Privacy Notice

Asabya Academy ("we") collects only what we need to provide our school self-evaluation and compliance service to schools, and to run this website.

What we collect. Your name, email, school, the work you do on the platform (sessions, quizzes, scores), and confirmation that you are 18 or older or, if you are under 18, that a parent or guardian has consented.

Sign-in with Google. If you sign in using Google, we receive your name, email address, and Google profile picture from Google. We use this data only to create and operate your Asabya Academy account: to identify you, communicate with you about your programme, and link your work on the platform to your account. We do not use Google user data for advertising, do not sell it, and do not share it with third parties except the sub-processors listed below. You can revoke Google's access at any time at https://myaccount.google.com/permissions.

Connecting another calendar (optional). You can connect a calendar you already keep elsewhere, such as Google Calendar, Outlook or Apple Calendar, so that your own events appear alongside your Asabya schedule. You do this by pasting the private subscription link that your calendar provider gives you. We use that link only to read that calendar. From each event we take its title, its time, its location and a link back to it, and nothing else: descriptions and the names and email addresses of other people invited are discarded and never used or stored. We do not store the events from your other calendars. They are fetched, shown to you, and gone, so no event from your personal calendar is written to our database or included in our backups. We store only the subscription link itself, encrypted, and you can remove it at any time from your calendar page, which deletes it. Treat that link as private: anyone who has it can see that calendar.

Trying the demo, and asking for a demonstration. Before you open the public demo we ask for your name, work email, school or organisation, role and country. If you ask for a live demonstration we also ask for your mobile or WhatsApp number, your preferred days and times, and the language you would like. We use these details only to arrange and follow up on your demo or demonstration, and we keep them for up to 12 months unless you ask us to delete them sooner. We also record when you used the demo and which demo account you viewed, for the same 12 months. Your IP address is kept for 30 days to stop the forms being abused, then removed. A cookie on your device remembers that you have filled in the demo form, so we do not ask again. If you tick the box to receive updates from Asabya Academy on WhatsApp, we record your number, the exact wording you agreed to and when; we only send WhatsApp messages to people who have agreed, and you can ask us to stop at any time.

Where you came from. When you first arrive through a link that carries a campaign tag or a referral code, a cookie on your device remembers that tag or code, the page you landed on and when, for up to 90 days. If you then leave your details or register a school, we copy it onto that record so we know which campaign or which referrer introduced you. The cookie is our own; no third-party tracker reads it.

Personal accounts and sign-in codes. You can open a personal account, without a school, to take part in our referral programme. It holds your name, email, a confirmation that you are 18 or older (we record when you confirmed, not your date of birth), your consent to data processing, and your referral record. A personal account belongs to no school and cannot buy anything. If you sign in with an emailed code, we send the code to your email and never store it; we keep a record that the email was sent, its delivery status and a one-way, scrambled form of your network address, and we limit how many codes can be requested.

Staff invitations. A school leader can invite staff by entering each person's name, email and role, or by sharing the school's join link. An invitation expires after 30 days. When you accept, we record that you confirmed you are 18 or older and joining as a member of staff, and you become a member of that school's workspace; from then on the school is responsible for your data under its agreement with us. Each use of a join link records who joined and when.

The referral programme. If you refer schools, we keep your name, email, phone, referral code, the reward you choose, the version of the partner agreement you accepted and your declaration, and the schools you referred with their progress and your rewards and payouts. When someone clicks your link we store only a one-way, scrambled form of their IP address and delete it after 30 days; daily counts are kept without it. You see a referred school by name only once it has registered, and counts before that; the school sees that you referred it. If you choose a cash reward, your bank details (IBAN) are encrypted, shown to you only by their last four characters, and readable in full only by our administrators, each time recorded; a change needs a recent sign-in and an email confirmation, and waits 7 days before a payout. We keep referral records while you take part and for as long as we need them to account for rewards we have paid.

School contacts, and marketing only with your consent. To offer our service to schools, we keep a list of schools in the countries we serve, built from public sources: the ministry's school directory, published school review reports, and each school's own website and public social media pages. For each school we keep its name, location, type and review details, and its published contact details: usually the school's own phone number, WhatsApp number and email address, and sometimes the name, role and work contact details of a member of staff such as the principal. We hold this as the controller. In Oman we may process these details without consent because they are available to the public (Article 10 bis (b) of the Personal Data Protection Law, added by Royal Decree 68/2026); in each other country we serve we follow the equivalent rule of its law. We send no advertising or marketing material to anyone without their explicit prior consent (Article 22 of the same law). Our first message to a school therefore contains no price and no offer: it says who we are and asks whether we may send information, and we send it only if the answer is yes. Asking us for a demonstration, registering a school, or ticking the box to receive updates from Asabya Academy on WhatsApp also counts as consent. For every contact we record whether consent was asked, given, refused or withdrawn, with the date, the channel and the exact wording used. You can refuse or withdraw consent at any time by replying NO or STOP, by telling us in any message, or by writing to privacy@asabya.com, and we stop at once. If we hold a contact and nobody has given consent or replied, we delete it automatically 12 months after our first message, or 12 months after we added it to the list if we never wrote. If you refuse or withdraw consent, we delete your details and keep only a one-way scrambled form (a hash) of the phone number and email address, so that we never contact you again. When we contact a school, we note when, how and what was said. We use this list for nothing else, we do not sell it, and we share it with no one outside the service providers who host our platform.

Why we collect data. To provide the service your school uses, to let you and the colleagues your school chooses work on its self-evaluation, to arrange demonstrations you ask for, to run the referral programme, to bill schools and take payments, and to improve the platform.

Your rights. You can ask us to show, correct, or delete your data, or to stop using it for analytics. Contact privacy@asabya.com. You can also complain to the Ministry of Transport, Communications and Information Technology.

Privacy Officer. Our Privacy Officer is the contact for any request about your personal data, including the rights above, and for the Ministry of Transport, Communications and Information Technology: privacy@asabya.com.

The law we follow. We process personal data under the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022, as amended by Royal Decree 68/2026) and its Executive Regulation (Ministerial Decision 34/2024, as amended by Ministerial Decision 6/2025), and the data protection law of each other country we serve where it applies.

Children. Anyone under 18 needs a parent or guardian's consent.

How long we keep data. While your account is active and your school uses Asabya. When your school's agreement ends and it asks us to, or when you ask us to, we delete or anonymise your personal data and confirm in writing when that is done, except records the law requires us to keep, such as invoices. Copies in our encrypted backups are overwritten within 90 days.

If there is a breach. If a personal-data breach affects your data, we notify your school within 48 hours of becoming aware of it, so that it can meet its own duty to notify the Ministry of Transport, Communications and Information Technology within 72 hours.

Who else sees it. Schools using Asabya Academy sign a Data Processing Agreement with us. The current DPA and sub-processor list are at academy.asabya.com/dpa and academy.asabya.com/sub-processors.

Payments. Schools pay invoices by card on the secure hosted checkout of our payment provider, Tap Payments. Card details are entered on Tap's page and never reach us; we receive the result of the payment, the card brand, its last four digits and the payment reference, and keep them with the invoice. Tap processes payment details under its own privacy policy.

Backups and where your data is stored. Your data is stored in Frankfurt, Germany (EU). The database is backed up daily by our hosting provider, and those backups are kept for 7 days. An independent AES-256 encrypted copy of the database, and of the files held with our database provider, is kept with a second provider (Cloudflare R2) for 90 days, and a restore is tested automatically every week. Some sub-processors operate outside Oman, currently in Germany, Japan, the United States and on global edge networks, so some of your data is processed outside Oman. This processing is governed by our Data Processing Agreement. Each sub-processor's role and location is listed at academy.asabya.com/sub-processors.

Updates. This notice may change. The effective date at the top of this page reflects the current version.

---

Operator: International Strategic Solutions Investment LLC, CR 1609049, Muscat, Sultanate of Oman.