Privacy Policy

Data Protection Officer (DPO): means the natural person appointed by the School to oversee databases and Processing, monitor compliance with applicable data protection requirements, advise on data protection matters, and receive privacy-related requests, complaints and communications from Data Subjects and relevant authorities.

Data Subject: means the individual whose Personal Data is Processed. For the purposes of this Policy, this may include Website users, prospective students, parents, legal guardians, students, emergency contacts and other individuals whose Personal Data is submitted through or collected via the Website or CRM.

Parent / Legal Guardian: means the person legally responsible for a student or prospective student, including the person submitting forms or information to the School on their behalf.

Personal Data: means any data or information related to a natural person that directly or indirectly identifies them, regardless of its source or form, including data concerning the individual, their family status or their location.

Personal Data Breach: means any breach of the security and integrity of Personal Data that results in unauthorised access, Processing, transfer, disclosure, loss, destruction, alteration or misuse, whether accidental or unlawful.

Personal Data Protection Council: means the Personal Data Protection Council formed under the Data Protection Law.

Personal Data Protection Directorate: means the organisational unit within the Ministry of Digital Economy and Entrepreneurship responsible for Personal Data protection and the receipt and investigation of reports and complaints under the Data Protection Law.

Prior Consent: means the prior consent of the Data Subject, or their Parent / Legal Guardian where applicable, for Processing, in accordance with the Data Protection Law.

Processor: means the natural or legal person responsible for Processing Personal Data, including where the person Processes Personal Data on behalf of the Controller and in accordance with the Controller’s instructions.

Processing: means any operation performed on Personal Data, whether by automated or non-automated means, including collection, recording, storage, organisation, use, disclosure, sharing, transfer, access, modification, restriction, concealment, deletion, destruction, anonymisation or any other handling of Personal Data.

Service Provider: means a third party engaged by the School or another SABIS^® entity to provide Website, CRM, hosting, admissions-processing, technical-support or related services involving access to or Processing of Personal Data.

Profiling: means automated Processing of Personal Data to evaluate, analyse or predict aspects relating to a Data Subject, such as behaviour, preferences, interests or characteristics.

Sensitive Personal Data: means Personal Data that directly or indirectly indicates a person’s origin, race, political opinions or affiliations, religious beliefs, financial status, health, physical or mental condition, genetic data, biometric data, criminal record, or any other information that the Personal Data Protection Council determines to be sensitive where its disclosure or misuse could harm the Data Subject.

Terms & Conditions: means the Website terms and conditions or other terms applicable to use of the Website, Website forms or related online services, where applicable.

Website: means the School’s website at iscamman.sabis.net and any webpages, online forms, landing pages, embedded forms, cookie tools or related online functionality operated or used by the School in connection with that Website.

Information Collected on Our Website

The Personal Data that may be collected through the Website includes, but is not limited to:

• Contact Details (e.g., name, home address, e-mail address, phone number)
• Content Data (e.g., text input)
• Identity Verification (e.g., date of birth, nationality, passport number)
• Technical and access data (e.g., access time, IP address, browser or device information, Website usage data and security or server logs)

Some Website forms, including the online Application Form where used, may ask a limited yes/no question about whether the prospective student has a medical condition, medication requirement or other health or support need. The Website does not collect medical records. Any detailed medical information required following admission is collected separately through the School’s medical forms and is Processed subject to enhanced safeguards and, where required, explicit Prior Consent.
The School may collect Personal Data through an online Application Form, Interest Form, Contact Us Form or other Website form in order to process an application, respond to an inquiry, arrange a meeting or tour or manage related admissions communications.

Where visitors submit Personal Data through the “Contact Us” form on the Website, the required details are used to contact the relevant visitor and process their inquiry.

This Policy also applies to Personal Data collected through Cookies and related technologies used in connection with the Website. Strictly necessary Cookies may be used to operate, secure and maintain the Website. Non-essential Cookies, including analytics Cookies where applicable, will be activated only after the required Prior Consent has been obtained. The School does not use marketing or advertising Cookies. Where analytics or another third-party service is enabled or embedded, including as described below, the relevant provider may independently Process information under its own terms and privacy policy. Further information about the Cookies used on the Website, including their provider, purpose and retention period, is provided through the Website’s Cookies Policy and/or cookie settings.

Children's Privacy

We place great importance on protecting the privacy of children who may use the Website. Individuals under the age of majority may only use the Website under the supervision and with the involvement of a parent or legal guardian.

If you are a parent or legal guardian and believe that your child has provided us with Personal Data without your consent, you may contact us at privacy@sabis.net. You may exercise applicable data protection rights on behalf of your child, including requesting access to, correction of, restriction of, or deletion of Personal Data submitted, subject to applicable law.

Purpose of Data Collection

Type of Personal Data Collected and Collection Purpose:
Information You Give to Us Voluntarily:

Interest Form:
Personal Data submitted through the Interest Form is collected for the purpose of communicating with individuals who require further information about the School, arranging meetings or tours, and supporting admissions-related communications.

Application Form:
Personal Data submitted via the Application Form is collected to facilitate and manage the student’s application, enrolment and admission process. This may include identification data, contact details and, where applicable, the limited health or support-related indication described above. Access is limited to authorised School personnel who require the information for authorised and necessary school-related purposes.

Contact Us Form:
Personal Data submitted through the Contact Us form is used solely to respond to inquiries and to take appropriate action based on the Data Subject’s request.

Information We Collect Automatically About You

Personal Data collected automatically through Cookies or web-server logs is used, as applicable, to operate, administer, secure and troubleshoot the Website, present its content effectively and understand Website activity. Non-essential Cookies are subject to the consent requirements described above. The School does not use Website data for Automated Decision-Making or Profiling that produces legal or similarly significant effects.

Data Security

We are committed to protecting your Personal Data and Processing it securely. To safeguard your information, we implement administrative, technical and physical security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, where appropriate, Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), data masking, encryption or secure transmission, logging and auditing, secure infrastructure controls, and access restrictions designed to ensure that Personal Data is accessed only by authorised personnel and Service Providers who require access for authorised and necessary Website, CRM, admissions, technical support, security or school-related purposes.

We remain committed to maintaining the confidentiality, integrity, and availability of your Personal Data and continually review and enhance our security measures in alignment with industry best practices and applicable legal requirements.

Where a serious Personal Data Breach may cause significant harm, Article 20 of the Data Protection Law requires the School to notify affected Data Subjects within twenty-four (24) hours and the Personal Data Protection Directorate within seventy-two (72) hours of discovering the breach.

Links to Our Social Media Portals

We maintain an online presence on social media networks and platforms in order to communicate with users and interested parties and inform them about our services (Facebook, Instagram and LinkedIn).
When you interact with the School through social media networks, online video hosting services or similar third-party platforms, your Personal Data may be Processed by those providers in accordance with their own terms of use and privacy policies. Depending on the provider, this may involve Processing outside Jordan.
Third-party websites, social media platforms and online services operate independently under their own terms and privacy policies. When you access an external link or interact with third-party content or functionality made available through the Website, the relevant provider may independently Process Personal Data, including outside Jordan. Where the School enables or embeds a third-party tool on the Website, the School will disclose its use and apply appropriate safeguards where required.

Link to Online Video Hosting

We use Vimeo, the online video hosting service from Vimeo Inc., 555 West 18^th Street, New York, New York 10011, on our Website. You may adjust your Vimeo data privacy settings by referring to their privacy policy at: https://vimeo.com/privacy

External Links

The Website includes links to external sites within the SABIS^® Global Network, such as SABIS^® Careers or the SABIS^® Newsletter. Please refer to the privacy policies of each external site within the SABIS^® Global Network to understand how your Personal Data is Processed.

Use of Google Analytics

The Website uses Google Analytics, a web analytics service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), to generate reports on Website activity and help us improve our services using active IP anonymisation.

For more information about Google Analytics cookies, you can access the following link: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

To opt out of Google Analytics (relating to your use of our Website), you can adjust your cookies settings, or you can download and install the Browser Plugin available by visiting:  https://tools.google.com/dlpage/gaoptout?hl=en.

Use of Google Maps

We use Google Maps on our Website. Google Maps is a service provided by Google LLC, 1600Amphitheatre Parkway, Mountain View, CA 94043, USA.

The Google Maps plug-in is included by embedding the service on our Website using what is known as iFrames. When loading these iFrames, Google may collect and process information (including Personal Data) under certain circumstances. We cannot exclude the possibility that Google may also transmit this information to a server in a different country.

Google may independently collect and Process Personal Data when Google Maps content is loaded or used, in accordance with Google’s own terms and privacy policy. The School does not determine Google’s independent Processing activities.

Use of Google Maps and any other embedded third-party tools may result in Personal Data being processed by the relevant third party in accordance with that third party’s own privacy terms. The School does not control the independent processing activities of those third parties, and users should review the applicable third-party privacy terms where they choose to interact with those tools.

The purpose of using Google Maps on our Website is to display our address and provide access routes to the School so that users may plan their journey independently.

Personal Data Erasure and Storage Duration

We will endeavour to keep your Personal Data accurate and up-to-date and not keep it for longer than is necessary to fulfil the purposes outlined in this Policy unless otherwise required by law.

The Interest Form, Application Form and Contact Us Form available on our Website (referred to in this Policy as the “Forms”) are created using the School’s Customer Relationship Management (CRM) web application, which is integrated with the Website. Personal Data collected through these Forms is stored in the School CRM database for the applicable retention period set out below, unless a longer period is required or permitted by law or for administrative, legal, operational or record-keeping purposes.

Interest Forms and Application Forms are retained until August 1 of the academic year of interest, unless the individual becomes an enrolled student or further retention is required for administrative, legal, operational or record-keeping purposes.

Contact Us form submissions are retained for one (1) year from submission, unless the inquiry becomes part of an admissions, registration, student administration or school record, or further retention is required for administrative, legal, operational or record-keeping purposes.

Event-related forms are retained for ten (10) days after the event, unless further retention is required or explicit consent has been obtained for additional Processing.

Parent data relating to enrolled students is retained while the student is enrolled and is generally deleted one (1) year after the student leaves the School, unless the information forms part of another School record or further retention is required or permitted by applicable law or valid Prior Consent, in accordance with the General School Privacy Policy.

The retention of Personal Data independently collected by social network operators and other third-party platforms is governed by their own retention practices and privacy policies.

Personal Data Transfer and Sharing

Personal Data submitted through Website forms may be stored in the School’s designated CRM database hosted in Microsoft Azure in Europe.

Authorised School personnel may access the data for admissions, communication, administrative and related School purposes. Authorised personnel from SES LEB may access CRM data where required for technical support, maintenance, troubleshooting or system administration, including upon the School’s request.

Active Website tools, maps, video-hosting services, social-media platforms or external links may involve independent Processing by third-party providers outside Jordan. Before Personal Data is transferred, stored or accessed outside Jordan by or on behalf of the School, the School will take reasonable steps to verify the level of protection applicable to the Personal Data in the receiving jurisdiction and to ensure that the transfer is permitted under the Data Protection Law and other applicable data protection requirements. Where the receiving jurisdiction does not provide an equivalent level of protection, the transfer will take place only where permitted under Article 15 of the Data Protection Law or another applicable legal provision, including, where required, after obtaining and recording explicit Prior Consent following appropriate notice regarding the level of protection.

Disclosure to Third Parties

We do not share Personal Data collected through this Website with third parties except where necessary for the purposes described in this Policy, where required or permitted by law, where supported by consent, or where appropriate safeguards are in place.

• Legal and Regulatory Requirements:
  We may disclose your Personal Data if we receive a valid request from law enforcement agencies, regulatory bodies, or government authorities - whether in the country of origin or elsewhere - where such disclosure is required by applicable law.
• Service Providers:
  We may share your Personal Data with trusted Service Providers who assist us in delivering our services (e.g., hosting, admissions processing, IT support). These Service Providers are contractually bound to Process Personal Data only on our instructions and in compliance with applicable data protection laws. A list of these Service Providers is available upon request, where applicable.
• Admissions, School Operations and Requested Services: We may share Personal Data with relevant third parties where necessary to process applications, manage admissions communications, provide requested services, administer Website or CRM workflows, or support related school operations, provided such sharing is supported by a lawful basis and subject to appropriate safeguards.

Third-party data sharing is subject to appropriate confidentiality, contractual, technical and organisational safeguards, where applicable, to protect Personal Data.

Legal Basis for the Processing of Your Personal Data

Under the Data Protection Law, the School Processes Personal Data with Prior Consent where required, or without Prior Consent only where a specific statutory exception applies. The applicable basis depends on the purpose and circumstances of the Processing.

Prior Consent

Personal Data voluntarily submitted through the Contact Us Form, Interest Form, online Application Form, event form or another Website form is Processed for the specific purpose identified in the relevant form and this Policy, on the basis of Prior Consent recorded through the relevant form, signature, checkbox or other mechanism, unless a specific legal exception applies. Prior Consent may be withdrawn at any time by contacting privacy@sabis.net without affecting the lawfulness of Processing carried out before withdrawal.

Processing Permitted by Law

The School may Process Personal Data without Prior Consent only where a specific case permitted by applicable law applies, including where Processing is required or permitted by legislation or a competent court decision, is necessary for healthcare provided by a licensed medical practitioner, is necessary to protect life or vital interests, or falls within another circumstance recognised under Article 6 of the Data Protection Law.

Necessity and Proportionality

Regardless of the applicable legal ground, the School limits Website-related Processing to Personal Data that is directly relevant and necessary for a clear and specified purpose, including responding to inquiries, arranging meetings or tours, processing applications, administering events and maintaining Website and CRM security. Necessity and proportionality limit the scope of Processing but do not, by themselves, replace Prior Consent or another specific legal permission.
Certain fields are required to submit a Contact Us, Interest, Application or event form and allow the School to respond to the request or process the application. The relevant form should identify, where appropriate, whether information is mandatory or optional. If required information or the applicable Prior Consent is not provided, the School may be unable to process the form or provide the requested service.

Marketing and Recommendations:

The School does not use Personal Data for direct marketing, advertising or promotional communications unless the individual has provided the required Prior Consent. Newsletter subscriptions, where offered, are managed through an external SABIS^® platform and are entirely voluntary. Individuals provide consent directly through the relevant subscription mechanism and may unsubscribe at any time using the option provided in each communication.

Sensitive Personal Data:

Where Processing involves health-related, religious or other Sensitive Personal Data, the School will obtain explicit Prior Consent from the parent or legal guardian where required and apply enhanced safeguards, unless a specific legal exception applies.

If the nature, type or purpose of Processing changes, the School will obtain new Prior Consent where required. All Processing is subject to appropriate technical and organisational safeguards and is limited to the purposes described in this Policy.

Data Subject Rights

You have rights regarding your Personal Data, subject to applicable law and any limitations expressly permitted under applicable law. To exercise any of these rights, please email privacy@sabis.net. The School will acknowledge Data Subject rights requests within fifteen (15) working days from the day following receipt and will thereafter review and respond to such requests in accordance with applicable law and the School’s Data Subject rights procedure. The School may need to verify the identity and authority of the person making the request.

• Right of access and information – You have the right to request information about, access to, and a copy of the Personal Data we hold about you.
• Right of rectification – You have the right to ask us to correct inaccurate or incomplete data we hold about you.
• Right to request deletion or concealment – In certain circumstances, you can ask for the Personal Data we hold about you to be erased, concealed or deleted from our records.
• Right to restriction of Processing – Under certain conditions, you have the right to ask us to restrict or limit the Processing of your Personal Data to a specific scope.
• Right to obtain or transfer a copy – Where applicable, you may request a copy of your Personal Data in an accessible format or request the transfer of a copy to another Controller.
• Right to object to Processing or Profiling – You may object where Processing or Profiling is unnecessary for the stated purpose, excessive, discriminatory, prejudicial or otherwise contrary to law. The Website does not currently use automated decision-making or Profiling that produces legal or similarly significant effects.
• Right to withdraw consent – Where Processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of Processing carried out before withdrawal.
• Right to lodge a complaint – You may submit a complaint first to the School’s DPO and, where the matter is not resolved, to the Personal Data Protection Directorate in accordance with the applicable complaint procedure. Exercising the right to lodge a complaint will not, by itself, result in adverse consequences for the Data Subject.
• Right to be notified of certain breaches – Under Articles 4 and 20 of the Data Protection Law, affected Data Subjects must be notified where a serious Personal Data Breach may cause significant harm, in accordance with the applicable breach-notification requirements.

Questions, Requests and Complaints

Questions, requests or complaints relating to this Website Privacy Policy or the Processing of Personal Data through the Website should be submitted to the DPO at privacy@sabis.net. The School will acknowledge Data Subject rights requests within fifteen (15) working days from the day following receipt and will thereafter review and respond to such requests in accordance with applicable law and the School’s Data Subject rights procedure. Privacy complaints will be acknowledged within ten (10) days from the day following submission and will thereafter be reviewed and responded to in accordance with applicable law and the School’s complaint-handling procedure.

Where a Data Subject is not satisfied with the School’s response, they may submit a complaint to the Personal Data Protection Directorate in accordance with the applicable complaint procedure.

Acceptance and Changes to the Policy

By using the Website or submitting information through Website forms, you acknowledge that you have read and understood this Policy. This acknowledgment does not itself constitute Prior Consent. Where Prior Consent is required for a specific Processing activity, it will be requested separately through the relevant form, signature, checkbox or other consent mechanism.