or staff. We process the data only to provide, secure and support the Service, which is necessary to perform our contract with the school, and to meet our own legal obligations.

4. Children

Learners' accounts are created by the school, which decides which learners may sign in. When a parent asks to be linked to a child, the link starts only after the child accepts the request and the school office confirms it (a school can switch the office's confirmation off). The office can also remove a parent's link at any time. We do not collect personal data from children for our own purposes, we do not profile learners, we do not use their data for advertising, and we do not sell personal data. Guardians exercise children's rights through the school.

5. Where data is kept and who can access it

• Location. All school data is stored in Microsoft Azure data centres in the United Arab Emirates, in the UAE North (Dubai) region, with backup copies in UAE Central (Abu Dhabi). We do not transfer school data outside the UAE. If a school downloads an export, the copy is in the school's hands.
• Access inside the school. Roles decide access. A learner's private details (date of birth, nationality, religion, category, medical information, office notes and parents' contacts) are open to the principal, vice principal, dean and school administrator for every learner, to teachers only for the learners they teach, and to heads of department also for learners in their department's courses; every opening is recorded. Teachers see the marks of their own courses; heads of department, the principal and the vice principal can read every course's marks, and the dean sees term grades. Behaviour reports are seen by the staff member who wrote them, the dean, the principal, the vice principal and the learner's teachers. Messages are seen by the people in the conversation. Messages between classmates, and between families of the same class, are off unless the school switches them on; when they are on, other parents of the class see a parent's name with "Parent of" and their child's name and can write to them, and these conversations can be read by the class's homeroom teacher, the dean and school leadership. Conversations between staff and a learner can be reviewed by the dean and school leadership for safeguarding. A guardian sees only their linked children, and a learner only themselves. Every school's data is isolated from every other school's at the database level.
• Access by us. Our personnel access school data only to resolve a support request or a security incident, or to carry out a school's written request, under confidentiality obligations, and such access is logged.
• Subprocessors. Microsoft Corporation and its affiliates (Microsoft Azure): hosting, database, file storage and backups, in the UAE. Stripe: only if a school chooses to pay its subscription by card, for the payment details of the school's billing contact; card details go to Stripe and are never stored by us, and no learner or staff data is shared with Stripe. We give schools at least 30 days' notice before adding or replacing a subprocessor.
• Disclosure. We disclose data only when the law requires it, and we tell the school unless the law prevents us.

6. How long we keep school data

• During the subscription. School data stays in the Service. The school corrects records inside the Service. When a learner leaves, the school office records it: the learner's sign-in stops and they leave class lists, while their school record is kept for as long as the school must keep it. When the school asks in writing for a learner's record or other personal data to be deleted, we delete it within 30 days.
• After the subscription or free trial ends. The school has 90 days to download its data with the Service's export features or to ask us for a full export (a ZIP file with every record as CSV spreadsheets), which we provide within 30 days of the request. If the school does not renew, its data, including its stored files and its audit log, is deleted automatically from our live systems at the end of those 90 days, and every remaining copy leaves our backups within a further 35 days.
• Backups and logs. Database backups are kept for 14 days on a rolling basis, with a geo-redundant copy in UAE Central. Previous versions of uploaded files are kept for 20 days, and deleted files can be recovered for a further 14 days, so every copy of a deleted file is gone within 35 days. Sign-in records (time, device and IP address) are deleted within 12 months. The school's audit log is kept for the subscription and deleted with the school's data.

7. Data we hold as a controller

• School representatives and prospects: name, role, work contact details, correspondence, contracts and invoices. Used to run our business relationship and meet accounting and tax obligations; invoices are kept for the period UAE tax law requires.
• Website visitors: our public pages set no tracking cookies and use no analytics or advertising services. Our servers keep short-lived technical logs (IP address, request, time) for security.
• Support requests: the content of your message and the information needed to resolve it, kept for 24 months.

8. Cookies and browser storage

The Service uses only cookies that are needed for it to work: the sign-in session cookie; two short-lived cookies during two-step verification and its set-up; the language preference; and, for parents with more than one child, which child they are viewing. The dark-mode setting and gradebook display preferences are kept in your own browser's storage and are not sent to us. None of these tracks you across other sites, so no cookie banner is required.

9. Security

We protect personal data with measures that include encryption in transit (TLS) and at rest, field-level encryption of sensitive notes and messages, isolation of each school's data in the database, strong password hashing, sign-in throttling and account lockout, two-step verification, virus scanning of every uploaded file, access logging, daily encrypted backups, and least-privilege access for our own staff. The Security and Compliance Overview describes them in more detail.

10. Data breaches

If we become aware of a breach affecting a school's data, we notify the school without undue delay and no later than 72 hours after becoming aware, with the information it needs to meet its own obligations, and we notify the authorities where the law requires.

11. Your rights and how they are exercised

Under the PDPL you may ask to access your personal data, to correct it, to delete it, to restrict or object to its processing, and to receive a copy in a portable format. If your data is held inside a school's workspace, please contact the school: it is the controller, and it acts on your request in the Service as follows.

• Access and portability: the school's office or leadership downloads the learner's record as a file (details, contacts, courses, attendance, reports, marks, meetings and messages) and gives it to you; school-wide lists can be downloaded as spreadsheets.
• Correction: the school corrects details and contacts on the learner's record, marks in the course gradebook, and attendance on the attendance pages.
• Deletion and restriction: the school removes contacts itself and, when a learner leaves, records it so that the sign-in stops. A complete deletion of a learner's record, or of other data the school cannot remove itself, is carried out by us on the school's written request within 30 days, unless the law requires the school to keep the records.

For data we hold as a controller, write to privacy@plusup.net; we answer within 30 days and may need to verify your identity. You may also lodge a complaint with the UAE Data Office.

12. Changes

We may update this policy. Material changes are announced to schools at least 30 days in advance by email or inside the Service. The date at the top shows when the current version took effect.