Privacy Notice

1. Who we are and our role

MahamE is an education platform used by schools and education authorities in the United Arab Emirates. For most personal data on the platform, your school or education authority is the data controller — they decide what is processed and why. MahamE acts as the processor, handling data on their documented instructions.

Where we use an external AI provider, Anthropic PBC acts as a sub-processor under a data-processing agreement: in-region processing, no use of your data for model training, and zero data retention beyond the request, governed by standard contractual clauses.

If you are unsure who the controller is for your data, contact your school or our Data Protection Officer (section 10).

2. What data we process and why

Depending on your role (student, teacher, school operator, or authority user), we process:

• Account & identity data — name, role, school, contact details, and credentials.
• Educational data — assignments, submissions, grades, attendance, and performance indicators.
• Usage data — log and device data needed to operate and secure the service.

We process this data to provide the platform and its features, to support teaching, assessment and school-improvement, to keep the service secure, and to meet legal and regulatory obligations. We practise data minimisation — we process only what each purpose needs.

3. Legal basis

Our primary legal basis is consent. Under UAE law, some processing may also rely on defined exceptions — for example, performance of a contract, compliance with a legal obligation, or a public-interest or regulatory mandate of an education authority. Where we rely on consent, you can withdraw it at any time (see section 5).

4. Children's data

Many of our users are children. We take extra care with their data in line with the UAE Child Digital Safety Law:

• We provide clear information about children's data to both the child and their parent or guardian.
• Where required, we process a child's personal data only with verifiable parental or guardian consent.
• A parent or guardian can withdraw that consent at any time by contacting us (section 10).

We do not use children's data for advertising, or for profiling unrelated to education.

5. Your rights

Subject to UAE law, you have the right to access your data, correct inaccurate data, request erasure, request portability of data you provided, withdraw consent, and object to or restrict certain processing.

To exercise any right, contact your school or authority, or our Data Protection Officer (section 10). Because your school or authority is usually the controller, we may forward your request to them.

6. How long we keep data

We retain personal data only as long as needed for the purposes above, for the period set by the controlling school or authority, or as required by law — after which it is deleted or anonymised. Specific retention periods are being finalised with counsel.

7. Sharing and sub-processors

We do not sell personal data. We share it only with your school or education authority (the controller), service providers acting as our sub-processors under contract (including Anthropic PBC for AI features), and public authorities where legally required. A current list of sub-processors is available on request.

8. International transfers

Where personal data is transferred across borders, we apply the safeguards required by UAE law, including standard contractual clauses and, for AI processing, in-region handling. Transfers between mainland UAE and the DIFC or ADGM free zones require their own safeguards.

9. Security and breach notification

We protect personal data with technical and organisational measures, including encryption and access controls. If a personal-data breach occurs, we will notify the competent authority and affected individuals without undue delay where there is a risk to their rights, in line with our internal breach-response procedure.

10. Data Protection Officer and contact

MahamE has appointed a Data Protection Officer (DPO). You can reach the DPO for any privacy question, to exercise your rights, or to complain, at [email protected].

You also have the right to lodge a complaint with the competent UAE data-protection authority.

11. Changes to this notice

We may update this notice. Material changes will be communicated through the platform, and the “last updated” date above will change.