Privacy Notice
Asabya Academy collects and processes personal data to deliver the IC3 Digital Literacy GS6 Master preparation programme. This notice (version 2) explains what we collect, why, and the rights you hold under the Oman Personal Data Protection Law (Royal Decree 6/2022, the "PDPL").
Who controls your data
The data controller is Asabya Academy, Muscat, Sultanate of Oman. Questions may be sent to academy@asabya.com.
What we collect
| Category | Examples |
|---|---|
| Identity | Full name, email address, date of birth |
| Education | School, class, grade, enrolment and delivery format |
| Learning activity | Session progress, quiz attempts and scores, points, badges |
We do not collect payment card data, and we do not use advertising networks or third-party tracking.
Why we process it — and our legal basis
We process this data solely to deliver the IC3 GS6 Master preparation programme — presenting lessons, recording progress, scoring assessments, and reporting progress to you, to your parent or guardian, to your teacher, and to your school.
Our legal basis is your consent, given under Article 14 of the PDPL.
Children and parental consent
This programme serves students many of whom are under 18. Oman's Child Law (Royal Decree 22/2014) defines a child as anyone under 18, and the PDPL requires a guardian's consent to process a child's personal data. We apply this in one of two ways:
- Direct sign-up. A student under 18 who signs up independently confirms, by self-attestation, that a parent or guardian has given permission to create the account. A guardian may optionally be invited to view the student's progress.
- School-licensed sign-up. Where a student joins through a school that has signed a Data Processing Agreement (DPA) with Asabya Academy, parental consent is addressed through that agreement between the school and the parents.
Where your data is stored
Your data is stored and processed by our processor, Supabase Inc., in the ap-south-1 region (Mumbai, India). Supabase Inc. is SOC 2 Type 2 certified. We have assessed the transfer as meeting PDPL Article 23 and Article 38 of the Executive Regulations.
How long we keep it
We retain your personal data for as long as your enrolment is active, and for two (2) years after it ends, after which it is deleted or irreversibly anonymised.
Your rights
Under the PDPL you may access, correct, erase, and withdraw consent for your data, and complain to the Ministry of Transport, Communications and Information Technology (MTCIT). Access, download and erasure can be exercised from the Settings page.
Data Protection Officer
Our Data Protection Officer can be reached at academy@asabya.com. (Placeholder contact — to be confirmed.)
Changes to this notice
Material changes are published with a new version number and effective date, and communicated to enrolled users.