Privacy and personal data
Uvak - Upplands Väsby Arabiska Akademin
Edition 2026-10-25.1
School privacy contact: Contact your school administration.
1. Who is responsible
The school identified above is responsible for its school records and decides why and how they are used. Skolnav is the application used to provide these services, not the school. Contact the school for the identity of its legal operator, its data protection officer where applicable, or questions about your records. The school contact above is the first point of contact; the Skolnav contact, when shown, handles service-related privacy requests.
2. Information we handle
Depending on your role and the services your school uses, records can include your name, school membership, email, telephone, account identifiers, profile photo and optional introduction; a child's registration details, date of birth or personal identity number where needed, address and guardian relationships; classes, teacher assignments, enrolment, sessions, attendance and corrections; messages, announcements, attachments and read or family acknowledgments; library loans, school fees and payments; photo permissions, invitation and recovery events, and security/audit records. Not every school collects every category. Do not put sensitive information about children, health, protected identities or other people in a public profile or ordinary message.
3. Where information comes from
Information is provided by you, a child's guardian, authorised school staff, approved school imports, or your use of the service. An import must not be used to guess a child's identity or guardian relationship. Ask the school to correct inaccurate official records. Editing your display name or telephone in your profile does not update official student or guardian records.
4. Purposes and lawful grounds
The school uses the records needed to organise teaching, maintain accurate attendance, communicate with families, manage access and library services, administer applicable fees, and protect the service. The lawful ground depends on the school and the purpose: a legal obligation or public task where applicable, a contract where necessary for that contract, or a documented legitimate interest where permitted after considering children's rights. The school must identify the applicable ground and any additional condition before handling sensitive data. Accepting the terms or acknowledging this notice is not consent to all processing and does not create a lawful ground by itself.
5. Children and photos
Children receive age-appropriate explanations and school-managed accounts. A guardian's involvement depends on the child's age, maturity and the activity. A child's acknowledgment of service rules is not treated as authority to enter an adult contract. Optional internal photos, website publication and social-media publication use separate permissions; permission for one purpose is not permission for another. You can ask the school to withdraw optional photo permission without losing necessary school services. Withdrawal does not undo earlier lawful use. A profile photo is optional, visible to signed-in members of the same school, and can be removed from your profile.
6. Who can see information
School access is based on active membership and assigned responsibilities. Administrators manage school records and can contact active school users. Teachers access assigned classes and permitted family contacts. Parents access linked children; students access their permitted school information. Private conversations remain limited to their authorised participants: an administrator role alone does not open another person's private conversation. Your display name and profile photo appear with announcements and messages. For staff, current school administrators can view your profile telephone, introduction and optional birthday month and day. You can add or remove your birthday yourself. Student and staff birthday names and dates are shown only to administrators in the school birthday calendar and weekly card. Birthday greetings are private to the recipient and can be disabled in notification preferences. Other members cannot view your telephone or introduction through the staff directory. Authorised support access must have a specific purpose and be limited.
7. Providers and international transfers
The school may use contracted hosting, authentication, backup and email providers to operate Skolnav. Providers receive only information needed for their service under appropriate instructions and agreements. Email notices may reveal your address to the mail provider; avoid forwarding school messages to unrelated people. Ask the school for its current provider list, storage locations and any transfer safeguards. Transfers outside the EEA require an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards with the necessary assessment. This notice does not authorise a new provider or transfer.
8. Retention and deletion
There is no universal Swedish maximum retention period for all school data. The default review schedule for ordinary attendance, enrolment and school correspondence is three years after the relevant school year or case ends, with annual checks for information no longer needed. Retention for three years is justified only while the documented purpose remains; unnecessary information must be deleted or anonymised earlier. Account access ends when the school relationship ends. Optional profile details and photos should be removed when no longer needed. Minimum identity and audit information may need to remain with retained records to preserve their accuracy. Legal holds, accounting obligations and applicable public-record or school archival rules can require different or longer periods, including permanent preservation. Each school must document those exceptions and its deletion decisions. This schedule is a review policy, not a claim that automatic deletion already occurs.
9. Backups and restoration
Backups are used for recovery, with restricted access and a separate documented retention cycle. They are not a reason to keep active records indefinitely. A deletion may remain in a protected backup until that backup expires; after a restoration the school must reapply relevant deletion and access-revocation decisions before returning the data to normal use. Ask the school for its current backup expiry period. Do not assume the three-year school-record review period is the backup period.
10. Your rights
Depending on the applicable ground and exceptions, you can request access and a copy, correction, erasure, restriction, objection, or portability. You can withdraw consent for optional processing. Erasure is not absolute where records must lawfully be retained. Contact the school using the details above; it may verify identity proportionately and consider the child's rights before disclosing records to a guardian. Do not email passwords, full personal identity numbers or sensitive records in an initial request. Requests are normally answered within one month; a justified extension must be explained. You may complain to Sweden's Integritetsskyddsmyndigheten (IMY), www.imy.se.
11. Security, cookies and account records
Access checks, protected sign-in and school separation help protect records. Keep your password private, sign out on shared devices and report suspected exposure promptly. Necessary sign-in/session cookies and language/theme settings support the application. Optional tracking requires separate information and choices. The service records the version and time of your explicit terms agreement and privacy-notice acknowledgment, linked to your school account. This record does not grant school roles or photo permissions.
12. Changes and contact
The school should notify you of material changes. Updated terms or notices can require a new explicit acknowledgment; previous records remain attributable to the text accepted at that time. You can read these documents without signing in. Contact the school if a notice, retention period or legal responsibility is unclear before providing optional information.
IMY — Personal-data retention guidance
Skolverket — School records and archiving guidance