This Privacy Policy explains how Duhok British International School ("the School", "we", "us") collects, uses, shares and protects personal information when you use the Rast Education mobile applications (for parents, students and staff) and the school web portal (together, the "Service"). The Service is provided to support the education and welfare of our students; we are the data controller for the information processed through it.
Accounts are created and issued by the School to parents/guardians, enrolled students, and staff. The Service is not open to public self-registration. Student accounts are provided at the School's discretion and, for younger students, are used under the supervision and consent of a parent or guardian.
| Category | Examples | Why |
|---|---|---|
| Account & identity | Name, username, email, role, profile photo, school/branch | Sign-in, identification, account security |
| Student records | Attendance, grades/report cards, homework, behaviour points, timetable, exams | Education delivery and reporting to parents |
| Health (where applicable) | Nurse/medical-room visits, conditions recorded by the school nurse | Student welfare and safeguarding |
| Communications | Messages, voice notes, attachments, class feed posts and comments | School–home communication |
| Finance | Fee invoices, payment records and requests | Billing and account management |
| Location (transport) | Bus GPS during a trip; for drivers, device location while a run is active | Live bus tracking and student safety |
| Device & technical | Device identifier (for approved-device sign-in), push token, app version, IP address, log records | Security, notifications and diagnostics |
We process personal data to perform our educational and contractual responsibilities to families, to meet legal obligations, to protect the vital interests and safety of students, and — where required — on the basis of consent (for example, optional media messaging or location features). Where processing relies on consent, you may withdraw it at any time (see Data Deletion & Your Rights).
The Service processes the personal data of children as part of the School's educational role. Access to a child's data is restricted to that child's linked parents/guardians, the child (where a student account is issued), and authorised school staff with a legitimate need. We apply data minimisation and role-based access controls so that, for example, a parent can only see their own children's information. See our Child Safety Policy.
We share personal data only as needed to run the Service:
We do not sell personal data or share it for third-party marketing.
Data is stored in the School's database [hosting location/country]. We protect it with encrypted transport (HTTPS/TLS), hashed passwords, rotating sign-in tokens, approved-device binding, role-based access, audit logging and regular, verified backups. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss or misuse.
We keep student and school records for as long as the student is enrolled and afterwards for the period required by law and the School's retention schedule, then delete or anonymise them. Operational data such as message attachments, logs and bus-trip traces are kept only as long as needed for their purpose.
Subject to applicable law, you may request access to, correction of, or deletion of personal data, object to or restrict certain processing, and withdraw consent. To exercise these rights, see Data Deletion & Your Rights or contact us below.
We may update this policy from time to time. Material changes will be notified through the Service or by the School. The "Last updated" date above shows the current version.
For privacy questions or to exercise your rights, contact [email protected] at [email protected], +964 750 891 8131, Duhok, Iraq 42001. See also our Contact page.