Trust & data

Privacy Policy

How we collect, use, and protect your information — built for families, aligned with modern privacy standards.

Last updated 14 May 2026

01Who we are

Ather Private Schools ("Ather", "we", "us") is a licensed educational institution. The data controller is the Head of School.

02Information we collect

  • Identifying information (name, date of birth, nationality, photo) provided during admissions and enrolment.
  • Contact information for guardians, emergency contacts, and authorised pickup persons.
  • Educational records, attendance, behaviour and wellbeing notes.
  • Health information disclosed for the safety and wellbeing of your child.
  • Financial information necessary for billing and government reporting.
  • Technical data when you use our website and portal (IP address, browser, pages visited).

03How we use information

Solely to deliver and improve our educational services: admissions, teaching and learning, safeguarding, communication with families, statutory reporting, alumni relations, and lawful business operations.

04Lawful basis

Contractual necessity, legitimate interests in delivering education, legal obligation (ministry reporting), and consent (for optional uses such as photography in marketing).

05Sharing

We do not sell personal data. We share only with examination boards, education authorities, healthcare providers in emergencies, IT vendors under strict data processing agreements, and law enforcement when legally required.

06International transfers

Some vendors (for example examination boards or cloud infrastructure) operate outside Iraq. We transfer only under appropriate safeguards.

07Retention

Student academic records: 25 years. Financial records: 10 years. Marketing communications: until you unsubscribe. Web analytics: 14 months.

08Your rights

You may request access, correction, deletion (subject to legal retention), portability, restriction, or objection. Email privacy@atherschools.com; we respond within 30 days.

09Children

Children under 16 are processed under parental consent. Marketing imagery requires explicit annual opt-in.

10Security

Encryption in transit (TLS 1.3), encryption at rest, role-based access control, annual penetration testing, staff training, and a documented incident response plan.

11Cookies

See our cookie notice, or use the cookie controls on the site to change preferences.