School-controlled data. For learner records supplied or created through a school account, the school normally determines why the data is used. EEP EdTech operates TOP Learning Engine as the school’s service provider under the school agreement and Data Processing Agreement (DPA).
1. Who is responsible
EEP EdTech For Education & Training Computer Software, Dubai professional licence no. 1658891, operates TOP Learning Engine.
For school-managed accounts, the school is normally the data controller and EEP EdTech acts as its processor. For account administration, billing, security logs and direct business enquiries, EEP EdTech may act as controller. The signed school agreement and DPA take priority where they provide school-specific instructions.
2. Data we process
Names, IDs assigned by the school, class, year group, role, guardian links and account details.
Attendance, plans, assessments, marks, feedback, goals, evidence and teacher observations.
Support needs, wellbeing or safeguarding-related information only when enabled and authorised by the school.
Device, browser, login, audit, security, usage and support records needed to operate and protect the service.
Schools decide which modules and fields they use. They must avoid uploading information that is unnecessary for the agreed educational purpose.
3. Why we process information
- Provide, secure and support the contracted school service.
- Authenticate users and apply school roles and permissions.
- Connect approved workflows such as planning, classroom activity, progress and student support.
- Maintain audit trails, investigate incidents and prevent misuse.
- Meet contractual, accounting and legal obligations.
- Improve reliability using aggregated or de-identified service information where appropriate.
We do not sell learner data or use it for behavioural advertising.
4. Where data is stored and transferred
The production hosting region, backup location, approved subprocessors and any cross-border transfer mechanism are identified in the school’s Order Form, DPA or subprocessor schedule before live student data is enabled.
Where information is transferred outside the UAE, EEP EdTech and the school will apply the safeguards required by applicable law and the written agreement. A school may request the current hosting and subprocessor details through the privacy contact.
5. Who can access data
- Authorised school users according to their assigned role and school membership.
- Limited EEP EdTech personnel who need access for support, security or service operation.
- Approved service providers acting under written confidentiality and data-protection obligations.
- Authorities where disclosure is required by applicable law.
Security measures
TOP Learning Engine uses role-based access, school/site isolation, access logging, encrypted transport, controlled administrative access, backups and incident-response procedures appropriate to the contracted service. No system can guarantee absolute security; schools and users must protect their credentials and report suspected access promptly.
6. Retention, export and deletion
School data is retained for the active subscription and the additional period stated in the Order Form or DPA. Before termination, an authorised school administrator may request an export in an agreed format.
After the contractual retrieval period, production data is deleted or de-identified according to the DPA. Encrypted backup copies may remain for a limited backup cycle and are isolated from ordinary use until overwritten. Legal, security and accounting records may be retained for the period required by law.
7. Individual rights and requests
Depending on the applicable law, individuals may request access, correction, restriction, portability or deletion, and may object to certain processing. Learners, parents and school staff should normally submit a request to their school first because the school controls the educational record. We assist the school in responding.
Requests concerning EEP EdTech’s own account, billing or enquiry records can be submitted through the privacy contact. Identity and authority may be verified before information is disclosed or changed.
8. AI-supported features
AI features are optional and operate within school-authorised workflows. The school controls which source material is used, and users must review generated output before relying on it for a learner or school decision.
The applicable Order Form and DPA will identify the AI provider, processing location and retention controls. School content will not be used to train a public or general-purpose model unless the school gives separate written agreement. AI output must not be treated as the sole basis for a high-impact decision about a learner.
9. Contact and complaints
Use the legal and privacy enquiry page and select “Privacy or student data”. Include the school name, your relationship to the school and the nature of the request; do not send sensitive student information in the first message.
If the request concerns a school record, we may refer it to the school’s authorised privacy contact.