Data Retention

Principles

• Every kind of record has a fixed period. Nothing about a child is kept without end. The longest period is for the permanent record (the transcript, report cards, yearly attendance totals, and a Qur'an summary): a fixed 60 years, because former students need it for life.
• We collect sensitive details only when needed, so there is less to keep.
• When a period ends, the record is deleted by a scheduled job, not left for someone to remember.

The schedule

Each row says how long we keep it and how it is deleted. The list below is the same list our nightly deletion job enforces, so this page and the job cannot drift apart.

How deletion works

• A scheduled job runs every night and deletes records whose period has ended. Whether it is deleting yet, or still rehearsing, is stated under the schedule above.
• Private files are deleted along with their records. A document goes into the recovery archive with its record (described below); a recording never does.
• Recordings of one-to-one sessions are deleted 30 days after the session by the same nightly job and under the same rules: while it is rehearsing it deletes none, and a legal hold keeps them. A safeguarding concern about the child, or naming the teacher or second adult, keeps them too: while it is open, and, if it was raised while the recording still existed, for as long as that concern's record is kept. Each deletion is logged by record number.
• Before a student's Qur'an progress detail is deleted, a summary is saved, and that summary is kept with the permanent record.
• Daily attendance, absences, declarations, and the instructional log are kept 5 years after the school year ends, because families may need them for state homeschool or umbrella-school records. The yearly totals stay on the permanent record.
• Safeguarding records are kept until the later of the student's 25th birthday and 7 years after the concern closes, or longer while a legal matter is open.
• Staff records are kept 7 years after employment ends (a period proposed for our attorney's review). Job applicants we do not hire are deleted after 12 months.
• Privacy requests (a request to see, correct, or delete information, and our reply) are kept 2 years after the request closes (a period proposed for our attorney's review), then deleted by the same job.
• Deleted information disappears from our encrypted backups as the backups rotate: we keep the last 30 nightly backups off our server and the last 7 on it, all encrypted to a key held offline. Before each update to our software we also copy the database, so the update can be undone. That copy is readable only by our own hosting account. The unencrypted copy is destroyed as soon as the update is finished (if an update stops partway, a day after the site is back), and a copy encrypted to the same offline key is kept on our server for 7 days, then deleted.
• Deletion is logged by record number, without the deleted content.

The recovery archive

Deleting a record takes it off every screen at once: no student, family member, teacher, or staff member sees it again. So that a record deleted by mistake, or wrongly, can still be recovered, it is kept for 90 days in a sealed recovery archive, and then erased for good. This applies to every deletion our software makes: the nightly job's deletions above, applications, a family's own request to delete, sign-in accounts, the audit log, messages and conversations, and family and school files.

• Everything in the archive is encrypted. No screen, report, export, or maintenance command can read what it holds. A deleted file is moved there, under a number instead of its name.
• Our office sees only a list of what is there: the date, the kind of record, its record number, and why it was deleted.
• Within the 90 days, a Director can put a record back where it was, with the same record numbers, and only our Safeguarding Lead or deputy can do so for a safeguarding record. Each restore needs a written reason and two-step sign-in, is recorded, and is reported to the other Directors (or the rest of the safety team) by record number. Our technology provider can restore a record only at the school owner's request, and that is recorded too.
• After 90 days the nightly job erases the record for good, files included, and logs that by record number. A legal hold that covers a record keeps it in the archive until the hold is released. While the nightly job is rehearsing, it erases nothing here either.
• Recordings of children (one-to-one session recordings and recitation recordings) are never kept in the archive: a child's face and voice keep the shorter promise, and they are erased on their own dates. Mail delivery records, sign-in sessions, and caches are not kept there either.
• The periods in the schedule above do not change: they say when a record is deleted. The archive only adds the 90 days in which a deletion can be undone.

Sign-in accounts

• A student's sign-in is turned off when the student withdraws, and deleted 1 year later. The student record stays, without a sign-in, for the periods above.
• A family's sign-in accounts are deleted 1 year after the family's last child leaves or its last application closes, unless a legal hold, an unpaid invoice, or an open privacy request still needs them. Invoices keep the payer's name as written on them.
• A former staff member's sign-in is turned off when their employment ends, and deleted with their staff record.

When we must keep a record longer

We keep a record past its period only when a safeguarding matter, a legal claim, a court order, or a law requires it, or while a family's own request to see, correct, or download its information is open. Each legal hold is recorded with its reason by our office, on the Legal holds screen of our school software, and our nightly job keeps every record the hold covers. When the hold is released on that screen, the records are deleted on the job's next run if their period has ended.

Two kinds of hold need no one to record them. An open safeguarding matter about a child holds that child's records by itself. An open request from a family to see, correct, or download its information holds that family's records until the request closes. A request to delete holds nothing, since deleting on schedule is what it asks for.

A hold reaches as far as its reason. A hold about a family keeps the records of every child in it. A hold about one child keeps that child's records and the records the household shares, such as its invoices and emergency details, but not a brother's or sister's own records.

Asking us to delete sooner

You can ask us to delete information before its period ends by writing to privacy@southernislamicinstitute.org. We will, unless a record-keeping or safeguarding duty requires us to keep it, in which case we tell you which duty. We reply within 30 days. What we delete is kept for 90 days in the sealed recovery archive described above, then erased for good.