Legal

1. About this policy

Fanal is a school management and learning platform used by schools, staff, students, parents and guardians. This Privacy Policy explains how personal information is handled when people visit Fanal, apply to a school, use a school workspace, receive communications, or contact us for support.

In this policy, “Fanal”, “we”, “us” and “our” refer to the operator of the Fanal platform. The legal identity, registered address and privacy contact of the operator will be stated in the school agreement and in the final adopted version of this policy.

2. Our role and the school’s role

A school normally decides why pupil, parent, staff, academic, attendance and school-finance information is used. For that information, the school acts as controller and Fanal processes the information to provide the service under the school’s instructions.

Fanal acts as a controller for information used to register and administer school customers, manage platform-operator accounts, secure the service, prevent abuse, provide support, meet legal obligations and communicate about the Fanal service.

3. Information we handle

• Identity and contact details, including names, email addresses, telephone numbers, addresses, dates of birth, gender, occupation, aliases and profile images.
• School details, including school name, crest, location, contact information, approval status and workspace settings.
• Admissions information, including student and guardian applications, requested academic placement, review status, reviewer details and onboarding history.
• Academic information, including enrolment history, classes, houses, programmes, subjects, timetables, assessments, scores, grades, report cards, teacher remarks and promotion records.
• Attendance, student notes, homework, written responses, submissions, attachments, links, viewing history, due dates and completion status.
• Communications, including announcements, recipients, read or acknowledgement status, notification preferences and email or SMS delivery records.
• School-finance records, including fees, invoices, charges, balances, receipt references, recorded payment methods, refunds, adjustments, allocations and audit histories.
• Staff information, including roles, teaching assignments, department, wage information, profile-change history and signatures used on authorised school documents.
• Account, device and service information, including authentication records, pupil codes, sessions, cookies, browser storage, timestamps, IP or network information where logged, diagnostic events and security audit records.

4. Where information comes from

Information may be provided directly by a user, by a parent or guardian, by an authorised school representative, by another linked user, or generated through use of the platform. Limited technical and delivery information may also come from devices, browsers and service providers that support hosting, media, email or SMS delivery.

5. Why information is used

The legal basis depends on the information, purpose, Fanal’s role and the law that applies. It may include performance of a contract, compliance with law, legitimate interests, a school’s public or educational task, vital interests, or consent where consent is appropriate and freely given.

• To register, approve and administer school workspaces and user accounts.
• To provide admissions, enrolment, academic, attendance, timetable, assessment, report-card, homework, announcement and school-finance features.
• To connect authorised parents and guardians with student records.
• To deliver essential service, security, finance and school communications.
• To provide support, diagnose problems, maintain reliable service and protect accounts.
• To keep appropriate audit records, prevent misuse and meet legal, regulatory, accounting or safeguarding obligations.
• To understand and improve service performance using limited, preferably aggregated or de-identified information.

6. Access and sharing

Information is made available only to people and organisations that need it for an authorised purpose. This may include the relevant school and its authorised users, linked parents or students, Fanal personnel who require access for support or security, and contracted providers that support infrastructure, media storage, email, SMS, monitoring or professional advice.

We may disclose information where required by law, to protect a child or another person, to investigate misuse, or as part of a business reorganisation subject to appropriate safeguards.

7. Children and student information

Children deserve a high level of privacy. Student accounts must be created or authorised through an approved school process. Schools and guardians should provide students with clear, age-appropriate information about how their records are used.

Fanal limits student information to educational and operational purposes authorised by the school. We do not use student content to build advertising profiles or train public, general-purpose artificial-intelligence models. A separate Student Privacy Notice explains these commitments in simpler language.

8. Retention and deletion

Information is kept only for as long as needed for the purpose for which it was collected, for the period directed by the school, or for a longer period required by education, finance, employment, safeguarding or other applicable law.

Some academic and finance records are preserved as historical or audit records. Correcting such a record may require a linked correction or reversal rather than removal of the original entry. Deleted live data may remain temporarily in protected backups until the backup cycle expires.

9. Security

We use reasonable technical and organisational measures designed to protect information. These include role-based access, account authentication, secure communications, password protection, logging, backups, service monitoring and controls intended to separate one school’s workspace from another.

No online service can promise absolute security. Users must protect their credentials and tell their school or Fanal promptly if an account or record may have been compromised.

10. Your choices and rights

Requests concerning school-controlled records should be sent to the relevant school. Requests concerning Fanal’s own activities can be submitted through Fanal’s official support route with “Privacy request” in the subject. We may need to verify identity or parental authority before responding.

• Ask whether personal information is being processed and request access to it.
• Ask for inaccurate or incomplete information to be corrected.
• Object to or ask us to stop certain processing where the law provides that right.
• Withdraw consent for future processing where consent is the legal basis.
• Ask for deletion, restriction or portability where applicable and subject to lawful record-retention duties.
• Opt out of direct marketing and complain to the relevant data-protection authority.

11. International processing

Some service providers may process information in another country. Where this happens, Fanal will use contractual, technical and organisational safeguards required by applicable law. The current provider register and relevant processing locations are described in the Subprocessor Notice or supplied to a school on request.

12. Changes and contact

We may update this policy when the service, our providers or the law changes. We will show the revised date and give additional notice where a change materially affects how information is used.

Privacy questions may be sent through the official Fanal support channel provided on the platform or in the school agreement. The final adopted policy will also identify the responsible legal entity, postal address and privacy email address.