EL SCHOOL
Privacy policy
Updated: October 13, 2026
Who we are
EL SCHOOL is a school management platform designed for Tunisian private schools. Administrators, teachers, pupils and parents use it for school life, communication and administrative tasks.
Data controller: the school — SOCIETE IBN ROCHD D'ENSEIGNEMENT PRIVE. The school decides why and how personal data is processed in EL SCHOOL, and is responsible for it.
Data protection contact: privacy@ibnrochd.net
For any other question about this policy: support@ibnrochd.net
Applicable law
The processing of personal data in EL SCHOOL is governed by Tunisian law, in particular Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data.
Data we collect
We collect the following categories of personal data when you use EL SCHOOL:
- Account information: full name, email address, phone number and role (administrator, teacher, pupil, parent).
- Pupils’ school records: grades, attendance, submitted homework, course enrolment and results.
- Absence justifications and notices: if you choose to submit them: the reason (including illness or a medical appointment), an optional note and certificate, linked to the pupil and submitting parent. They may contain health data; they are used to announce or justify an absence and are reviewed by administrators at the school.
- Financial data: tuition invoices, payments and billing history for school fees.
- Communications: messages exchanged in EL SCHOOL messaging between teachers, pupils and parents.
- Files and media: contents of photos, videos, audio recordings and documents you choose to send (attachments, submitted work, certificates), together with file names and technical metadata.
- Device information: notification tokens of the EL SCHOOL mobile app, used to send you alerts.
- Usage logs: sign-in times, IP addresses, actions performed on the platform and error logs, for security and fixing faults.
How we use your data
We use the personal data we collect to:
- run school management: grades, attendance and homework;
- send notifications about absences, grades, upcoming homework and payment dates, in the platform and on the phone;
- let teachers, pupils and parents communicate through the built-in messaging;
- record and follow tuition payments and prepare financial reports for the school;
- keep the platform secure and detect unauthorised access or fraud;
- improve EL SCHOOL from how it is used and from users’ feedback;
- comply with applicable Tunisian law and school regulations.
Data sharing
EL SCHOOL does not sell, rent or trade personal data. Authorized school staff, families and providers needed to deliver the service can access school records according to their roles and functions. Exchanges with the YouTube player are described in Hosting and services and are also governed by Google’s privacy policy. EL SCHOOL does not use school records to target advertisements or supply marketing services.
Hosting and services
EL SCHOOL uses hosting, storage and delivery services. Storage, backup, email, SMS and error-reporting destinations depend on the school’s configuration. To find out which providers and destinations are used for your school, contact privacy@ibnrochd.net.
- Storage: files may be stored on the application server or in a configured storage service.
- Service emails and SMS: email delivery sends recipient addresses and email contents to the configured email provider. When an SMS service is enabled, it receives the recipient’s phone number and SMS contents.
- Expo: relaying notifications to the mobile app through Apple Push Notification service (Apple) on iPhone and Firebase Cloud Messaging (Google) on Android. Notifications can contain sender or child names, message previews, absence-justification review notes, device tokens and account, conversation or record identifiers for delivery and opening the relevant content.
- Error reports: When enabled, technical reports from the app, the office website and the server are sent to the configured error-reporting service. They may contain the error, stack traces, version, technical context, navigation and an internal account identifier. These identifiers are pseudonymous and remain linked to an account. Filters remove contact details from structured account fields, request bodies, cookies and selected authentication headers; this filtering does not guarantee that all free-text fields are free of personal data.
- YouTube / Google: Some course videos use the embedded YouTube (Google) player. Loading the player sends technical data to YouTube to display the title and thumbnail, check video availability and prevent abuse. Playback also sends information about player use. Google explains its processing at https://policies.google.com/privacy. Disabling autoplay or third-party cookies does not eliminate all these exchanges. EL SCHOOL also records playback events and resource opens for educational follow-up linked to the pupil account.
Retention and erasure
Confirming deletion closes access and revokes sessions. Sign-in identifiers, date of birth and profile contact details are cleared or replaced. Your message text and edit-history text are erased, and cleanup of personal files starts.
An internal request tracks remaining items for review: academic, attendance, behaviour and financial records, justifications that may contain health data, shared documents, logs, diagnostics, backups, exports and processor copies. The internal account ID remains for tracking. Closing access does not certify complete erasure. No approved retention schedule or general legal basis for retention has been documented to date.
Use /delete-account or the in-app deletion feature; confirmation or identity verification is required. No second message is needed to start follow-up. For progress or to clarify your request: privacy@ibnrochd.net.
Your rights
You can send the school the following requests about your personal data:
- Access: request a copy of the personal data we hold about you.
- Correction: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your data, including data that remains after account deletion.
- Portability: request your data in a structured, machine-readable format.
- Objection: send an objection to the processing of your data.
- Restriction: ask for the processing of your data to be restricted.
To make a request, contact privacy@ibnrochd.net and specify the data concerned and the action you are requesting. The school office may verify your identity before processing it.
Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, change, disclosure or destruction:
• Authentication: requests for protected data require a signed token (JWT).
• Encryption in transit: data travelling between your device and our servers is encrypted (HTTPS/TLS).
• Protected passwords: passwords are stored hashed (bcrypt), never in clear text, and EL SCHOOL staff cannot recover them.
• Protected sessions: on the office website, the short-lived access token is kept in the browser’s local storage and the token that renews the session in a cookie scripts cannot read (httpOnly, Secure, SameSite=Strict). In the mobile app, tokens are kept in the phone’s secure storage (Keychain on iPhone, Keystore on Android).
• Access by role: everyone (administration, teacher, pupil, parent) reaches only the data their role needs.
No system is infallible: choose a strong, unique password and sign out on a shared device.
Children’s privacy
EL SCHOOL is by nature used by minors (pupils under 18). We take their protection very seriously.
• Creation and activation: the school supplies a QR code. A parent or pupil can use it in the app to create the account it authorises. If a pupil account is already reserved during the parent’s activation, the pupil can activate it with their own name and password.
• Pupil data: the collected categories are described in « Data we collect », including absence justifications and uploaded files.
• Parent access: parents and guardians see the school record of the child linked to their account and the conversations they can access.
• No marketing: we do no direct marketing to pupils.
For questions about a child’s enrolment, consent or the use of their data, contact privacy@ibnrochd.net.
Changes to this policy
We may update this policy as our practices, technology or the law change. The « Last updated » date identifies the published revision. For questions about a change, contact privacy@ibnrochd.net.
Contact
For any question or request about this policy or the use of your data:
Data controller: SOCIETE IBN ROCHD D'ENSEIGNEMENT PRIVE
Product: EL SCHOOL
Data protection contact: privacy@ibnrochd.net
Support: support@ibnrochd.net
Country: Tunisia