Banadir Language School
Privacy Policy
Banadir Language School
Version 1.0
Date published: TO BE COMPLETED: date this policy goes live on the website
Next review date: TO BE COMPLETED: date 12 months after publication
Owner: Omar Ahmed, founder and headmaster
This policy is written for parents and students. It is written in short, plain sentences on purpose. If you would like it read to you, or explained in Somali, please ask us using the details in Section 12.
1. What this policy is for
We are a school. We are not a shop. We do not sell anything except lessons, and we do not sell you.
This policy tells you three things:
- Exactly what we collect, and why we need it.
- Exactly how long we keep it, and when it is deleted.
- Exactly what you can ask us to do about it, and how fast we must answer.
Every promise here can be checked. If we break one, tell us, or tell the independent contact in Section 12.
2. The one rule that shapes everything else
We collect data only where it is needed to teach the student. Nothing else.
If a piece of information is not needed to teach a class, take a payment, keep a child safe, or answer a legal duty, we do not ask for it.
We never use your data for marketing. We do not send advertising. We do not build profiles to sell you more classes. We do not sell, rent, trade or share student or parent details with any advertiser, data broker, or other company for their own use. There is no exception to this and there is no box you can tick that changes it.
3. Who holds your data
The school is the data controller. That means the school decides what is collected and is answerable for it.
- Controller: Banadir Language School
- Person responsible: Omar Ahmed, founder and headmaster
- Contact for any data question: info@banadirschool.com
Some outside companies handle data on our behalf. They are processors. They may only do what we tell them, and they may not use your data for their own purposes.
| Who | What they do for us | What they can see |
|---|---|---|
| TO BE COMPLETED: name of the video class provider | Runs the live classes | Names shown in class, video and audio during class |
| Moodle | Holds logins, class replays, materials | Student name, login email, class list, replay access |
| Google Drive | Holds the safeguarding copies of recordings | Class recordings, restricted access |
| TO BE COMPLETED: name of each payment provider used | Take payments | Payer name, amount, payment reference |
| TheJamah | Built and maintains the school's website and systems | Technical access only, under a written agreement, for support work |
4. What the application form collects, and why
This is the full list. If a field is not on this list, do not fill it in, and tell us it is there.
For every student
| What we ask | Why we need it |
|---|---|
| Full name | To enrol the student, mark the register, and issue a login |
| Date of birth | To place the student in an adult class or a children's class, which are never mixed, and to know whether the guardian rules apply |
| Email address | To send the login, the timetable, and class messages |
| Phone or WhatsApp number | To reach the student or parent if a class changes at short notice |
| Country the student lives in | To know which data protection law applies to that student |
| English level and course chosen | To place the student in the right class |
| Payment method and payment reference | To record that the monthly fee was paid |
For a student under 18, we also ask
| What we ask | Why we need it |
|---|---|
| Full name of the parent or guardian | So we know who is legally responsible for the child |
| Parent or guardian email and phone number | So all school contact goes through the parent |
| Proof of the child's age | Because the law that applies to students living in Somalia requires us to verify the age of the child |
| Proof of the parent or guardian's identity | Because that same law requires us to verify the identity of the guardian |
| Signed parental consent form | Because no child is enrolled without it |
| Anything the parent chooses to tell us about a health or learning need | Only if the parent decides to tell us, and only so the teacher can support the child in class |
What we never ask for
- Religion, ethnicity, or political views.
- Family income.
- National identity numbers, except where a payment provider requires it to send a refund.
- Access to social media accounts.
- Photographs of the student, other than what appears on camera in class.
5. What class recordings capture
Every class is live on video and is recorded. There are two separate recordings, made for two different reasons, kept in two different places, deleted on two different clocks. A parent gives or refuses permission for each one separately, on the parental consent form.
What a recording captures: the teacher, the students who have their cameras on, everyone's voice, the shared screen and teaching materials, the class chat, and the names shown on screen. It captures whatever is behind a student in their room. It does not capture private messages, because private messages between a teacher and a child are forbidden and the class chat is the only chat used.
| Safeguarding copy | Lesson replay copy | |
|---|---|---|
| Why it exists | So that a concern can be investigated if one is raised | So an enrolled student can watch the lesson again |
| Who can open it | The Designated Safeguarding Lead and the Deputy only, and only after a concern is raised | The students enrolled in that class, their teacher, and the Safeguarding Lead |
| Where it is kept | The school's protected storage, Google Drive | The student platform, Moodle |
| How it is reached | By password, by two named people | By the student's own login, downloads switched off |
| How long it is kept | Deleted within 30 days | Deleted within 14 days of the lesson |
The only exception. If a concern has been raised about a class, the safeguarding copy of that class is locked and kept until the concern is closed. The reason is written down. Nothing else is ever kept past its clock.
A student who does not have recording permission is asked, privately, to keep their camera off. They lose nothing else. They stay in the class, they are taught the same, and they still receive the class materials.
6. What else we hold, and for how long
| Kind of data | How long we keep it |
|---|---|
| Application and enrolment record | While the student is enrolled, then TO BE COMPLETED: number of months the school keeps a former student's record, to be confirmed |
| Parental consent form | While the child is enrolled, then deleted with the enrolment record |
| Proof of age and proof of guardian identity | We record that the check was done and the date. The document copy is deleted within TO BE COMPLETED: number of days, recommended 30 of the check |
| Attendance register | TO BE COMPLETED: number of months, so that class credits can be honoured for at least 3 months |
| Class credits and refund records | 3 months after the credit expires |
| Payment records | TO BE COMPLETED: the number of years the school must keep financial records under the law where it is registered |
| Emails and messages with parents | TO BE COMPLETED: number of months, recommended 12 |
| Safeguarding concern records | TO BE COMPLETED: to be confirmed by the school with a legal adviser |
| Website visit logs | TO BE COMPLETED: number of days, recommended 30 |
When a period ends, the data is deleted, not archived.
7. Children and the guardian rule
Every student under 18 is treated as a child, in every country, with no exception.
We use 18 because the law that applies to students living in Somalia sets the age of a child at 18. We apply that age to everyone rather than sorting children by country.
For every student under 18:
- A parent or guardian must give written consent before enrolment is complete.
- The law that applies to students living in Kenya requires parental consent for a child and gives no exemption for education. So we do not rely on any education exemption anywhere. We take consent, every time.
- We verify the age of the child and the identity of the guardian, because the law that applies to students living in Somalia requires it.
- All school contact goes to the parent, or through the class. A teacher never messages a child privately.
- The parent, not the child, gives and withdraws permission for recordings, and can do so at any time.
A child aged 18 or over manages their own data and gives their own consent.
8. Why we are allowed to hold this data
- To provide the lessons you asked for. We need a name, a level, a contact and a payment record to run a class you paid for.
- Consent. Recordings of a child rest on written parental consent, given separately for each copy, and it can be withdrawn at any time.
- A legal duty. Payment records and safeguarding records are kept because the law requires it.
- Protecting a child. The safeguarding copy exists so that a concern can be looked into properly.
We do not rely on "legitimate interests" to send you marketing, because we do not send marketing.
9. How a parent sees, corrects or deletes a child's record
You may ask us, at any time, and free of charge, to:
- tell you everything we hold about your child,
- send you a copy of it,
- correct anything that is wrong,
- delete your child's record,
- delete or stop a recording of your child,
- stop the school holding data that is not needed to teach.
How to ask. Write to info@banadirschool.com, or to the independent contact in Section 12 if you would rather not write to the school. Say the student's name and what you want. You do not need to give a reason.
How fast we answer.
| Step | Our deadline |
|---|---|
| We confirm we received your request | 3 working days |
| We answer in full | 20 working days |
| We delete a recording when you withdraw consent | 5 working days |
| We stop recording your child in future classes | Immediately, from the next class |
If we cannot delete something, we will tell you in writing exactly which item, exactly why, and exactly when it will go. The only reasons we may hold something back are a payment record we must keep by law, or a safeguarding record connected to an open concern.
Leaving the school. When a student leaves, their login is closed within 5 working days and their replay access ends at once.
10. Keeping the data safe
- Every school account is protected by a password that is not shared and is not reused.
- Two step login is switched on for every account that can see student data.
- Only the people who need to see a piece of data can see it. Teachers see their own classes. The safeguarding copies can be opened by two named people only.
- Class links are never posted in public.
- Recordings are never stored on a teacher's own phone or laptop. Any local copy is deleted within 24 hours of the class.
- Paper is not used for student records.
11. If there is a breach
A breach means data was seen, taken, lost or changed by someone who should not have been able to do so.
If it happens:
- We stop it and close the hole the same day we find it.
- We write down what happened, when, what data was involved, and who is affected.
- We tell every affected parent and student directly, within 72 hours of finding out. We tell you in plain words what was exposed, what the risk to you is, and what we are doing.
- We report it to the data protection authority in the country where the affected students live, where the law requires it, within the deadline that law sets.
- Where a child is affected, the independent contact in Section 12 is told at the same time as the parents, so that the school is not the only party who knows.
- We write up what we changed so it does not happen again, and we publish the fix to affected families.
We will not delay telling you while we investigate. You will hear the first version quickly, and the full version when we have it.
12. Who to contact
For anything about your data
Omar Ahmed, founder and headmaster
Email: info@banadirschool.com
Phone or WhatsApp: TO BE COMPLETED: school phone number
Independent outside contact, for any concern about the school or its founder
Salim, TheJamah
Email: hello@thejamah.com
Phone or WhatsApp: +1 631 417 0416
Salim is not employed by the school and does not report to the founder. TheJamah built the school's systems. Salim has agreed to receive concerns from parents, students and staff independently. You may write to him directly about anything in this policy, including a concern about the founder, without speaking to the school first.
If you are not satisfied with our answer, you may complain to the data protection authority in the country where the student lives:
- Students living in Kenya: the Office of the Data Protection Commissioner.
- Students living in Somalia: TO BE COMPLETED: the data protection authority for the country where the school is registered
- Students living anywhere else: TO BE COMPLETED: the authority in that country, if the family asks us we will help them find it
13. Where the data lives, stated honestly
We will not pretend this is simpler than it is.
- The school is registered in TO BE COMPLETED: the country where the school is legally registered, not yet established. This has not been finalised, so we are not going to name a country we cannot yet stand behind. When it is settled, this policy will be updated and every family will be told.
- Our students live in Kenya, in Somalia, and in other countries.
- The class platform, the student platform and the storage service hold data on servers in TO BE COMPLETED: the countries where each provider stores data, to be confirmed provider by provider.
This means your data crosses borders. It leaves the country the student lives in, and it is held by companies outside that country.
Here is our position on that:
- We do not use a country's law as a way to give you less. Where two laws apply, we follow the stricter one for everybody. That is why every under 18 has parental consent, in every country.
- The law that applies to students living in Kenya reaches us even though we are not in Kenya. It applies to anyone handling the data of children located in Kenya, wherever that handler sits. We accept that it applies to us, and we do not argue otherwise.
- The law that applies to students living in Somalia applies to those students in the same way, including the age of 18 and the checks on the child and the guardian.
- We only send your data outside the student's country where it is necessary to run the class. Every processor in Section 3 is there because a class cannot run without it.
- We keep the amount of data small, so that what crosses a border is as little as possible.
- If a family objects to their data being held by a particular provider, tell us. We will tell you honestly whether the student can still be taught without it.
If any of this changes, we will say so on this page and write to every parent. We will not change it quietly.
14. Related documents
- Safeguarding and Child Protection Policy
- Parental Consent Form for Class Recording
- Teacher Code of Conduct
- Terms and Conditions
- Refund and Cancellation Policy
- Complaints Procedure
All are published on the school website. Ask and we will send you a copy.
15. Review
This policy is reviewed at least once every 12 months, and immediately after any breach or any change to the systems we use.