Last updated 10 November 2026
This policy explains what personal data School360 KSA ("we") collects when you use our website and the School360 KSA platform, how we use it, and the rights you have. We process personal data in line with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulations, overseen by the Saudi Data & AI Authority (SDAIA). Schools use School360 KSA to run admissions, attendance, fees, exams and more, so it holds information about children: we treat it with particular care.
1. Who we are and our role
- For our website, demo requests and the accounts of the schools we serve, School360 KSA decides how personal data is used (we are the controller).
- For the records a school adds to School360 KSA about its students, families and staff, the school is the controller. We process that data only on the school's instructions, to provide the service.
- Questions about this policy or your personal data: privacy@ksa.school360.cloud.
2. What we collect
- Details you give us on the website: your name, role, school, city, mobile number, email and message when you book a demo or contact us.
- School data: the students, parents and guardians, staff, classes, attendance, fees and invoices, marks, documents, photos and other records a school adds, which can include national ID, Iqama and passport numbers, nationality, GOSI details and salary information. The school owns this data; we store and process it only to run the service for the school.
- Account and usage information: sign-ins, the device and browser used, and how the platform is used, so we can keep it secure and improve it.
3. How we use it, and on what basis
- To set up and run each school's portal under our agreement with the school, and to contact the school about it.
- To keep accounts secure, prevent misuse and fix problems, which is in our and our schools' legitimate interest.
- To meet our legal obligations, for example keeping tax invoices as VAT and e-invoicing rules require.
- To send service emails and notifications (invitations, sign-in codes, invoices, alerts a school has switched on). We don't send marketing messages without your consent, and you can withdraw consent at any time.
- To improve School360 KSA, using aggregated information that doesn't identify students, parents or staff.
4. Children's information
- Student records (names, national ID or Iqama numbers, dates of birth, photos, attendance, results, health notes and pick-up arrangements) are entered and controlled by the school. We never use them for advertising, profiling or anything other than providing School360 KSA to that school.
- Inside a school, each person sees only what their role allows: for example, a teacher sees their own classes, and family contact details and identity numbers are hidden from roles that don't need them.
- Parents and guardians with a parent account see only their own children's information.
5. Sensitive data
- Some school records, such as health notes, are sensitive data under the PDPL. Schools should record only what they need, and we protect these records with the same role-based access, encryption in transit and activity logging as everything else.
6. Cookies and analytics
- The School360 KSA portal uses only the cookies it needs to keep you signed in and remember settings such as your language, light or dark mode, the campus and the academic year.
- Our website (not the portal) uses Google Analytics to understand how visitors find and use it: pages viewed, buttons pressed and roughly where visitors are. It never receives names, emails or mobile numbers, and we don't use it for advertising.
- Where we ask for consent, analytics cookies are set only after you accept. You can also block them in your browser, or use Google's opt-out browser add-on.
- Google Analytics is never used inside the portal, so school, student and family data is never sent to it.
7. Who we share it with
- We don't sell any data, and we never share student or family information with advertisers.
- We use trusted providers for hosting, email, SMS and payments, only as needed to run the service and under contracts that require them to keep the data confidential and protect it.
- We may disclose information when the laws of the Kingdom of Saudi Arabia require it, for example to a court or a competent government authority.
8. Where your data is kept
- School data is hosted securely with established hosting providers. If personal data is ever transferred or processed outside the Kingdom, we do so only as the PDPL and its regulations on transfers allow, with appropriate safeguards in place.
9. The school's responsibilities
- The school decides what information to record about its students, families and staff, and is responsible for having a lawful basis for it under the PDPL, including consent where the law requires it. We process school data only on the school's instructions.
- School owners and administrators control who can sign in, what each role can see and do, and which parents get accounts.
10. Keeping it safe and how long we keep it
- Each school has its own separate database, data is encrypted in transit, sign-ins can require a second step, and every change is recorded in the school's activity log.
- If a personal data breach happens, we'll tell the affected school without undue delay and notify SDAIA where, and within the time, the PDPL requires.
- We keep school data while the subscription is active. If a school closes its account, it can ask for an export, and we delete the data within 90 days unless the law requires us to keep it longer, for example tax invoices.
11. Your rights
- Under the PDPL you have the right to be told how your personal data is used, to see it and get a copy, to have it corrected or completed, to have it deleted when it's no longer needed, and to withdraw consent you have given.
- Write to privacy@ksa.school360.cloud and we'll reply within the period the law sets. Parents, students and staff can also ask through their school, which controls their records.
- If you're not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA).
- You can unsubscribe from any non-essential email using the link in it.
12. Changes to this policy
- We'll update this policy when our practices or the law change, and show the date at the top. If a change is significant, we'll tell schools before it takes effect.