Last updated: September 2026
This Privacy Policy explains how SKOOLES collects, uses, shares and protects personal data across the SKOOLES platform. It covers our website at skooles.com and all four SKOOLES products: SKOOLES Web, SkooHub, SkooBook and SkooNet. Product-specific details are set out in the annexes at the end of this policy.
1. The two roles we play
Our responsibilities depend on whose data we are handling. This distinction matters, so we state it plainly.
When we act as a controller. For visitors to skooles.com, people who contact us or request a demo, and our own business contacts, SKOOLES decides why and how personal data is processed. This policy governs that processing.
When we act as a processor. For data inside a school, university or training centre using SKOOLES, the institution is the controller. It decides what data is entered, who may see it, and how long it is kept. We process that data only on the institution’s documented instructions, under our Data Processing Agreement. If you are a student, parent or member of staff, please direct requests about your records to your institution first; we will support them in responding.
2. Data we collect
2.1 Website and enquiries (we are the controller)
- Contact details you submit: name, email address, and the content of your message.
- Technical data: IP address, browser and device type, pages viewed, and referring page.
- Cookie and analytics data, as described in our Cookie Policy.
2.2 Platform data (the institution is the controller)
Depending on which modules the institution enables, the platform may process:
- Identity and profile: name, date of birth, nationality, languages, photograph, contact methods, and the relationships between students, parents and staff.
- Academic records: enrolment, courses, timetables, assignments, assessments, grades and academic history.
- Attendance: presence records for class sessions, agenda items and transportation trips, including check-in events captured by NFC or Bluetooth on school buses.
- Transportation: routes, assigned buses, pick-up and drop-off events, and live trip status. Location data is processed on the driver device during an active trip.
- Communication: messages, announcements, alerts and attachments sent through SkooNet.
- Health and welfare data: where the institution chooses to use the medical records module, this may include allergies, conditions and emergency contacts. This is sensitive data and is treated accordingly.
- Employment data: for staff, contracts, certifications and course assignments.
- Technical and audit data: sign-in events, device and app version, sync status, and an audit log of changes made to records.
3. Why we process data and on what legal basis
Where the GDPR or equivalent law applies, we rely on the following bases.
- Contract. To provide the platform to the institution and to operate accounts, sync, messaging and support.
- Legitimate interests. To keep the service secure, prevent abuse, diagnose faults, and improve reliability, balanced against the rights of the people concerned.
- Legal obligation. To meet record-keeping, safeguarding and reporting duties that apply to us or to the institution.
- Consent. For optional cookies and for marketing email. You may withdraw consent at any time.
- Public task or substantial public interest. Where a public education authority relies on these bases for the delivery of education, we process on its instructions.
We do not sell personal data. We do not use student data to train third-party AI models, and we do not serve behavioural advertising to students.
4. Children and student data
SKOOLES is designed for use in schools, which means much of the data we process concerns children. We take specific positions on this:
- Accounts for pupils are created and controlled by the institution, not by the child directly. Where consent is required for a child, it is obtained by the institution from the parent or guardian in line with local law, including Article 8 GDPR.
- For institutions in the United States, the institution may designate us a school official with a legitimate educational interest under FERPA. That designation holds only while the institution keeps direct control over our use and maintenance of education records, which our Data Processing Agreement is written to give it. We process student records only under the institution’s direction.
- We do not knowingly collect personal data directly from a child under 13 outside an institutional relationship. Where COPPA applies, a school may give consent in place of a parent, but only for uses of the service that are limited to an educational purpose. That consent does not transfer our own obligations as an operator to the school, and it never permits us to use student data for a commercial purpose.
- Student data is not used for advertising, profiling for commercial purposes, or building a profile outside the educational context.
- On termination, student data is returned or deleted as set out in section 8 and in the Data Processing Agreement.
5. Who we share data with
We share personal data only with service providers that help us run the platform, and only to the extent needed. Each is bound by contract to protect the data and to process it solely on our instructions. Our current list is published at Sub-processors, which names each provider and its role.
We may also disclose data where we are legally required to do so, or to protect the rights and safety of users. We will tell the institution before responding to a request for its data unless we are legally prevented from doing so.
6. International transfers
SKOOLES is operated from Lebanon and uses cloud infrastructure that may process data in the European Union, the United Kingdom, the United States and other regions, depending on the services enabled. Where data leaves the European Economic Area, we rely on the European Commission Standard Contractual Clauses or another approved transfer mechanism, together with technical measures such as encryption in transit and at rest. Institutions with data residency requirements should raise them before deployment; some components can be hosted on premises.
7. Security
Security measures include tenant isolation so that each institution’s data is fully separated, OAuth 2.0 and OpenID Connect authentication, role and permission based access control, AES-256 encryption of sensitive data at rest, TLS in transit, and audit logging of data operations. A fuller description is on our Security page. No system is perfectly secure; if a breach affects personal data we will notify the affected institution without undue delay and support its own notification duties.
8. How long we keep data
- Website enquiries: up to 24 months from last contact, unless you ask us to erase them sooner.
- Platform data: for as long as the institution’s subscription is active. After termination the institution has 30 days to export its data, after which we delete or irreversibly anonymise it within 90 days, unless law requires longer retention.
- Backups: deleted data persists in encrypted backups for up to 35 days before being overwritten.
- Audit logs: retained for up to 12 months for security and accountability.
9. Your rights
Subject to local law, you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent. Under Lebanese Law 81/2018 you have the right to be informed of the identity of the controller and the purposes of processing, and to access and correct your data.
If your data is held inside an institution’s SKOOLES tenant, contact that institution first, as it controls those records. For data we control, or to ask us to delete an account you created with us directly, use our Account and Data Deletion page or email [email protected]. We respond within 30 days. If you are in the EEA or UK and are unsatisfied, you may complain to your local supervisory authority.
10. Cookies
We use a small number of cookies for essential site functionality and, with your consent, for analytics. Details and your choices are in our Cookie Policy.
11. Changes to this policy
We will update this page when our practices change and revise the date at the top. Where a change materially affects how we handle personal data, we will notify institutions in advance through the platform or by email.
12. Contact us
Privacy questions, data requests and complaints: [email protected]. Postal address: Tripoli, Lebanon. We aim to acknowledge every request within five working days.
Annexes: product-specific disclosures
The following annexes describe data handled by each SKOOLES product. They form part of this policy and are the disclosures referenced from our app store listings.
Annex A. SkooHub (school life mobile app)
Platforms: iOS, Android and web. Users: students, parents, teachers, administrators and bus drivers.
- Location. Collected only on the bus driver device, and only while a transportation trip is active, in order to show live trip status to parents and the school. It is not collected in the background when no trip is running, and it is not collected from student or parent devices.
- Bluetooth and NFC. Used to record student check-in and check-out on buses. We read the identifier of the school-issued tag or beacon; we do not scan for unrelated devices.
- Camera and photo library. Used only when a user chooses to attach or capture an image, for example a profile photo or a message attachment.
- Push notifications. Device tokens are processed to deliver alerts about agenda changes, attendance, transport status and messages.
- Offline storage. Agenda, attendance and transport data is cached in an encrypted local database so the app works without a connection. It is removed when the user signs out.
Annex B. SkooBook (learning app)
Platforms: Android, iOS and Windows. Users: students and teachers.
- Course and learning data. Enrolled courses, resources, assignments and progress are synchronised to the device so they remain available offline.
- Offline storage. Course content is stored in a local database on the device and cleared on sign-out or token revocation.
- Translation. Where a user requests on-demand translation, the selected content is sent to Microsoft Azure Translator for processing and is not retained by that service for model training.
- No location, Bluetooth, or advertising identifiers are collected by SkooBook.
Annex C. SkooNet (communication platform)
SkooNet is built on the Matrix open messaging standard and runs on a homeserver operated for the institution.
- Message content and metadata. Messages, attachments, room membership and timestamps are processed to deliver communication. Retention is configured by the institution.
- Encryption. The platform supports end-to-end encrypted rooms. Where a room is end-to-end encrypted, we cannot read its contents.
- Moderation and safeguarding. Institutions may enable retention and oversight of school communications to meet safeguarding duties. Where they do, users are informed by the institution.
- Push notifications. Device tokens are processed to deliver message alerts.
Annex D. SKOOLES Web (administration dashboard)
The web dashboard is used by school administrators and staff. It processes the full set of platform data described in section 2.2, subject to each user’s role and permissions. All access is authenticated, permission-checked and written to an audit log. AI features available to administrators, such as analytics and predictive risk indicators, are decision-support tools only; they do not make automated decisions that produce legal or similarly significant effects on a person without human review.
Note on legal review
This policy describes our actual practices and is published so that users and institutions can rely on it. It should be reviewed by qualified counsel in each market before it is used as a contractual commitment.