This Privacy Statement explains how the International Oryx International School, part of Orbital Education Group, collects, uses and protects personal data in accordance with Qatar Law No. 13 of 2016 Concerning Personal Data Protection and other applicable laws and regulations in the State of Qatar.
It applies to:
- student applicants, current and former students, and their parents or guardians;
- employees, officers, consultants and contracted staff engaged by the school;
- job applicants;
- users of school‑managed IT systems and services; and
- visitors to the school campus and school‑managed websites.
This Privacy Statement should be read alongside any more specific privacy information provided at the point personal data is collected, including role‑specific notices and the school’s Cookie Notice provided by Cookiebot.
For the purposes of applicable data protection law in Qatar, Oryx International School L.L.C., with registered address at Barwa City, Mesaimeer, Doha, Qatar, acts as the data controller in respect of personal data processed by the school.
As part of an international education group, the school may work with other Orbital Education Group entities to support governance, information technology services and operational management, in accordance with applicable data protection requirements.
The school operates within Orbital Education Group’s data protection framework. At a local level, responsibility for the day-to-day management of personal data and for handling requests rests with the school's Data Protection Officer.
For any questions, requests or concerns regarding personal data, please contact: ITSupport@oryxschool.qa
This contact point should be used for all data protection queries and data subject rights requests and will coordinate responses with the appropriate school personnel.
Personal data is any information relating to an identified or identifiable individual. This includes, for example:
- contact and identification details;
- family and guardian information;
- financial and billing information;
- academic records, assessments and school reports;
- photographs, video recordings and CCTV images; and
- information relating to health, safeguarding or educational support, where relevant.
Certain personal data we process, such as information relating to a student’s health, wellbeing, safeguarding or educational support, is considered sensitive personal data under Qatari law.
This data is handled with additional care and appropriate safeguards and is processed only where permitted under applicable legal and regulatory requirements, including where necessary and, where required, on the basis of consent.
We collect and process personal data for clear, specific and legitimate purposes linked to the operation of the school, the provision of education, safeguarding, and compliance with legal and regulatory obligations.
Personal data is not processed for purposes that are incompatible with those described in this Privacy Statement.
Lawful basis for processing
We process personal data in accordance with Qatar Law No. 13 of 2016. Depending on the context, processing may be carried out on one or more of the following grounds:
- where it is necessary for the provision of education and school-related services;
- where it is necessary to comply with legal and regulatory obligations;
- where it is necessary for legitimate operational and safeguarding purposes; and
- where the individual, or where appropriate a parent or legal guardian, has provided consent.
Where consent is required, it is obtained in a clear, specific and informed manner and may be withdrawn at any time, subject to legal or operational limitations.
Retention of personal data
Personal data is stored securely and retained only for as long as necessary.
Retention periods are determined by reference to:
- the purpose for which the personal data was collected and processed;
- applicable Qatari legal, regulatory and safeguarding requirements;
- operational, contractual and administrative needs; and
- the rights and reasonable expectations of the individuals concerned.
By way of example, student records may be retained in accordance with regulatory and safeguarding requirements, safeguarding records retained in line with applicable legal obligations, and recruitment data retained only for a limited period following completion of the recruitment process.
Further information about retention practices is set out in approved internal retention schedules and, where relevant, in more specific privacy notices provided at the point of collection.
In some circumstances, personal data may be obtained from sources other than the individual it relates to. These sources may include previous schools, referees, professional advisers, recruitment agencies, public authorities, or other entities within Orbital Education Group, as permitted by law.
Students, parents and guardians
We process personal data relating to students and their parents or guardians in order to provide education and associated services, including admissions, learning, assessment, pastoral care, safeguarding and compliance with legal obligations.
Most student‑related personal data is required to deliver education or meet regulatory responsibilities. Where personal data is optional or requires consent, this will be clearly explained at the point of collection.
Student personal data may be used for purposes including:
- managing admissions and enrolment;
- maintaining academic and welfare records;
- billing and financial administration;
- supporting learning and development;
- safeguarding and student wellbeing;
- communicating with families; and
- meeting inspection and regulatory requirements.
Children’s online privacy
Where personal data is collected online from or about students, including through admissions portals, learning platforms, forms or other school‑managed website features, the school ensures that such processing is carried out transparently, fairly and only for legitimate educational, safeguarding or operational purposes.
Where required under applicable law, the school obtains express consent from a parent or legal guardian before collecting or processing a child’s personal data through online services. Any consent requirements are clearly explained at the point at which personal data is collected.
Personal data collected online about students is used only for the purposes explained at the time of collection and is not disclosed to third parties unless this is necessary to deliver those purposes, required by law, or subject to appropriate contractual and data protection safeguards.
A parent or legal guardian may, upon request and subject to appropriate identity verification:
- obtain confirmation of whether personal data relating to their child is being processed;
- receive a description of the personal data being processed, the purpose of the processing, and a copy of that data; and
- request that the school delete, erase, or restrict the processing of personal data collected online from or about their child, where appropriate.
The school does not make a child’s participation in games, prize offers or other online activities conditional on the provision of personal data beyond what is strictly necessary for participation.
Requests relating to children’s personal data may be made using the contact details set out in this Privacy Statement and will be handled in accordance with applicable data protection requirements.
We collect personal data when individuals apply for roles with the school. Applicant data is processed solely for recruitment and selection purposes and is retained only for a limited period unless otherwise required by law or consent is provided.
Employees and contracted staff
We collect and process personal data during recruitment, onboarding and throughout employment or engagement with the school for purposes including:
- management of employment and contractual relationships;
- payroll, benefits and human resources administration;
- compliance with Qatari labour, tax and regulatory requirements; and
- safeguarding and operational management.
Where applicable, this may include sensitive personal data, which is processed with enhanced safeguards and, where required, consent.
Job applicants
We collect personal data when individuals apply for roles with the school. Applicant data is processed solely for recruitment and selection purposes and is retained only for a limited period unless otherwise required by law or consent is provided.
Marketing and Communications
We may process personal data for marketing, communications and community engagement purposes, including providing information about school events, admissions, educational programmes, open days, newsletters, alumni activities and other school-related services.
Marketing and communications may be sent by email, telephone, SMS, post, social media or other appropriate communication channels, depending on the nature of the communication and the contact preferences provided.
Where required under applicable data protection law in Qatar, we will obtain consent before sending marketing communications. Individuals may withdraw consent or opt out of receiving marketing communications at any time by using the unsubscribe option provided in the communication, updating their communication preferences, or contacting the school directly.
We do not sell personal data to third parties for marketing purposes. Personal data used for marketing and communications is managed in accordance with applicable data protection requirements, consent records, communication preferences and retention practices.
For users of our IT Systems
Personal data is generated through the use of school-managed IT systems and is processed to ensure system security, integrity and appropriate use. Access is restricted to authorised personnel.
Visitors to the school site (including CCTV)
We collect limited personal data about visitors to the school campus, including visitor registration details and CCTV images, for safety and security purposes.
CCTV operates only in public areas, is clearly signposted, and images are retained only for the minimum period necessary to fulfil security or legal requirements.
Where consent is required under Qatari law (for example, for certain uses of images, video, marketing or optional services), such consent is obtained in a clear, specific and informed manner. Where applicable, consent is obtained from a parent or legal guardian and may be withdrawn at any time, subject to legal or operational limitations.
Personal data may be shared with:
- other Orbital Education Group entities, where required for governance, safeguarding, IT or compliance purposes;
- third‑party service providers who process personal data on our behalf under contractual safeguards; and
- public authorities or regulators, where disclosure is required by law.
We do not sell personal data to third parties.
As part of an international education group, personal data may be transferred to, stored in or accessed from countries outside the State of Qatar.
Where such transfers occur, the school ensures that appropriate safeguards are in place to protect personal data. These may include intra-group data sharing arrangements, contractual protections with third-party service providers, access controls, data minimisation measures and organisational policies designed to ensure a consistent level of data protection across the group.
Under applicable data protection law in Qatar, individuals have rights in relation to their personal data, which may include the right to:
- access personal data held about them;
- request correction of inaccurate or incomplete data;
- request deletion of personal data where appropriate; and
- object to or request restriction of certain processing activities.
These rights are not absolute and may be subject to legal, regulatory or safeguarding limitations.
Requests will be handled in accordance with applicable data protection requirements, and the school may need to verify an individual’s identity before responding. The school will respond within a reasonable timeframe in accordance with applicable law. Requests may be submitted to ITSupport@oryxschool.qa.
Individuals also have the right to raise concerns or complaints about how their personal data is processed, including with the National Cyber Security Agency (NCSA) in the State of Qatar.
We do not use personal data for automated decision‑making that produces legal or similarly significant effects on individuals.
The school implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.
These measures include access controls, system protections, staff training and contractual safeguards with third-party providers.
The school operates within Orbital Education Group’s data protection framework. This framework includes group-wide policies, procedures and oversight mechanisms designed to ensure compliance with applicable data protection requirements.
This Privacy Statement is reviewed at least annually and may also be updated at any time to reflect changes in law, regulation, technology or how we operate. The most current version will always be available on our website. This Privacy Statement was last updated on 01/06/2026.
