سياسة الخصوصية

“Nidaa” is a cloud platform that helps schools organize student pickup and handover in a safe, documented way. This Privacy Policy applies to our website and applications (the Parent app, Guard app, and Supervisor app), the School dashboard, the schoolyard display, and all related services (together, the “Service”).

By using the Service you acknowledge that you have read this policy and understand how we handle your personal data. This policy should be read together with our Terms & Conditions.

Under the Saudi Personal Data Protection Law, a distinction is made between the “Controller” who determines the purposes and means of processing, and the “Processor” who processes data on the controller’s behalf:

• The School is the controller of the student, parent, and staff data it enters into the system.
• Nidaa acts as a processor that provides the technical platform and processes data according to the school’s instructions and this policy. Nidaa also acts as a controller for the account and usage data needed to operate, improve, and secure the platform.

When your school subscribes to Nidaa, the school is responsible for obtaining the legal basis required to enter parent and student data into the platform.

Account & people data

• Parents: name, mobile number, email, and the students linked to the account.
• Students: name, grade and class, in-school ID, and an optional identification photo.
• Authorized pickup persons: name, relationship, mobile number, and temporary permits.
• Staff (administration, supervisors, guards): name, login credentials, role, permissions, and branch.

Operational data

• Pickup requests and their timestamps, the status of each request, and documented handover logs (who handed over, who received, and when).
• Daily verification codes, temporary permit numbers, and early-pickup decisions and approvals.
• Audit logs of actions performed within the platform.

Technical data

• Device identifier and type, operating system, push-notification tokens, IP address, and performance/crash logs.

We do not collect precise background location data, and we only request sensitive data when strictly necessary and with a clear legal basis.

We process personal data on one or more of the legal bases set out in the Personal Data Protection Law and its Implementing Regulations:

• Consent: when you give explicit consent to a specific processing activity, which you may withdraw at any time.
• Performance of a contract: to deliver the pickup service the school has subscribed to.
• Legitimate interest: to secure the platform, prevent fraud, and improve the Service, without prejudicing your fundamental rights.
• Legal obligation: where a legal requirement compels us to process or retain data.

• Running the student pickup process from request to a safe, documented handover.
• Verifying the identity of the receiver and issuing temporary permits and verification codes.
• Sending operational notifications to parents and staff about request status.
• Producing operational reports and analytics for the school (e.g. peak times and average handover time).
• Keeping audit logs for security, accountability, and traceability of operations.
• Providing technical support through the Support Center, and securing and improving the platform.

We do not use student data for marketing purposes, and we do not make automated decisions producing legal effects on individuals without human involvement.

By its nature, Nidaa handles data of students who may be minors. We give the protection of their data special care in the best interest of the child, as follows:

• Student data is entered by the school or the legal guardian; a child cannot create an independent account.
• We limit ourselves to the minimum student data needed for the safe pickup process.
• Student data is only visible to authorized people within their school, according to their permissions.
• Guardians have the right to access their children’s data and request its correction or deletion, within what the school’s policies and applicable regulations permit.

We do not sell your personal data. We may share data only in the following limited cases:

• Within your school: with authorized staff (administration, supervisors, and guards) to the extent needed to perform their roles.
• Service providers: trusted processors that help us with cloud hosting, notifications, and support, under data-processing agreements that oblige them to protect the data.
• Legal requirements: where there is a lawful order or request from a competent judicial or regulatory authority in the Kingdom.
• Protecting rights: where necessary to protect the safety of individuals, the security of the platform, or to prevent fraud.

We prefer to host and process data within the Kingdom of Saudi Arabia. Where personal data needs to be transferred or processed outside the Kingdom, we comply with the controls set out in the Personal Data Protection Law and its Implementing Regulations, including verifying an adequate level of protection, applying the necessary safeguards, and obtaining required approvals where applicable.

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or for the period determined by the school or required by applicable regulations. When the purpose ends, we securely delete or anonymize the data. When your school’s subscription ends, the school is given a window to retrieve its data before it is deleted according to the agreed deletion policy.

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Granular role-based permissions, so each user only sees what they need.
• Daily verification codes and controlled temporary permits for every pickup.
• A complete audit trail of every sensitive action within the platform.
• Periodic security reviews and secure-by-design, privacy-by-design principles.

Although we apply appropriate safeguards, no method of transmission over the internet can be guaranteed 100% secure. In the event of a personal-data breach, we will act in accordance with the law’s requirements, including notifying the competent authority and affected individuals where applicable.

To exercise any of these rights, please contact us using the details below. If the data is managed by your school, we may direct you to it as the controller. We will respond to your request within the statutory period. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the competent authority.

Our website and apps use cookies and identifiers that are necessary to run the Service, remember your preferences (such as language and dark mode), and measure performance in aggregate. We do not use advertising cookies to track you across third-party sites. You can control cookies through your browser settings.

We may update this policy from time to time to reflect changes in our services or applicable regulations. When we make material changes, we will post the updated policy here with a revised “Last updated” date and may notify you through the platform where appropriate. Your continued use of the Service after posting constitutes acceptance of the updated policy.

For any privacy inquiry or to exercise your rights, contact our data protection team: