Privacy Policy

Each client institution is the controller of the data it manages through the service. Manhaj acts as processor: it processes such data only on the institution’s instructions and solely for the purposes of providing the service.

The contact details of the institution’s data contact (DPO or data officer) are made available to data subjects by the institution itself.

Depending on the features used, the service processes: identity data (learners, parents/guardians, staff), academic data (enrolments, grades, attendance), contact data, billing data and, where applicable, sensitive data (school health) strictly necessary to the institution’s mission.

Data is processed for the management of schooling and training, communication with families, billing and compliance with the institution’s legal obligations.

Processing is based on performance of the relationship between the institution and families, on applicable legal obligations and, where relevant, on consent collected in accordance with Law 2004-63.

The service processes data relating to minors under the responsibility of the institution and parental authority. Such data benefits from reinforced protection and is accessible only to authorised persons.

Data is accessible only to authorised users of the institution and to the publisher’s staff strictly necessary for operation and support, bound by confidentiality.

Any use of further sub-processors (hosting, notification delivery) takes place in compliance with Law 2004-63 and under equivalent confidentiality and security commitments.

Data is hosted on secure infrastructure. Any transfer of data outside Tunisia is governed in accordance with the requirements of Law 2004-63 and, where applicable, subject to INPDP authorisation.

Data is retained for the period necessary for the purposes pursued and the institution’s legal obligations (in particular academic and accounting retention periods), then securely deleted or archived.

The publisher implements appropriate technical and organisational measures: strict data isolation per institution, encryption at rest of sensitive data, role-based access control, action logging and regular backups.

In accordance with Law 2004-63, every data subject has a right of access, rectification and objection on legitimate grounds regarding their data.

These rights are exercised with the institution acting as controller. Manhaj, as processor, assists the institution in handling such requests.

Processing of personal data is subject to the formalities provided by Law 2004-63 before the INPDP. The institution remains responsible for completing the declarations or authorisations incumbent upon it; Manhaj provides the necessary technical information.

The platform uses cookies strictly necessary for authentication and operation of the service. No third-party advertising tracker is placed.

This policy may be updated; the version in force is published on this page. For any data-related question, the institution and data subjects may contact Manhaj via the Contact page.