Merit Online Academy ‘s Privacy Policy

Merit Online Academy (“Merit”, “we”, “us”, “our”) provides online English Language and Literature tutoring to students across Saudi Arabia, the United Arab Emirates, Qatar, Kuwait, Bahrain and Oman. This policy explains what personal data we collect from parents, students and site visitors, why we collect it, and the rights you have over it.

1. Who we are and What privacy policies do we follow?

Merit Online Academy is the data controller responsible for the personal data described in this policy — meaning we decide why and how it’s used.
Registered business name and address: Merit Academy Online
Email: hello@meritonlineacademy.com
WhatsApp: [add your business WhatsApp number]

2. What personal data we collect

Information you give us directly
-Name, WhatsApp number, email address and country, when you message us or fill in the free-trial form
-The exam board, curriculum and grade level you’re asking about
-Anything you write in the “notes” field or in conversation with us
-Payment details when you pay for lessons — handled directly by our payment provider; we do not store full card numbers
Information about a child, provided by a parent or guardian
-The student’s name, age or grade, and school
-Academic information relevant to tutoring: exam board, target grades, past performance, and progress during lessons
Information collected automatically
-IP address, browser and device type, pages visited and referring website
-Cookie data — see Cookies below
Lesson data
[Confirm and edit this paragraph based on what you actually do] If lessons are recorded or if tutors keep written progress notes, those recordings or notes are personal data about the student and are covered by this policy. Recordings are used only for tutoring quality and progress review, and are not shared outside Merit without the parent’s consent.

3. Children’s privacy

Most Merit students are school-age minors. We take extra care with their data:
-We only collect a child’s personal data through a parent or legal guardian who books the trial lesson or enrols the child — we don’t knowingly collect it directly from a child browsing the site unaccompanied.
-We collect only what’s needed to match a tutor and run lessons: name, age or grade, school curriculum, and academic progress. We don’t collect a child’s data for advertising or profiling.
-A parent or guardian can review, correct, or ask us to delete their child’s data at any time by contacting us — see Contact us.
-We don’t send marketing communications to a child directly; all communication about lessons goes to the parent or guardian’s contact details.

4. How we use your data

-To match a student with a tutor who teaches their specific exam board and level
-To schedule, deliver, and follow up on lessons, including sending reminders and progress updates
-To communicate with you by WhatsApp, email or phone about your enquiry or ongoing lessons
To process payment for lessons
-With your consent, to send updates or offers about our tutoring services — you can opt out at any time
-To keep our website and services running securely, and to understand how the site is used so we can improve it
-To meet our legal, tax and regulatory obligations

5. Our legal basis for processing

Depending on what we’re doing with your data, we rely on one of the following:
Consent — for example, when you message us to book a free trial, or opt in to marketing updates. You can withdraw consent at any time, and withdrawing it won’t affect a service you’ve already received.
Performance of a contract — to actually deliver the tutoring you or your child have booked.
Legitimate interest — to keep our service secure, prevent misuse, and improve how we teach and communicate.
Legal obligation — for example, keeping financial records for tax purposes.

6. Who we share data with

Your matched tutor(s) — they need your child’s name, level and progress information to teach effectively.
Service providers who help us run Merit: messaging (WhatsApp/Meta), email delivery, website hosting, and analytics tools. Each only receives what they need to do their job, and is bound by their own privacy terms.
Payment processors, to charge and process fees for lessons.
Authorities, where we’re legally required to share information — for example, in response to a valid court order.
We do not sell personal data to third parties for their own marketing purposes.

7. International data transfers

Some of the tools we rely on — including WhatsApp, email, and website hosting — may process data outside the country where you or your child are based, including outside Saudi Arabia or the UAE. Where that happens, we take steps intended to keep your data appropriately protected, consistent with the cross-border transfer requirements under Saudi Arabia’s PDPL and the UAE’s PDPL. [Confirm your actual safeguards here — e.g. Standard Contractual Clauses — with a lawyer before publishing.]

8. How long we keep data

We keep personal data only for as long as we need it to provide tutoring, respond to your enquiry, or meet legal and tax obligations, after which it’s deleted or anonymised. [Add specific retention periods once decided — e.g. enquiry data kept 12 months if no lesson is booked; enrolled-student records kept for the duration of tutoring plus a defined period after.]

9. How we protect your data

We use reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access — including restricting who can access student records and using secure channels for communication and payment. No method of storage or transmission is completely secure, but we work to keep risk as low as reasonably possible, and we’ll notify affected parents without undue delay if a breach is likely to put their or their child’s data at risk, consistent with our obligations under Saudi Arabia’s PDPL and the UAE’s PDPL.

10. Your rights

Depending on where you’re based, you generally have the right to:
-Ask what personal data we hold about you or your child, and get a copy of it
-Ask us to correct inaccurate data
-Ask us to delete data we no longer need to keep
-Object to, or ask us to restrict, certain kinds of processing
-Receive your data in a portable format
-Withdraw consent at any time, where we’re relying on consent
To exercise any of these, contact us — see Contact us below. We’ll respond within a reasonable time.

You can also complain to a regulator.
In Saudi Arabia: the Saudi Data & Artificial Intelligence Authority (SDAIA).
In the UAE: the UAE Data Office.
Elsewhere in the Gulf: the relevant data protection authority in your country of residence.

11. Cookies and similar technologies

Essential cookies — needed for the site to function correctly, such as remembering your menu or form state.
Analytics cookies — help us understand how visitors use the site (for example, Google Analytics), so we can improve it. These are only set with your consent where required.
You can control or delete cookies through your browser settings at any time. Blocking essential cookies may affect how the site works.

12. Third-party links and services

Our site links to third-party services such as WhatsApp, and references Cambridge Assessment International Education and Pearson Edexcel for informational purposes. Those organisations have their own privacy policies, which we’d encourage you to review — this policy only covers data collected by Merit Online Academy.

13. Changes to this policy

We may update this policy from time to time, for example as our services or the law changes. The “last updated” date at the top of this page always reflects the latest version. For significant changes, we’ll let you know via [email / WhatsApp / a notice on the site — pick what you’ll actually do].

14. Contact us

Questions about this policy, or want to exercise any of the rights above? Reach us at:
hello@meritonlineacademy.com
WhatsApp