TMRW EDTECH - FZCO ("TMRW," "we," "us," or "our") provides a Microsoft-native school management platform for education operators, including student information systems, finance, human resources, and operational management tools (the "Services"). This Privacy Policy explains how we collect, use, store, and protect personal data when you or your organization use our Services, visit our website, or interact with us through the Microsoft Marketplace. This policy is written to align with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and reflects principles consistent with the EU General Data Protection Regulation (GDPR) for customers and users in jurisdictions where it applies.
1. Who This Policy Applies To
This policy applies to: Customers— schools, school groups, and Ministries of Education that purchase or use TMRW's platform.
End users - administrators, teachers, staff, students, and guardians whose data is processed within the platform on behalf of a customer.
Website visitors — anyone visiting tmrw.education.
Marketplace users — organizations evaluating or purchasing TMRW through Microsoft AppSource or Azure Marketplace. Where TMRW processes personal data on behalf of a school or school group (our customer), the customer is the data controller and TMRW acts as the data processor. Our handling of that data is governed by the data processing terms in our customer agreement, summarized in Section 6 below.
2. Information We Collect
2.1 Information Customers and Users Provide
Account and contact information (name, email, phone, job title, organization).
Student and staff records entered into the platform (e.g., enrollment data, attendance, grades, HR records, financial records) as configured by the customer.
Billing and procurement information, including Microsoft tenant and billing account identifiers, when purchasing through Microsoft Marketplace.
2.2 Information Collected Automatically
Usage data (features accessed, session duration, login activity).
Device and log data (IP address, browser type, operating system).
Cookies and similar technologies on tmrw.education (see Section 8).
2.3 Information From Microsoft
When you purchase or provision TMRW through Microsoft AppSource or Azure Marketplace, Microsoft shares limited account and subscription information with us (such as tenant ID, subscription ID, and billing contact) to activate and manage your subscription, in accordance with Microsoft's commercial marketplace policies.
3. How We Use Information
We use personal data to: - Provide, operate, and maintain the TMRW platform. - Process subscriptions and payments, including transactions made through Microsoft Marketplace. - Communicate with customers about their account, updates, and support. - Provide customer support and respond to inquiries. - Improve and develop our Services, including platform performance and security. - Comply with legal obligations and enforce our agreements. - Detect, prevent, and address fraud, security incidents, or technical issues. We do not sell personal data. We do not use student or staff data processed on behalf of a customer to train artificial intelligence models or for any purpose beyond delivering the Services, unless the customer has separately and explicitly authorized this in writing.
4. Legal Basis for Processing
Where applicable law requires a legal basis for processing personal data, we rely on one or more of the following: - Performance of a contract — to deliver the Services our customers have subscribed to. - Legitimate interests — to maintain, secure, and improve our platform. - Legal obligation — to comply with applicable laws and regulations. - Consent — where required, such as for certain marketing communications or optional cookies.
5. Data Residency and Storage
Customer data is hosted on Microsoft Azure infrastructure. For customers based in the United Arab Emirates, data is hosted in Microsoft Azure's UAE North / UAE Central regions, unless a customer agreement specifies otherwise. We do not transfer personal data outside the agreed hosting region except where necessary for support, in which case appropriate safeguards are applied consistent with UAE PDPL and, where relevant, GDPR cross-border transfer requirements (such as standard contractual clauses).
6. Data Ownership, Processing, and Customer Right
Customers own their data.
All student, staff, and operational data entered into the platform remains the property of the customer. - TMRW acts as a data processor for customer data and processes it only as instructed by the customer and as necessary to deliver the Services. - Data separation. Each customer's data is logically or physically separated from other customers' data, depending on the deployment architecture agreed in the customer contract. - Data export. Customers may request a full export of their data at any time during the term of their agreement. - Data deletion. Upon termination of a customer agreement, TMRW will delete or return customer data within the timeframe specified in the customer's Data Processing Agreement (typically within 30 days), except where retention is required by law. - Access controls. Access to customer data by TMRW personnel is role-based, logged, and limited to what is necessary for support and operations. Customers may request an access audit summary. A full Data Processing Agreement (DPA) is available to customers and forms part of the commercial contract with TMRW.
7. Data Sharing and Third Parties
We do not sell or rent personal data. We may share data with: - Microsoft, as the underlying cloud infrastructure provider (Azure, Dynamics 365, Microsoft 365) and, where applicable, as the marketplace operator for billing and subscription management. - Sub-processors who support our infrastructure, hosting, or customer support operations, under contractual confidentiality and data protection obligations equivalent to this policy. - Authorities, where required by law, regulation, or valid legal process. - Successors, in the event of a merger, acquisition, or sale of assets, subject to the same data protection commitments described here. A current list of sub-processors is available on request.
8. Cookies and Website Tracking
tmrw.education uses cookies and similar technologies to: - Operate core website functionality. - Understand site usage and improve content. - Support marketing and analytics, where consent is given. You can control cookie preferences through your browser settings or any cookie consent tool presented on the site. Disabling non-essential cookies will not affect your ability to use core website content.
9. Data Security
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process, including: - Encryption of data in transit and at rest. - Role-based access controls and authentication. - Regular security monitoring and review. - Defined incident response procedures, including notification to affected customers in line with legal requirements and contractual commitments. No system can guarantee absolute security. In the event of a data breach affecting personal data, we will notify affected customers and, where legally required, relevant authorities, without undue delay.
10. Data Retention
We retain personal data only for as long as necessary to: - Deliver the Services under an active customer agreement. - Meet legal, regulatory, tax, or accounting requirements. - Resolve disputes and enforce our agreements. Customer data is retained according to the terms agreed in the customer's contract and deleted or returned upon termination, as described in Section 6.
11. Your Rights
Depending on your location and applicable law, you may have the right to: - Access the personal data we (or our customers, as controllers) hold about you. - Request correction of inaccurate data. - Request deletion of your data, subject to legal and contractual retention requirements. - Object to or restrict certain processing. - Request a copy of your data in a portable format. - Withdraw consent, where processing is based on consent. If your data is processed by TMRW on behalf of a school or organization (i.e., TMRW is the processor, not the controller), please direct your request to that organization in the first instance. We will support our customers in responding to such requests. To exercise these rights directly with TMRW, contact us using the details in Section 14.
12. Children's Data
TMRW's platform processes student data, including data relating to minors, on behalf of our school and Ministry of Education customers. We do not collect data directly from children; all student data is provided and managed by the customer (the school or education authority), which is responsible for obtaining any necessary parental or guardian consent required under applicable law. We apply the same security, access control, and data minimization principles described in this policy to all student data, with particular care given to its sensitivity.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated policy on this page with a revised "Last updated" date. Material changes affecting existing customers will be communicated through the customer's agreed account contact.
## 14. Contact Us
If you have questions about this Privacy Policy or how we handle personal data, contact us at: TMRW EDTECH - FZCO IFZA Business Park, DDP, IFZA, Dubai, United Arab Emirates Email