This Privacy Policy explains how Duhok British International School ("the School", "we", "us") collects, uses, shares and protects personal information when you use the Rast Education mobile applications (for parents, students and staff) and the school web portal (together, the "Service"). The Service is provided to support the education and welfare of our students; we are the data controller for the information processed through it.
Accounts are created and issued by the School to parents/guardians, enrolled students, and staff. The Service is not open to public self-registration. Student accounts are provided at the School's discretion and, for younger students, are used under the supervision and consent of a parent or guardian.
| Category | Examples | Why |
|---|---|---|
| Account & identity | Name, username, email, role, profile photo, school/branch | Sign-in, identification, account security |
| Student records | Attendance, grades/report cards, homework, behaviour points, timetable, exams | Education delivery and reporting to parents |
| Health (where applicable) | Nurse/medical-room visits, conditions recorded by the school nurse | Student welfare and safeguarding |
| Communications | Messages, voice notes, attachments, class feed posts and comments | School–home communication |
| Finance | Fee invoices, payment records and requests | Billing and account management |
| Location | Precise (GPS) location of a bus driver's device while a bus run is active, including in the background while the run is active; the family home pin a family places itself for the bus route; the location a staff member shares at the moment of clocking in or out (attendance) | Live bus tracking for the families on that bus, student safety, and attendance at the school site |
| Device & technical | Device identifier (for approved-device sign-in), push token, app version, IP address, log records | Security, notifications and diagnostics |
The apps access location data only in these cases, and never silently:
Location data is stored on the School's own server, shared only with the School and (for bus positions) with the families of the pupils on that bus, never sold or shared with advertisers, and kept only as long as the trip records and attendance records it belongs to. You can withdraw location permission at any time in your device settings; the related feature then stops working, nothing else does.
We process personal data to perform our educational and contractual responsibilities to families, to meet legal obligations, to protect the vital interests and safety of students, and — where required — on the basis of consent (for example, optional media messaging or location features). Where processing relies on consent, you may withdraw it at any time (see Data Deletion & Your Rights).
The Service processes the personal data of children as part of the School's educational role. Access to a child's data is restricted to that child's linked parents/guardians, the child (where a student account is issued), and authorised school staff with a legitimate need. We apply data minimisation and role-based access controls so that, for example, a parent can only see their own children's information. See our Child Safety Policy.
We share personal data only as needed to run the Service:
We do not sell personal data or share it for third-party marketing.
Data is stored in the School's own database on a server operated for the School in Duhok, Iraq (encrypted backup copies are kept in the School's Microsoft cloud storage). We protect it with encrypted transport (HTTPS/TLS), hashed passwords, rotating sign-in tokens, approved-device binding, role-based access, audit logging and regular, verified backups. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss or misuse.
We keep student and school records for as long as the student is enrolled and afterwards for the period required by law and the School's retention schedule, then delete or anonymise them. Operational data such as message attachments, logs and bus-trip traces are kept only as long as needed for their purpose.
Subject to applicable law, you may request access to, correction of, or deletion of personal data, object to or restrict certain processing, and withdraw consent. To exercise these rights, see Data Deletion & Your Rights or contact us below.
We may update this policy from time to time. Material changes will be notified through the Service or by the School. The "Last updated" date above shows the current version.
For privacy questions or to exercise your rights, contact [email protected] at [email protected], +964 750 891 8131, Duhok, Iraq 42001. See also our Contact page.