Data Rights Request
Data Rights Request
Submit a request to exercise your data rights under GDPR/UK GDPR. You can request access to, rectification, deletion, or portability of your personal data.
What happens when you request data deletion
When you ask for your data to be deleted, your request is verified and actioned within 30 days. Here is exactly what is removed, what we are legally required to keep, and how the process works.
What we remove
- Your name, email address, and phone number — permanently replaced with an anonymised placeholder
- Attendance, grades, homework, and assessment records linked to you
- Wellbeing records, emergency contacts, and guardian relationships
- Messages, communications, and files you uploaded
What we must keep — and why
- Financial records — school fees, invoices, and payments — kept for 6 years to meet HMRC statutory requirements, and cannot be erased
- An audit log confirming the erasure was completed — kept as an accountability record. It records that the action took place, not your personal details.
How the process works
- Your request is verified by a school administrator and actioned within 30 days
- Erasure is carried out by irreversible anonymisation — your personal identifiers are permanently replaced with a pseudonym
- Once anonymised, the action cannot be undone, and the remaining records can no longer be traced back to you
If you use a Tawaasal mobile app provided by your school, your school is the controller of your personal data and Tawaasal acts on its behalf. We forward your request to your school, who verifies and actions it within the timeframe above.