1. Who we are

CampusTrack is a staff attendance platform based in Dubai, UAE. We provide GPS-based staff attendance solutions for schools and multi-site organizations. In this policy, "we," "us," and "our" refer to CampusTrack.

2. Data we collect

We collect the following categories of personal data:

Identity data: Name, employee ID, email address, phone number, date of birth, nationality, gender.
Employment data: Department, designation, branch, employment type, date of joining, reporting manager.
Attendance data: GPS coordinates at check-in/check-out, timestamps, work mode (on-campus, remote, field), device information.
Biometric data (optional): Facial feature vectors derived from a face-recognition model and used only for face verification. Stored as encrypted mathematical representations only — not as photographs.
Leave and schedule data: Leave requests, approvals, shift assignments, calendar events.
Contact form data: Name, email, optional mobile / WhatsApp number, school or organization name, role, and message content submitted through our website.

3. How we use your data

To provide and operate the CampusTrack attendance system for your school.
To verify employee identity at check-in via GPS location and optional face verification.
To generate attendance reports, leave balances, and workforce analytics for school administrators.
To send notifications related to attendance, leave approvals, and system announcements.
To respond to demo requests and contact form submissions.
To improve the product based on aggregated, anonymised usage patterns.

4. Legal basis for processing

We process personal data on the following grounds under UAE PDPL (Federal Decree-Law No. 45 of 2021):

Contractual necessity: To provide the attendance service agreed between us and your school.
Legitimate interest: For system security, fraud prevention, and product improvement.
Consent: For optional features such as face verification, which requires explicit employee consent before enrolment.

5. Data storage and security

Data is hosted on enterprise-grade cloud infrastructure with a UAE-aligned data-processing addendum (available on request). Because the primary processing region is outside the UAE, your data is transferred cross-border; we maintain appropriate safeguards including encryption, access controls, and contractual data-processing terms per UAE PDPL Article 22.
All data is encrypted at rest and in transit (industry-standard transit encryption).
Face audit photographs are retained per a configurable automatic-deletion policy aligned with UAE PDPL retention principles.
Database backups are maintained per our backup and recovery policy, with retention aligned to regulatory guidance.
Access to production systems is restricted to authorised personnel only.

6. Data sharing

We do not sell, rent, or trade personal data. Data is shared only with:

Your school's administrators: who have role-based access to employee data within their branch.
Our cloud infrastructure provider, under a Data Processing Addendum (details available on request).
Google and Microsoft: only if your school enables SSO — limited to authentication tokens.

7. Data retention

Attendance records: retained for the duration of the school's subscription plus 12 months.
Face verification photos: automatically deleted after 60 days.
Face embeddings: deleted when an employee is removed or face registration is revoked.
Contact form data: retained for 12 months.

8. Your rights

Under UAE PDPL, you have the right to:

Access: obtain the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your data, subject to legal and contractual obligations.
Restriction: request that we limit processing of your data in certain circumstances.
Objection: object to processing based on legitimate interest, and to automated decision-making.
Portability: receive your data in a structured, commonly used, machine-readable format, or have it transferred to another controller where technically feasible.
Withdraw consent: for optional processing (e.g., face verification, or analytics/marketing cookies on this website) at any time, without affecting prior lawful processing.

To exercise these rights, contact us at privacy@campustrack.ae.

9. Cookies and analytics

The CampusTrack marketing website uses cookies in three categories:

Essential — required for the site to function (e.g., security and your consent choice). Always active; no consent required.
Analytics — Google Analytics 4, loaded via Google Tag Manager, to understand aggregate, anonymised usage and improve the site. Set only with your consent.
Marketing — Google advertising/measurement tags for campaign attribution. Set only with your consent.

We use Google Consent Mode v2: analytics and marketing tags are blocked by default and load only after you opt in via our cookie banner. You can change or withdraw consent at any time using the “Manage cookies” link in the site footer. The CampusTrack application itself uses session cookies for authentication only.

10. Data Protection Officer

Under UAE PDPL Article 11, the appointment of a formal Data Protection Officer is required only where the controller carries out processing of sensitive personal data on a large scale or processes personal data on a systematic and continuous basis at the scale defined by the regulator. CampusTrack’s current processing activities do not meet that threshold; we will formally appoint a Data Protection Officer when our processing scale crosses the regulatory threshold. In the meantime, all data-protection enquiries are handled by our internal data-protection contact at privacy@campustrack.ae.

11. Contact

For privacy-related enquiries, contact:
CampusTrack
Email: privacy@campustrack.ae
Dubai, United Arab Emirates

Privacy Policy