A school-centred privacy framework for our students, families, staff and community
Last updated: September 2026
Policy owner: Arcadia Global School
Review cycle: At least annually, or sooner where legislation, regulation, technology or School practice changes
Collect only what we reasonably need • Use it responsibly • Protect it carefully • Share it thoughtfully • Retain it no longer than necessary
At Arcadia Global School (AGS), protecting the privacy, dignity and safety of our students, families, staff and wider community is an important responsibility.
As a school, we are entrusted with information about children and families every day. Some of that information is highly sensitive. We recognise that this trust carries with it a responsibility to collect, use, store, share and dispose of personal data carefully, transparently and securely.
We aim to apply high standards of data protection throughout the School and to ensure that personal information is:
This Notice explains how Arcadia Global School handles personal data and the choices and rights available to individuals whose information we process.
Arcadia Global School is a private school operating in Dubai, United Arab Emirates and regulated by the Knowledge and Human Development Authority (KHDA) and other relevant UAE and Dubai authorities.
For the purposes of applicable data protection legislation, AGS is responsible for determining how and why much of the personal data covered by this Notice is processed.
Throughout this Notice, the terms “AGS”, “the School”, “we”, “us” and “our” refer to Arcadia Global School.
Arcadia Global School has appointed a Data Protection Officer to oversee compliance with applicable data protection laws. Questions about this Notice, the School’s use of personal data, or to exercise your data subject rights should be directed to: Arcadia Global School, Dubai, United Arab Emirates Attention: Data Protection Officer (DPO) Email: Info@arcadiaglobal.sch.ae Telephone: +97145599700.
This Notice may apply to personal data relating to:
Because education involves children, AGS gives particular attention to the protection of student personal data.
AGS processes personal data in accordance with applicable UAE and Dubai legislation and regulatory requirements, including, where applicable:
Where different requirements apply to a particular category of information, AGS will seek to apply the appropriate standard.
Personal data is information relating to an identified or identifiable individual.
Depending on the circumstances, this may include information such as:
Some personal data requires particularly careful handling because of its sensitive nature.
The information AGS processes about a student may include:
This may include information relating to:
Such information is treated with particular care and is shared internally only where staff have an appropriate reason to access it.
This may include:
AGS may process information relating to the safety and protection of a child.
Access to safeguarding information is strictly controlled and limited to individuals who need the information in order to protect or support the child, or where disclosure is required or permitted by law or by a competent authority.
We may process information relating to:
AGS may process information relating to parents and guardians including:
Where there is a court order, custody arrangement or other legal restriction relevant to a child’s education or safety, the School may also need to retain appropriate information relating to it.
AGS processes personal data only where there is an appropriate purpose and a valid lawful basis under the UAE PDPL for doing so. Depending on the processing activity, our lawful basis will typically be one of the following:
To:
To:
To:
To:
To:
To meet requirements imposed by bodies including, where applicable:
To:
To administer recruitment, employment, payroll, professional development, safeguarding checks and related HR activities.
To provide:
Children deserve particular protection when their personal information is used.
AGS therefore seeks to apply the following principles when processing student data:
A parent’s ability to exercise rights on behalf of a child may depend on the child’s age, maturity, the nature of the information and applicable legal requirements.
Age of Consent and Parental Authority: Under UAE law, minors cannot provide valid legal consent for the processing of their personal data. Where consent is the lawful basis for processing a student’s data (such as for marketing, public photography, or biometric access systems), AGS will always seek the explicit, informed consent of the student’s parent or legal guardian.
AGS may need to process particularly sensitive information in order to fulfil its educational, safeguarding, health, inclusion and legal responsibilities.
This may include information concerning:
AGS will apply additional safeguards to such information where appropriate.
Protecting children can sometimes require the School to process or share information without obtaining consent first.
Where AGS reasonably believes that:
the School may disclose relevant information to appropriate persons or authorities.
The safety and protection of children will always be given very serious consideration.
Personal data may be obtained:
AGS does not sell personal data.
We may, however, share relevant personal information where doing so is necessary for the legitimate operation of the School, the education or protection of a child, compliance with a legal or regulatory requirement, or another permitted purpose.
Recipients may include:
Providers working on behalf of AGS are expected to protect information appropriately and use it only for authorised purposes.
Reports concerning learning needs, disabilities, health, emotional wellbeing or other individual needs can contain highly sensitive personal information.
AGS treats such reports with particular care.
Access should normally be restricted to staff directly involved in supporting the student and to other persons who have a legitimate professional need for the information.
Where information must be shared outside the School, AGS will take into account applicable law, regulatory requirements, safeguarding considerations, parental authority and the best interests of the student.
Photography and video play an important role in celebrating student achievement, communicating with families and recording School life.
AGS may take photographs, video or audio for purposes including:
Where consent is required, AGS will seek appropriate consent.
Families should understand that there may be circumstances in which photography or video is necessary for legitimate School purposes separate from marketing consent — for example, security, safeguarding, educational evidence or the recording of certain official School activities.
Where parents or students have concerns about the use of an image, they should contact the School.
AGS may operate CCTV and other security systems on School premises for purposes including:
CCTV access is restricted to authorised persons.
Recordings will normally be retained only for an appropriate period unless an incident requires footage to be retained for longer.
CCTV will not normally be installed in areas where individuals have a reasonable expectation of a high level of privacy.
AGS uses digital technology to enhance teaching, learning and School operations.
This may include:
Before introducing systems that process significant or sensitive student information, the School should consider the privacy, security and educational implications of their use.
Personal information must not be uploaded by staff or students into unauthorised technology or artificial-intelligence platforms.
Where AI systems are used, AGS seeks to ensure that their use is appropriate, proportionate, secure and consistent with School policies and applicable law.
Important decisions affecting a child should not ordinarily be made solely by an automated system without appropriate human oversight.
Some of the technology, educational platforms, service providers or cloud systems used by AGS may store or process information outside the UAE.
Where personal data is transferred internationally, AGS ensures that such transfers strictly comply with the UAE PDPL. Data will only be transferred to jurisdictions that have been approved by the UAE Data Office as having an adequate level of data protection. Where a jurisdiction has not been explicitly approved, AGS will ensure that appropriate safeguards are implemented, such as legally binding standard contractual clauses (SCCs), explicit consent from the data subject/guardian, or other mechanisms expressly permitted by UAE law.
Depending on the circumstances, these safeguards may include:
AGS does not intend to retain personal information indefinitely simply because it has been collected.
Different records are retained for different periods depending upon:
Certain records relating to safeguarding, academic history, regulatory compliance or employment may need to be retained for longer periods.
Where personal data is no longer reasonably required, AGS will seek to securely delete, destroy or anonymise it in accordance with its records-retention procedures.
AGS takes reasonable organisational, administrative and technical steps designed to protect personal information.
Depending on the nature of the information and the system involved, these measures may include:
Access to personal information should be limited to individuals who require it for legitimate School purposes.
No information system can be guaranteed to be completely secure, but AGS seeks continuously to improve its safeguards in response to changing technology and risk.
AGS seeks to ensure that the information it holds is accurate and, where necessary, up to date.
Parents, employees and other members of the School community should inform AGS promptly where important information changes, particularly:
Subject to applicable UAE law and any relevant exemptions, individuals may have rights concerning their personal data.
These may include rights to:
These rights are not absolute.
For example, the School may need to retain or continue processing information to:
AGS may need to verify the identity and authority of a person making a privacy request before releasing information.
Parents and guardians will ordinarily receive information about their child’s education, progress, attendance and welfare as part of the normal relationship between home and School.
However, access to information may occasionally need to be restricted where:
Each situation will be considered carefully.
AGS may send families and prospective families information about School activities, events, admissions and other relevant opportunities.
Where applicable, recipients can withdraw from optional electronic marketing communications by using the unsubscribe facility provided or contacting the School.
Operational, educational, safeguarding, billing, emergency and regulatory communications are not marketing communications and may still need to be sent where necessary.
When someone visits the AGS website, certain technical information may be collected automatically.
This may include:
AGS may use this information for:
The AGS website may use cookies and similar technologies.
Where required, users will be provided with appropriate choices regarding non-essential cookies.
AGS will maintain information about the cookies used on its website and should periodically review its cookie practices to ensure that its published information accurately reflects the technologies in use.
The School website or digital platforms may contain links to third-party websites or services.
AGS is not responsible for the privacy practices of independent third parties.
Users are encouraged to review the privacy notices of those organisations before providing personal information to them.
Where a third party processes data on behalf of AGS, the School will seek appropriate contractual and security assurances.
AGS may collect personal information through:
The information collected should be limited to what is reasonably necessary for the relevant purpose and handled in accordance with this Notice.
Where additional or materially different uses are intended, appropriate information will be provided at the point of collection.
AGS takes suspected loss, unauthorised disclosure, misuse or compromise of personal information seriously.
Where a suspected personal-data breach occurs, the School will seek to:
Anyone who believes that personal information held by AGS has been compromised should report the concern immediately to the School.
All AGS employees who handle personal information are responsible for protecting it.
Staff are expected to:
Failure to follow School requirements relating to personal data may result in disciplinary action where appropriate.
Where an external organisation processes personal information on behalf of AGS, the School seeks to select providers capable of protecting that information appropriately.
Depending on the nature of the service, AGS may assess matters including:
Suppliers should only use School data for authorised purposes.
Anyone who has a question or concern about the way AGS handles personal information is encouraged to contact the School in the first instance.
Data Protection Officer (DPO), Arcadia Global School, Dubai, United Arab Emirates. Email: Info@arcadiaglobal.sch.ae. Telephone: +97145599700.
We will seek to investigate legitimate privacy concerns fairly and promptly. Individuals also have the right to lodge a formal complaint with the UAE Data Office if they believe their data protection rights have been violated.
Privacy, education and technology continue to evolve.
AGS may therefore update this Privacy and Data Protection Notice from time to time to reflect:
The most current version will be published by the School and will include the date on which it was last updated.
Where a change would materially affect the way existing personal information is used, AGS will take reasonable steps to communicate that change and, where necessary, obtain appropriate consent or establish another lawful basis before proceeding.
Arcadia Global School is entrusted with information about children, families, employees and members of our community.
We recognise that privacy is not simply a compliance requirement. It is part of the trust that exists between a school and its families.
Our aim is therefore simple: to collect only what we reasonably need, use it responsibly, protect it carefully, share it thoughtfully and retain it no longer than necessary.
The same standards of integrity, responsibility and care that we expect throughout our School community guide our approach to personal information.
Your child’s privacy matters. AGS uses personal information to educate, safeguard and support students, run the School effectively and meet UAE and Dubai regulatory requirements. We aim to collect only what we need, protect it carefully and share it only where there is a proper reason.
What we may hold: Identity and contact details; admissions and academic records; attendance and behaviour; health, safeguarding and inclusion information; photographs/video; trip, activity and transport information; and relevant parent/guardian details.
Why we use it: To provide education, support progress and wellbeing, safeguard children, deliver inclusion, communicate with families, manage admissions/fees/activities, maintain security and meet KHDA, government and legal obligations.
Who we may share with: Relevant regulators and government authorities; health or safeguarding services; examination bodies; other schools; approved technology, transport, trip and service providers; and professional advisers where there is a legitimate or legal reason.
How we protect it: Need-to-know access, approved systems, access controls, passwords and multi-factor authentication where appropriate, staff confidentiality, cybersecurity measures, supplier checks and secure disposal/retention processes.
Children’s information receives particular protection. Sensitive student data should only be accessed by staff who have a legitimate professional reason. Safeguarding information may need to be shared without consent where this is necessary to protect a child or comply with law or a competent authority.
AGS may use photographs, video, educational platforms, cloud services and approved AI-enabled tools for legitimate School purposes. Where consent is required for marketing use, we will seek it. Personal information should not be uploaded to unauthorised AI or technology platforms.
Subject to UAE law and relevant exemptions, you may be able to ask how information is used, request access or correction, request deletion or restriction in appropriate circumstances, withdraw consent where processing relies on consent, and raise concerns. Some records must still be retained for safeguarding, regulatory, educational or legal reasons.
Some approved providers may process information outside the UAE. AGS seeks appropriate safeguards for international transfers. Records are kept only for as long as reasonably necessary, subject to legal, regulatory, safeguarding, educational and operational requirements.
Questions or concerns? Contact AGS at Info@arcadiaglobal.sch.ae / +97145599700. The full Privacy and Data Protection Notice is available from the School and on the AGS website.
