Privacy Policy

This policy explains how Plus Up ("Plus Up", "we") handles personal data. It covers two situations:

• Data inside a school's workspace. When a school uses Plus Up, the school is the data controller and we are its data processor. We act on the school's instructions under the Data Processing Agreement. Sections 2 to 6 and 11 describe this.
• Our own data. For visitors to https://plusup.net, people who contact us, and the representatives of schools that buy the Service, we are the controller. Section 7 describes this.

We comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (the "PDPL") and the regulations issued under it.

Current status

Plus Up is not yet used by any school with real data. The service at https://plusup.net is a demonstration: it holds fictional data only and runs on a temporary server outside the United Arab Emirates, so no real learner, family or staff data may be entered into it. Before the first school uses Plus Up with real data, the service, its database, its file storage and its backups move to a data centre in the United Arab Emirates, and the steps these documents mark as required before real school data is handled are completed. The company's licence details are added to these documents when its trade licence is issued.

1. Who we are

Plus Up, licence: to be issued by the Umm Al Quwain Free Trade Zone, Umm Al Quwain, United Arab Emirates. Questions about this policy and requests about personal data: privacy@plusup.net. General support: support@plusup.net.

2. Data we process on behalf of schools

A school enters the data it needs to run. Depending on the features it uses, this includes:

• Learners: name in English and Arabic, student number, class, date of birth, gender, nationality, religion, learner category (for example special educational needs), medical status with any condition and the instructions staff must follow, office notes, profile photo if one is added, courses and timetable, attendance and lateness for each lesson, hall passes, marks, term grades and teachers' comments, assignments, quiz answers and submitted work, Pluses (reward points), behaviour incidents and positive reports, meetings about the learner, messages with staff (and with classmates, if the school turns that on), the guardian link requests they accept or decline, and the day they left the school. Health, religion and behaviour information is sensitive data; religion, medical details, office notes, behaviour descriptions and message texts are protected with additional encryption.
• Parents, guardians and other family contacts: name, relationship, phone numbers, email, country, sign-in username, the learners they are linked to and their requests to be linked (with the school office's decision), meeting requests, and messages with staff (and with other families of the class, if the school turns that on). The religion of parents and other family contacts is not collected.
• Staff: name, work email, username, role, department, profile photo, timetable, lesson plans and weekly overviews, meetings and their minutes, messages, absences and the type of leave recorded to arrange cover, the cover lessons they take, and the actions they take in the Service (audit log).
• Files: documents, images and videos uploaded by staff, learners or guardians (lesson materials, homework, announcements, message attachments, the school calendar, class rosters).
• Technical records: sign-in history, session and device information, IP addresses and timestamps, kept for security.

3. Why and on what basis

The school decides the purposes: teaching, assessment, attendance and safeguarding, communication with families, and the record-keeping its regulator requires. The school is responsible for its lawful basis, including any consent it needs from guardians or staff. We process the data only to provide, secure and support the Service, which is necessary to perform our contract with the school, and to meet our own legal obligations.

4. Children

Learners' accounts are created by the school, which decides which learners may sign in. When a parent asks to be linked to a child, the link starts only after the child accepts the request and the school office confirms it (a school can switch the office's confirmation off). The office can also remove a parent's link at any time. We do not collect personal data from children for our own purposes, we do not profile learners, we do not use their data for advertising, and we do not sell personal data. Guardians exercise children's rights through the school.

5. Where data is kept and who can access it

• Location. All school data is stored in data centres in the United Arab Emirates, with backup copies at a second location in the UAE, and no school data is accepted before that hosting is in place (see Current status). We do not transfer school data outside the UAE. If a school downloads an export, the copy is in the school's hands.
• Access inside the school. Roles decide access. A learner's private details (date of birth, nationality, religion, category, medical information, office notes and parents' contacts) are open to the principal, vice principal, dean and school administrator for every learner, to teachers only for the learners they teach, and to heads of department also for learners in their department's courses; every opening is recorded. Teachers see the marks of their own courses; heads of department, the principal and the vice principal can read every course's marks, and the dean sees term grades. Behaviour reports are seen by the staff member who wrote them, the dean, the principal, the vice principal and the learner's teachers. Messages are seen by the people in the conversation. Messages between classmates, and between families of the same class, are off unless the school switches them on; when they are on, other parents of the class see a parent's name with "Parent of" and their child's name and can write to them, and these conversations can be read by the class's homeroom teacher, the dean and school leadership. Conversations between staff and a learner can be reviewed by the dean and school leadership for safeguarding. A guardian sees only their linked children, and a learner only themselves. Every school's data is isolated from every other school's at the database level.
• Access by us. Our personnel access school data only to resolve a support request or a security incident, or to carry out a school's written request, under confidentiality obligations, and such access is logged.
• Subprocessors. The provider of the UAE data centre (named here before any school data is placed with it): hosting, database, file storage and backups, in the UAE. Stripe: only if a school chooses to pay its subscription by card, for the payment details of the school's billing contact; card details go to Stripe and are never stored by us, and no learner or staff data is shared with Stripe. We give schools at least 30 days' notice before adding or replacing a subprocessor.
• Disclosure. We disclose data only when the law requires it, and we tell the school unless the law prevents us.

6. How long we keep school data

• During the subscription. School data stays in the Service. The school corrects records inside the Service. When a learner leaves, the school office records it: the learner's sign-in stops and they leave class lists, while their school record is kept for as long as the school must keep it. A complete deletion of a learner's record requires a purpose-built, audited process and legal review before it can be offered.
• After the subscription or free trial ends. The school has 90 days to download its data with the Service's export features or to ask us for a full export (a ZIP file with every record as CSV spreadsheets), which we provide within 30 days of the request. If the school does not renew, its data, including its stored files and its audit log, is deleted automatically from our live systems at the end of those 90 days, and every remaining copy leaves our backups within a further 35 days.
• Backups and logs. Database backups are kept for 14 days on a rolling basis, with a geo-redundant copy at the second UAE location. Previous versions of uploaded files are kept for 20 days, and deleted files can be recovered for a further 14 days, so every copy of a deleted file is gone within 35 days. The IP address is removed from sign-in audit records after 12 months. The sign-in records themselves are currently kept without a time limit, including after a school's data is deleted; a retention limit is planned before real school data is handled. The school's audit log is kept for the subscription and deleted with the school's data.

7. Data we hold as a controller

• School representatives and prospects: name, role, work contact details, correspondence, contracts and invoices. Used to run our business relationship and meet accounting and tax obligations; invoices are kept for the period UAE tax law requires.
• Website visitors: our public pages set no tracking cookies and use no analytics or advertising services. Our servers keep short-lived technical logs (IP address, request, time) for security.
• Support requests: the content of your message and the information needed to resolve it, kept for 24 months.

8. Cookies and browser storage

The Service uses only cookies that are needed for it to work: the sign-in session cookie; two short-lived cookies during two-step verification and its set-up; the language preference; and, for parents with more than one child, which child they are viewing. The dark-mode setting and gradebook display preferences are kept in your own browser's storage and are not sent to us. None of these tracks you across other sites, so no cookie banner is required.

9. Security

We protect personal data with measures that include encryption in transit (TLS) and at rest, field-level encryption of sensitive notes and messages, isolation of each school's data in the database, strong password hashing, sign-in throttling and account lockout, two-step verification, malware scanning for files up to 100 MiB (larger staff-uploaded videos are excluded), audit logging of significant school actions, daily encrypted backups, and least-privilege access for our own staff. File-download logging and a documented incident process are planned before real school data is handled. The Security and Compliance Overview describes the current controls and planned work in more detail.

10. Data breaches

If we become aware of a breach affecting a school's data, we notify the school without undue delay and no later than 72 hours after becoming aware, with the information it needs to meet its own obligations, and we notify the authorities where the law requires.

11. Your rights and how they are exercised

Under the PDPL you may ask to access your personal data, to correct it, to delete it, to restrict or object to its processing, and to receive a copy in a portable format. If your data is held inside a school's workspace, please contact the school: it is the controller, and it acts on your request in the Service as follows.

• Access and portability: the school's office or leadership downloads the learner's record as a file (details, contacts, courses, attendance, reports, marks, meetings and messages) and gives it to you; school-wide lists can be downloaded as spreadsheets.
• Correction: the school corrects details and contacts on the learner's record, marks in the course gradebook, and attendance on the attendance pages.
• Deletion and restriction: the school removes contacts itself and, when a learner leaves, records it so that the sign-in stops. A complete deletion of a learner's record, or of other data the school cannot remove itself, is not yet offered; it requires a purpose-built, audited process and legal review, including a decision on records the law requires the school to keep.

For data we hold as a controller, write to privacy@plusup.net; we answer within 30 days and may need to verify your identity. You may also lodge a complaint with the UAE Data Office.

12. Changes

We may update this policy. Material changes are announced to schools at least 30 days in advance by email or inside the Service. The date at the top shows when the current version took effect.