General Privacy Notice

For the purposes of this Policy, the School is responsible for determining the purposes and means of Processing Personal Data in connection with its educational, admissions, registration, administrative, welfare, operational and parent/student communication activities.

The School forms part of the SABIS^® Network. It uses systems, platforms, services and technical support provided by SABIS Educational Services S.A.L. in Lebanon (“SES LEB”) and, where applicable, other SABIS^® entities or Service Providers.

Depending on the specific processing activity:

• The School acts as the Controller where it determines the purposes and means of Processing Personal Data;
• SES LEB or other SABIS^® entities may Process Personal Data on behalf of the School as Service Providers or Processors; and
• In limited circumstances, certain SABIS^® platforms or external services may be governed by their own privacy policies and terms, where they are operated independently from the School.

Where Personal Data is Processed by SES LEB or another Service Provider on behalf of the School, such Processing should be carried out for defined purposes, based on appropriate instructions, and subject to confidentiality, security, technical, organisational and contractual safeguards.

The School remains the primary point of contact for students, parents, legal guardians and Website users regarding this Policy and the exercise of Data Subject rights, unless a separate privacy policy or notice expressly states otherwise.

The School may be contacted at:

The International School of Choueifat – Amman
P.O. Box 316, Wadi Essir 11810
Amman, Jordan
Tel: +962 6 429 1133
Email: info@iscamman.sabis.net

For questions, comments, Data Subject rights requests, consent withdrawal requests or complaints relating to this Policy or the Processing of Personal Data, please contact the School’s Data Protection Officer (“DPO”) at: privacy@sabis.net

For the purposes of this Policy, and in accordance with applicable data protection laws, including the Jordanian Personal Data Protection Law No. 24 of 2023:

Automated Decision-Making: A decision made solely by automated means, without meaningful human involvement, which produces legal or similarly significant effects on the Data Subject.

Controller: The natural or legal person, within or outside Jordan, that has Personal Data in its custody and is responsible for the relevant Processing activities. For the purposes of this Policy, the School generally acts as Controller for admissions, enrolment, educational, administrative, safety, welfare, medical and school-related Processing activities.

Cookies: Small text files or similar technologies stored on a user’s browser or device to support the operation, security and functionality of the Website.

CRM: The Customer Relationship Management system used in connection with the School’s Website forms, including the Contact Us, Interest, Application and event forms and related admissions or communication workflows, where applicable.

Cross-Border Transfer: Any transfer, storage, access, disclosure or other Processing of Personal Data outside the Hashemite Kingdom of Jordan.

Data Protection Law: The Jordanian Personal Data Protection Law No. 24 of 2023, together with any applicable regulations, instructions, decisions or amendments issued under it.

Data Protection Officer (DPO): The natural person appointed by the School to oversee databases and Processing, monitor compliance with applicable data protection requirements, advise on data protection matters, and receive privacy-related requests, complaints and communications from Data Subjects and relevant authorities.

Data Subject: The individual whose Personal Data is Processed. For the purposes of this Policy, this may include students, prospective students, parents, legal guardians, Website users, emergency contacts and other individuals whose Personal Data is Processed by the School.

Parent / Legal Guardian: The person legally responsible for a Student or Prospective Student, including a person submitting forms or information to the School on their behalf.

Personal Data Breach: Any breach of the security and integrity of Personal Data that results in unauthorised access, Processing, transfer, disclosure, loss, destruction, alteration or misuse, whether accidental or unlawful.

Personal Data Protection Council: The Personal Data Protection Council formed under the Data Protection Law.

Personal Data Protection Directorate: The organisational unit within the Ministry of Digital Economy and Entrepreneurship responsible for Personal Data protection and the receipt and investigation of reports and complaints under the Data Protection Law.

Personal Data: Any data or information related to a natural person that directly or indirectly identifies them, regardless of its source or form, including data concerning the individual, their family status or their location.

Prior Consent: The prior consent of the Data Subject, or their Parent / Legal Guardian where applicable, for Processing, in accordance with the Data Protection Law.

Processing: Any operation performed on Personal Data, whether by automated or non-automated means, including collection, recording, copying, storage, organisation, use, disclosure, sharing, transfer, access, modification, restriction, concealment, deletion, destruction, anonymisation or any other handling of Personal Data by any means.

Processor: The natural or legal person responsible for Processing Personal Data, including where the person Processes Personal Data on behalf of the Controller and in accordance with the Controller’s instructions.

Profiling: Automated Processing of Personal Data to evaluate, analyse or predict aspects relating to a Data Subject, such as performance, behaviour, preferences, interests or characteristics.

Prospective Student: An individual whose admission or enrolment at the School is being considered or applied for.

Recipient: Any natural or legal person, within or outside Jordan, to whom Personal Data is transferred or exchanged by the Controller.

SABIS^® AI: The artificial intelligence functionality or chatbot made available through the SABIS^® E-Books Application or related SABIS^® Systems, where applicable, for educational support purposes.

SABIS^® E-Books Application: The digital learning application made available to authorised users as part of the SABIS^® educational system.

SABIS^® Systems: Systems, platforms, applications, databases and digital tools used by or made available to the School in connection with educational, administrative, communication, student support, operational or technical services.

Sensitive Personal Data: Personal Data that directly or indirectly indicates a person’s origin, race, political opinions or affiliations, religious beliefs, financial status, health, physical or mental condition, genetic data, biometric data, criminal record, or any other information that the Personal Data Protection Council determines to be sensitive where its disclosure or misuse could harm the Data Subject.

Service Provider: Any third party engaged by the School or SES LEB to provide services involving access to or Processing of Personal Data.

Student: A student enrolled at the School.

Website: The School’s website at iscamman.sabis.net.

The School may collect and process different categories of Personal Data depending on the nature of the relationship with the Data Subject, the form or service being used, and the purpose for which the information is required.

The categories of Personal Data processed by the School may include, without limitation:

5.1 Contact and communication data
This may include name, email address, telephone number, home address, correspondence, messages, inquiries, complaints, requests, and other information submitted through the Website, forms, email, telephone, meetings, messaging platforms, portals or other communication channels.

5.2 Identification and registration data
This may include full name, date of birth, nationality, place of birth, national number, personal number, passport details, civil registration details, residency information, family book details, photographs, student number, grade, section, school records, transfer records, and other identification or registration documents required for admissions, registration, re-registration, student file completion, regulatory requirements, or school administration.

5.3 Parent, legal guardian and family data
This may include parent or legal guardian names, contact details, relationship to the student, occupation, employer information, education level, family composition, siblings enrolled at the School, emergency contact details, and other information required to manage the relationship between the School, the student and the parent or legal guardian.

5.4 Admissions, enrolment and student administration data
This may include information submitted through application forms, interest forms, re-registration forms, parent data forms, acceptance processes, transfer documents, placement information, academic history, previous school information, Ministry of Education forms, and other information required to assess, process, manage or maintain the student’s enrolment and school record.

5.5 Academic and educational data
This may include attendance records, grades, examination results, academic performance records, teacher observations, disciplinary records, educational support notes, learning support information, participation in activities, student work, class placement, educational progress, reports, transcripts, certificates, and other records generated in the course of providing educational services.

5.6 Health, medical and welfare data
The School may collect and process health-related data, which may include medical conditions, medication requirements, allergies, vaccination records, medical history, hospitalisation history, school nurse records, emergency medical information, health-related declarations, developmental or wellbeing information, and information required to support the Student’s health, safety, welfare, educational needs or emergency care.
Health-related data may constitute Sensitive Personal Data and will be processed subject to enhanced safeguards and, where required, explicit Prior Consent.

5.7 Sensitive Personal Data
The School may Process Sensitive Personal Data where necessary for specific, clear and lawful purposes. This may include health data, religious information where voluntarily provided and relevant, financial information, information relating to a student’s welfare or support needs, and any other information classified as sensitive under applicable law.
Sensitive Personal Data is collected only where necessary, relevant and proportionate to the purpose, and is subject to restricted access and appropriate safeguards.

5.8 Financial and payment-related data
This may include billing records, invoices, payment status, refund records, fee-related correspondence, guarantee forms, account statements, payment method information, bank or payment details where applicable, and other information required for tuition, transportation, cafeteria, refunds, accounting, audit, tax, or financial administration purposes.

5.9 Transportation, cafeteria and service-related data
This may include bus registration details, student name, grade, home address, route or location information, parent or guardian contact details, transport attendance, meal subscription information, dietary requirements, allergy information, where applicable, and other information required to provide transportation, cafeteria services, school trips, or related student services.

5.10 Photography, audio, video and media data
This may include photographs, videos, webcam recordings, voice recordings, CCTV footage, event recordings, classroom or activity photographs, student work, testimonials, and other audio-visual material collected or used by the School.
Optional media, marketing or promotional use will be handled separately through appropriate consent mechanisms.

5.11 Security, visitor and access data
This may include visitor names, entry and exit records, CCTV footage, access logs, incident records, and other information processed for safety, security, access control, safeguarding, incident management or protection of School premises.

5.12 Website, CRM and technical data
This may include data submitted through Website forms, including Contact Us, Interest, Application and event forms, as well as technical data such as IP address, browser type, device information, access time, system logs, strictly necessary Cookies and similar technologies.

5.13 System, platform and digital learning data
This may include usernames, user IDs, school identifiers, credentials, account data, platform access data, usage logs, educational platform interactions, application activity, troubleshooting information, and system-generated records connected to SABIS^® Systems, the SABIS^® E-Books Application, and other School-related platforms.

5.14 SABIS^® AI data
Where SABIS^® AI is made available, limited Personal Data may be processed in connection with its use, including user prompts, AI-generated responses where applicable, user ID, School ID and related system identifiers necessary to operate the tool, provide educational support, troubleshoot issues, maintain security and ensure system integrity.
SABIS^® AI does not intentionally collect names, email addresses or other directly identifying information through the prompt interface, and Personal Data processed through SABIS^® AI is not used to train or retrain artificial intelligence models.
Access to SABIS^® AI data, where required, is limited to authorised personnel and only for authorised and necessary purposes, including technical support, troubleshooting, security, audit, compliance, system maintenance and system integrity, subject to appropriate safeguards.

The School may collect Personal Data in several ways, including:

6.1 Directly from Data Subjects
Personal Data may be provided directly by students, prospective students, parents, legal guardians, Website users, employees acting in a School capacity, visitors, emergency contacts or other individuals communicating with the School.
This may occur through paper forms, electronic forms, the Website, the CRM, email, telephone, meetings, school portals, applications, messaging channels, interviews, events, or other communication methods.

6.2 From parents or legal guardians
Where the Personal Data relates to a student or prospective student, the School may collect Personal Data from the student’s parent or legal guardian, including information submitted for admissions, registration, re-registration, medical, transportation, emergency, cafeteria, educational, financial, or administrative purposes.
Where parents or legal guardians provide Personal Data relating to third parties, such as emergency contacts, they are expected to have the necessary authority or consent to provide such information to the School.

6.3 Through School records and educational activities
The School may generate or collect Personal Data in the course of providing educational services, including attendance records, grades, assessments, reports, disciplinary records, educational support notes, certificates, transcripts, communications, activity records and other documents or records created as part of the student’s school life.

6.4 Through the Website and CRM
The School may collect Personal Data through Website forms, including Contact Us, Interest Form, Application Form, event-related forms and newsletter subscription forms.
The School’s Website forms may be created, managed or integrated through the School’s CRM system. Personal Data submitted through such forms may be stored in the School’s designated CRM database hosted in Microsoft Azure, subject to access controls, security measures and retention practices.

6.5 Through SABIS^® Systems and digital platforms
The School may collect or generate Personal Data through systems, applications and platforms used to support education, administration, communication, student management, parent access, digital learning, E-Books, AI functionality, IT support, security and related services.

6.6 From third parties
The School may receive Personal Data from third parties where relevant and lawful, including previous schools, government authorities, the Ministry of Education, external examination bodies, healthcare providers, transport providers, cafeteria providers, Service Providers, SABIS^® entities, or other parties involved in providing services to the School or supporting students.

6.7 Automatically
Certain data may be collected automatically when individuals use the Website, CRM forms, digital platforms, applications or related systems. This may include technical data, strictly necessary Cookies, system logs, authentication data and security-related information.

The School Processes Personal Data on the basis of valid Prior Consent. Processing may take place without Prior Consent or prior notice only where Article 6 of the Data Protection Law, or another specific provision of applicable law, expressly permits it. The applicable legal ground depends on the purpose and circumstances of the relevant Processing activity.

The School may Process Personal Data on one or more of the following grounds:

• Valid Prior Consent obtained through the relevant application, enrolment, consent or other collection mechanism, which identifies the relevant purpose and duration and, where applicable, the relevant Processors, Recipients or transfers;
• Processing that is required or expressly permitted by applicable legislation or a decision of a competent court, including a legally required disclosure to the Ministry of Education or another public authority;
• Processing necessary for preventive medical care, medical diagnosis or healthcare provided by a licensed medical practitioner, where the applicable statutory conditions are met;
• Processing necessary to protect the life or vital interests of the Data Subject, including in a medical emergency; and
• any other circumstance in which Processing without Prior Consent is expressly permitted under Article 6 of the Data Protection Law or other applicable legislation, including qualifying crime-prevention, research or statistical Processing, or Processing of Personal Data made publicly available by the Data Subject, subject to the applicable statutory conditions.

In all cases, the School limits Processing to Personal Data that is directly relevant and necessary for a lawful, specific and clear purpose. Necessity and proportionality limit the scope of Processing but do not, by themselves, replace Prior Consent or another specific legal permission.

Certain core information is required to process an application, enroll or re-register a Student, provide educational and administrative services, maintain School records, communicate with Parents / Legal Guardians and meet legal or regulatory requirements. The School will identify, where appropriate, whether requested information is mandatory or optional. If required information or the applicable Prior Consent is not provided, the School may be unable to process the application, complete enrolment or provide the relevant service.

Where Processing is based on Prior Consent, the Data Subject or Parent / Legal Guardian may withdraw that consent at any time without affecting the lawfulness of Processing carried out before withdrawal. Refusal or withdrawal of consent for an optional activity, service or communication will not affect admission or continued enrolment. Where Personal Data or consent is required to provide a specific core service and no separate legal permission applies, refusal or withdrawal may affect the School’s ability to provide that service. If the nature, type or purpose of the Processing changes, the School will obtain new Prior Consent where required.

Sensitive Personal Data will be Processed only where necessary and proportionate, subject to enhanced safeguards, and based on explicit Prior Consent unless a specific legal exception applies.

Where a Student is 18 years old or older at the start of an academic year, the School may, where appropriate, seek acknowledgements or consents directly from the Student for Processing activities that rely on consent during that academic year. This does not affect Processing carried out before that academic year on the basis of consent provided by the Parent or Legal Guardian, or permitted without Prior Consent under Article 6 of the Data Protection Law or other applicable legislation.

Personal Data collected through the School’s Website, including Contact Us forms, Interest Forms, Application Forms, event forms, newsletter subscriptions, Cookies and similar technologies, is addressed in the School’s Website Privacy Policy.

Where Personal Data submitted through the Website, or CRM is used for admissions, registration, enrolment, student administration, school communications or school record-keeping, such Personal Data may also be processed in accordance with this Policy.

The School processes Personal Data for admissions, registration, re-registration, student file management, class placement, administrative planning and the general operation of the School.

This may include processing Personal Data to:

• assess and process applications for admission;
• verify student and parent/legal guardian identity;
• communicate with parents, legal guardians and prospective students;
• arrange placement tests, interviews, meetings or campus tours;
• complete student records and admissions files;
• collect documents required by the School, the Ministry of Education or other competent authorities;
• manage enrolment, re-registration, transfers and withdrawals;
• plan class placements, sections, capacity and academic year administration;
• maintain accurate parent, guardian, student and emergency contact records;
• administer tuition, bus fees, cafeteria subscriptions, refunds, accounts and payment obligations;
• maintain school records and comply with regulatory, accounting, legal and administrative obligations.

The School may also process Personal Data to manage communications with parents and legal guardians, including notices, reminders, academic communications, administrative updates, payment-related communications, policy updates and other school-related information.

Personal Data collected for admissions, enrolment, registration, re-registration, student administration and the provision of educational services is Processed on the basis of Prior Consent obtained through the relevant application or enrolment documentation, or under a specific legal permission described in the section above. The School limits such Processing to what is necessary and proportionate for the stated purpose.

Where Sensitive Personal Data is collected as part of registration or administration, such as health-related information, voluntarily provided religious information or other information requiring enhanced protection, it will be Processed only for the relevant purpose, subject to appropriate safeguards and, where required, explicit Prior Consent.

The School processes Personal Data to provide educational services, manage academic progress, support student development and maintain accurate educational records.

This may include processing Personal Data to:

• deliver classroom teaching, academic programmes and educational activities;
• manage grades, examinations, assessments, attendance and disciplinary records;
• monitor academic and non-academic performance;
• prepare reports, transcripts, certificates and academic records;
• support student learning and educational progress;
• identify where academic, behavioural, developmental or pastoral support may be required;
• manage participation in activities, clubs, competitions, trips, events, summer programmes, sports or swimming activities and other School programmes;
• administer access to SABIS^® Systems, digital platforms, learning tools and educational applications;
• communicate with parents and legal guardians regarding academic progress, conduct, attendance, support needs and school matters; and
• comply with Ministry of Education, regulatory, accreditation, academic and record-keeping requirements.

Student records may include Personal Data generated by the School during the student’s enrolment, including academic records, performance data, behavioural records, attendance information, teacher notes, student support records, and related communications.

Such Personal Data is processed for educational, administrative, welfare, record-keeping and compliance purposes, and access is limited to authorised personnel who require access for authorised and necessary school-related purposes.

The School may collect and process health, medical, developmental, welfare and other Sensitive Personal Data where necessary to support the student’s health, safety, welfare, educational needs, participation in school activities, or emergency care.

This may include:

• medical conditions;
• medication requirements;
• allergies;
• vaccination records;
• medical history;
• hospitalisation history;
• health declarations;
• developmental information;
• learning support or wellbeing information;
• emergency medical information;
• dietary or allergy-related information; and
• information required to support health, safety, welfare, educational access or appropriate care.

Health-related data is processed only where necessary and proportionate, and is subject to enhanced safeguards, restricted access and confidentiality obligations.

Where required, the School will obtain explicit Prior Consent from the Parent / Legal Guardian or, where legally capable, from the Student for the Processing of Sensitive Personal Data.

The School may use health-related information to:

The School may process Personal Data to provide, manage or support student services, including transportation, cafeteria, trips, activities and other school-related services.

12.1 Transportation
Where a student uses school transportation services, the School may process and share relevant Personal Data with the contracted transport provider, including the student's name, grade, address, route or location details, parent/legal guardian contact details, and other information required to provide safe and effective transportation services.

Such information will be shared only to the extent necessary for the provision, management, safety and administration of transportation services. It should be handled by the transport provider in accordance with applicable confidentiality, security and data protection obligations.

12.2 Cafeteria and meal services
Where cafeteria or meal services are provided, the School may process or share limited Personal Data required to administer such services. This may include the student's name, grade, meal subscription information, payment or account status, dietary requirements, allergies, or other relevant information needed to provide meals safely and appropriately.

Where allergy, dietary or health-related information is shared with a cafeteria provider, such sharing will be limited to what is necessary to protect the student’s health and safety and provide the relevant service.

12.3 Other Service Providers
The School may also share limited Personal Data with other Service Providers where necessary to provide School services, maintain systems, support activities, administer programmes, ensure safety, or comply with legal or operational requirements.

Service Providers are expected to process Personal Data only for the purposes for which it was shared and subject to appropriate confidentiality, security and data protection obligations.

The School may collect or use photographs, videos, audio recordings, webcam recordings, CCTV footage, event recordings, student work, testimonials and other audio-visual material in connection with school activities.

13.1 Administrative, identification and safety purposes
Photographs, images or video footage may be used where necessary for identification, student records, access control, security, safety, safeguarding, incident review, school administration or other authorised and necessary school-related purposes.

CCTV footage, when used, is processed for safety, security, the protection of students, staff, and visitors, the protection of School property, and the investigation of incidents where necessary. Access to CCTV footage is restricted to authorised personnel, and footage is retained only for a limited period unless required for investigation, legal or regulatory purposes.

13.2 Internal educational and School-community use
The School may use student photographs, student work, activity materials, or related content for internal educational, administrative, classroom, yearbook, school display, internal platform, or school community purposes, where appropriate and subject to applicable requirements, notices, permissions, or consents.

13.3 External promotional or marketing use
The use of a student’s image, voice, video, testimonial or other media material for external promotional, marketing, advertising, public website, social media, public campaign, billboard or public-facing publication purposes will be subject to a separate and optional consent mechanism.

Consent for the use of promotional or marketing media is not a condition of admission or continued enrolment.

Where consent is provided, it may be withdrawn at any time by contacting the School. Withdrawal will not affect lawful use made before the withdrawal. The School will, where reasonably practicable, stop using the material in future publications. Still, the material may continue to appear in materials already printed, published, distributed, archived, or otherwise in circulation where removal is not reasonably possible.

13.4 Marketing communications and newsletters
The School may send newsletters, marketing communications or promotional updates only where the required consent or opt-in has been obtained.

Data Subjects may unsubscribe or withdraw consent to marketing communications at any time.

The School uses SABIS^® Systems, platforms, applications and digital tools to support education, administration, communication, student management, parent access, digital learning, technical support and School operations.

Personal Data processed through such systems may include account data, user IDs, credentials, school identifiers, platform usage data, educational records, student performance records, attendance records, reports, communications, system logs, and technical support information.

Such processing may be necessary to:

• provide access to educational systems and digital learning tools;
• support teaching, learning, assessment and academic administration;
• manage student records, attendance, exams, reports and school operations;
• provide parents and legal guardians with access to school-related information;
• maintain system functionality, security, troubleshooting and technical support;
• monitor system use for security, operational and administrative purposes; and
• support compliance, audit, reporting and service improvement.

Access to Personal Data within such systems is restricted to authorised personnel on a need-to-know basis and is subject to confidentiality, security and access-control measures.

Where SABIS^® Systems are operated or supported by SES LEB or other SABIS^® entities, access to Personal Data is limited to what is necessary for the provision, operation, maintenance, support, security or improvement of the relevant systems and services.

Where SABIS^® AI is available, it is intended to support the educational experience by enabling authorised users to interact with curriculum-based content in a structured, guided manner.

SABIS^® AI may assist with academic questions, explanations, summaries, prompts or hints connected to SABIS^® educational content. It is designed as an educational support tool. It is not intended to replace teachers, determine grades, assess students, make admissions decisions, impose disciplinary outcomes or make any decision that produces legal or similarly significant effects on Data Subjects.

Personal Data processed through SABIS^® AI is limited to what is necessary to operate the tool, generate responses, maintain security, support troubleshooting, audit system performance and ensure system integrity. This may include user prompts, AI-generated responses where applicable, user ID, School ID and related system identifiers.

SABIS^® AI does not intentionally collect names, email addresses or other directly identifiable information through the prompt interface.

Personal Data processed through SABIS^® AI is not used to train, retrain, profile, benchmark or improve artificial intelligence models.

Users should not submit personal, sensitive, confidential or unnecessary information when interacting with SABIS^® AI.

Access to SABIS^® AI data, where required, is limited to authorised personnel and is permitted only for authorised purposes, including technical support, troubleshooting, security, audit, compliance, system maintenance and system integrity, subject to appropriate safeguards.

Parents, legal guardians and users will be informed in advance of the relevant Processing and available choices, including the available mechanism to disable access where applicable. Use of SABIS^® AI is optional and is not intended to replace teachers or alternative educational support.

The School may share Personal Data where necessary for the purposes described in this Policy and in accordance with applicable law.

Personal Data may be shared with:

• authorised School personnel;
• parents or legal guardians, where appropriate;
• SES LEB and other SABIS^® entities involved in providing educational, administrative, technical, system, support or operational services;
• IT, hosting, cloud, security, platform and software providers;
• transport, cafeteria, healthcare, activity, trip, event or other service providers;
• previous or future schools, where relevant and lawful;
• external examination bodies, accreditation bodies or educational organisations;
• healthcare providers, emergency responders or insurance-related parties where necessary;
• banks, payment providers, auditors, accountants or financial service providers where relevant;
• Ministry of Education, the Personal Data Protection Directorate, tax, social security, regulatory, judicial, law enforcement or other public authorities where required or permitted by law; and
• other parties where necessary to protect the lawful rights, safety or welfare of the School community or others.

The School does not permit Service Providers to use Personal Data for their own unauthorised purposes. Where a Service Provider Processes Personal Data on behalf of the School, such Processing should be subject to appropriate contractual, confidentiality, security and data protection obligations.

Because the School forms part of the SABIS^® Network and uses systems, platforms, cloud infrastructure and technical support that may be located outside Jordan, Personal Data may be transferred to, stored in, or accessed from jurisdictions outside the Hashemite Kingdom of Jordan.

Such jurisdictions may include Lebanon, countries in Europe where Microsoft Azure and related services are hosted, and the United States of America for certain platform, support, backup or disaster-recovery arrangements described in the School’s relevant notices and consent documentation.

Cross-Border Transfers may occur in connection with:

• SABIS^® Systems and platforms;
• CRM and Website-related systems;
• Microsoft Azure or other cloud hosting environments;
• SABIS^® E-Books Application and SABIS^® AI;
• IT support, troubleshooting, backup, disaster recovery and system maintenance;
• academic, administrative, reporting, training or operational support; and
• other services provided by SES LEB, other SABIS^® entities or authorised Service Providers.

Before a Cross-Border Transfer, the School will take reasonable steps to verify the level of protection applicable to the Personal Data in the receiving jurisdiction and to ensure that the transfer is permitted under the Data Protection Law and other applicable data protection requirements.

Where a Cross-Border Transfer is permitted, protective measures may include contractual safeguards, technical and organisational security measures, access restrictions, confidentiality obligations, role-based access controls, encryption, logging, audit measures and restrictions on further Processing.

Where the receiving jurisdiction does not provide an equivalent level of protection, the Cross-Border Transfer will take place only where permitted under Article 15 of the Data Protection Law or another applicable legal provision, including, where required, after obtaining and recording explicit Prior Consent following appropriate notice regarding the level of protection.
Transfers will be limited to what is necessary for the purposes described in this Policy.

The School retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law, regulatory obligation, contractual obligation, institutional requirement, legal claim, audit requirement, safeguarding need, or lawful school purpose.

Retention periods may vary depending on the type of Personal Data and the purpose for which it is processed.

Unless otherwise stated, the retention periods below apply to both paper and electronic records and copies.

The School’s retention practices may include the following:

18.1 General inquiry and Contact Us data
Personal Data submitted through general inquiries or the Website Contact Us Form is retained for one (1) year from receipt, unless the inquiry becomes part of an admissions, registration, student administration or School record, or a longer period is required or permitted for legal, regulatory, administrative or record-keeping purposes.

18.2 Website/CRM form data
Academic interest-related forms, including the Application Form and Interest Form, are retained until August 1 of the academic year of interest, unless the individual becomes an enrolled student or further retention is required for administrative, legal, operational or record-keeping purposes.
Event-related forms are retained for ten (10) days after the event, unless further retention is required or valid Prior Consent has been obtained for additional Processing.
Parent data relating to enrolled Students is retained while the Student is enrolled and is generally deleted one (1) year after the Student leaves the School, unless the information forms part of another School record or further retention is required or permitted by applicable law or valid Prior Consent.

18.3 Application and admissions data
Where an applicant does not enroll, Website/CRM form copies are retained for the period stated above. If application information is transferred into a separate admissions file or School record, it may be retained for the duration of the admissions process and for up to two (2) years thereafter for administrative, record-keeping and evaluation purposes. Where the Student is enrolled, application and admissions data may become part of the Student’s School record.

18.4 Student records
Core academic records relating to enrolled Students, including transcripts, certificates and formal academic history, may be retained for up to twenty-five (25) years, or longer where required by applicable law, Ministry of Education requirements or an applicable institutional record-keeping requirement. Other Student records, including administrative, attendance, conduct and support records, are retained only for the period necessary for the relevant educational, safeguarding, legal or record-keeping purpose.

18.5 Health and medical data
Health and medical data are retained only for as long as necessary to support the student’s health, safety, welfare, educational needs, emergency care, legal obligations, safeguarding requirements or School administration.

18.6 Financial and payment data
Financial, billing, refund, payment and guarantee-related data may be retained for as long as necessary for accounting, audit, tax, contractual, legal, financial administration, dispute resolution or regulatory purposes.

18.7 Media and consent records
Audio-visual materials and related consent records may be retained for as long as necessary for the purposes for which consent was provided, unless consent is withdrawn or retention is otherwise required or permitted by law. Materials already published, distributed or archived may remain in circulation where removal is not reasonably practicable.

18.8 System and platform data
Account data, credentials, access logs, system-generated data, and platform usage data may be retained for the duration of the user’s access to the relevant system and for a limited period thereafter, as necessary, for security, troubleshooting, audit, compliance, operational, or technical purposes.

18.9 SABIS^® AI data
Personal Data processed through SABIS^® AI is retained for up to two (2) years for technical support, troubleshooting, security, audit and system-integrity purposes and will be securely erased or anonymised when no longer required for those purposes, and in any event at the end of that period, unless further retention is required or permitted by applicable law.

18.10 Deletion, anonymisation and secure disposal
Where Personal Data is no longer required, it will be securely deleted, anonymised, archived, blocked or otherwise disposed of in accordance with applicable procedures and legal requirements.

The School implements appropriate administrative, technical and organisational measures designed to protect Personal Data against unauthorised access, loss, misuse, alteration, disclosure, destruction or unlawful processing.

Such measures may include, where appropriate:

The School does not use Personal Data for Automated Decision-Making or Profiling that produces legal or similarly significant effects on Data Subjects.

SABIS^® AI operates as an educational support tool. It does not independently make decisions regarding admissions, grading, assessment, disciplinary action, student progression, access to education, or any other outcome that may significantly affect a Data Subject.

Any automated Processing carried out through School systems is limited to supporting system functionality, educational delivery, security, administration, reporting, user experience or technical operations, and remains subject to appropriate safeguards and human oversight where relevant.

Data Subjects have rights in relation to their Personal Data, subject to applicable law and any limitations expressly permitted under applicable law.

These rights may include:

• the right to be informed about the collection and processing of Personal Data;
• the right to access Personal Data and obtain a copy of it;
• the right to request correction, completion or updating of inaccurate or incomplete Personal Data;
• the right to request deletion or destruction of Personal Data in certain circumstances;
• the right to request restriction or limitation of processing in certain circumstances;
• the right to object to certain processing activities, where applicable;
• the right to transfer a copy of Personal Data from one Controller to another, where applicable;
• the right to withdraw consent where processing is based on consent;
• the right to be notified of certain Personal Data breaches where required by law; and
• the right to lodge a complaint with the Personal Data Protection Directorate where applicable.

Requests to exercise Data Subject rights should be submitted to [DPO email address]. The School will acknowledge Data Subject rights requests within fifteen (15) working days from the day following receipt and will thereafter review and respond to such requests in accordance with applicable law and the School’s Data Subject rights procedure. The School may need to verify the identity and authority of the person making the request.

The exercise of rights may be subject to limitations expressly permitted by applicable law, including where continued Processing or retention is required for legal, regulatory, safeguarding, audit or legal-claim purposes.

Where a request relates to a student who is a minor or otherwise legally incapable of exercising rights directly, the request should generally be submitted by the parent or legal guardian, subject to applicable law.

The School recognises that a significant portion of the Personal Data it processes relates to students, including minors, and that such data requires heightened protection.

The School Processes Student Personal Data for authorised educational, admissions, administrative, welfare, safety, support, communication, operational and legal purposes, on the basis described in this Policy.

Where required, the processing of student Personal Data is carried out with the consent of a parent or legal guardian. Where a student is legally capable of providing consent or exercising rights under applicable law, the School will handle such consent or request in accordance with applicable requirements.

Parents and legal guardians may exercise rights on behalf of students where permitted by law and subject to applicable limitations.

The School takes reasonable steps to ensure that the student's Personal Data is:

• processed fairly, lawfully and transparently;
• limited to what is necessary for the relevant purpose;
• kept accurate and up to date where required;
• accessed only by authorised personnel;
• subject to appropriate confidentiality and security safeguards; and
• retained only for as long as necessary or permitted.

Where appropriate, the School may provide students with information about the use of their Personal Data in a clear and age-appropriate manner.

The School may amend or update this Policy from time to time to reflect operational, technical, legal, regulatory or institutional developments.

Where appropriate or required by law, the School will notify Data Subjects of material changes to this Policy, including through the Website, email, school communication channels, application notifications or other appropriate means.

The updated version of this Policy will indicate the date of the latest update.

Where a change requires new or separate consent, the School will seek such consent in accordance with applicable law.

By submitting information to the School, accessing School systems or participating in School activities, Data Subjects acknowledge that they have read and understood this Policy. This acknowledgment does not itself constitute Prior Consent. Use of the School’s Website is addressed separately in the Website Privacy Policy.

Where Prior Consent is required, it will be obtained separately through the relevant form, notice, signature, checkbox or other consent mechanism. Where Processing is permitted without Prior Consent under a specific provision of applicable law, the School may carry out that Processing subject to the safeguards described in this Policy.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may affect the availability of optional services, activities or communications that depend on such consent.

Questions, requests or complaints relating to this Policy or the Processing of Personal Data should be submitted to the DPO at eabuzaid@iscamman.sabis.net.
The School will acknowledge Data Subject rights requests within fifteen (15) working days from the day following receipt and will thereafter review and respond to such requests in accordance with applicable law and the School’s Data Subject rights procedure. Privacy complaints will be acknowledged within ten (10) days from the day following submission and will thereafter be reviewed and responded to in accordance with applicable law and the School’s complaint-handling procedure.
Where a Data Subject is not satisfied with the School’s response, they may submit a complaint to the Personal Data Protection Directorate in accordance with the applicable complaint procedure.