← Back to Privacy Center

Data Retention & Deletion Policy

Effective date: 20 April 2026

1) Purpose

This Data Retention & Deletion Policy is made available by UniHawk Education Support Services L.L.C, a company incorporated under the laws of the United Arab Emirates, with its registered address at Office 1113, Malik Hamad Suhail Owaida Al Khaili Building, Al Sufouh 2, Dubai, UAE (together “we”, “us”, “our” or “UniHawk”) for the HawkNest platform, including the website, mobile application, and related features and functionalities (together, “HawkNest” or the “Platform”).

This Policy sets out the principles and practices governing the retention, storage, and deletion of personal data collected or processed through the Platform, in accordance with applicable data protection laws. UniHawk is committed to ensuring that personal data is retained only for as long as necessary for the purposes for which it is collected and is handled securely throughout its lifecycle. To support the operation of the Platform and the provision of its services, personal data may be stored and processed as described below. This Policy should be read together with our Privacy Policy, which provides further details on how we collect, use, and protect personal data, including the categories of data processed and applicable legal bases.

All personal data collected or processed through the Platform is handled securely and in accordance with this Policy. To support the operation of HawkNest and the provision of its services, data is stored and processed as follows:

  • All personal data is stored on Amazon Web Services (AWS) infrastructure located in the United Arab Emirates (UAE) (me-central-1 region).
  • Certain AI-powered features are supported by Microsoft Azure OpenAI Service (Enterprise), also hosted in the UAE. Such services process inputs on a transient basis and do not retain personal data following completion of the request, except where limited technical logs may be generated for security and performance monitoring purposes. We do not include student personally identifiable information (PII) in AI prompts.
  • Where third-party operational tools are used, only pseudonymised identifiers are shared. No directly identifiable personal data (such as names, email addresses, or contact details) is transmitted to such tools.

2) Retention principles

We retain Personal Data in accordance with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021, as may be applicable, including the principles of data minimisation and storage limitation.

Personal data is retained only for as long as necessary to:

  • provide, operate, maintain, and improve the Platform;
  • maintain the security, integrity, and performance of the Platform, including fraud prevention and incident response;
  • comply with applicable legal, regulatory, tax, or accounting obligations; and
  • establish, exercise, or defend legal claims and enforce our agreements.

We periodically review the data we hold and securely delete or anonymise data that is no longer required for these purposes.

Where Personal Data is processed on behalf of institutional partners (including schools), retention and deletion shall additionally be governed by applicable contractual arrangements, including data processing agreements, and any documented instructions provided by such partners in their capacity as Data Controllers.

3) Categories of Data and Retention Periods

The retention periods set out below reflect our standard practices and may vary where required to comply with applicable law, regulatory requirements, contractual obligations, or legitimate interests.

  • Account and profile data: retained for the duration of the account. Upon account closure, such data is deleted or anonymised within 30 days, unless continued retention is required by law or for legitimate legal purposes.
  • School roster and import data: deleted following successful processing. Where temporarily retained for validation, troubleshooting, or reprocessing, such data is deleted within 30 days.
  • Application and system logs: retained for 90 days, and may be retained for up to 180 days where necessary for security monitoring, investigations, or incident response. Such logs do not include student PII used in AI prompts.
  • Analytics and usage data: retained for up to 24 months, after which it is aggregated and/or anonymised so that it no longer identifies any individual.
  • Support and correspondence data: retained for 24 months following resolution of the request, and longer where necessary for dispute resolution, enforcement of agreements, or compliance with legal obligations.
  • Backups and disaster recovery data: retained on a rolling basis for up to 35 days, after which such data is automatically overwritten. Backup data is not actively processed except for business continuity or disaster recovery purposes.

4) Data Subject Rights and Deletion Requests

Subject to applicable laws, you may request the deletion of your personal data where:

  • the data is no longer necessary for the purposes for which it was collected;
  • you withdraw consent (where processing is based on consent);
  • you object to processing and there are no overriding legitimate grounds; or
  • the data has been unlawfully processed.

To submit a deletion request, please contact us at: support@hawknest.ai

We will respond to verified requests within 30 days, subject to any extensions permitted under applicable law.

We may retain certain data notwithstanding a deletion request where such retention is necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

5) Institutional (School) Data Handling

For deployments involving schools or other institutional partners, data retention and deletion may also be governed by applicable contractual arrangements, including data processing agreements.

In such cases, we will support the return and/or deletion of personal data in accordance with the agreed terms, including specified timelines and applicable backup retention periods.

6) Effect of Deletion

Deletion of personal data may involve:

  • removal from active and live systems;
  • retention in secure backup systems until such data is automatically overwritten in the normal course of operations; and/or
  • continued retention where required to comply with legal or regulatory obligations, or for the establishment, exercise, or defence of legal claims.

Deletion requests are implemented in accordance with our internal data lifecycle management processes and may not result in the immediate removal of data from all systems.

Where feasible, data may be anonymised instead of deleted, in which case it will no longer be associated with an identifiable individual.

For school deployments, we will support deletion/return per the DPA, including timelines and backup retention.

7) Updates to this Policy

We may update this Policy from time to time to reflect changes in legal, regulatory, or operational requirements. Any updates will be made available through the Services or via other appropriate means.

8) Contact

For any questions or requests relating to this Policy or our data practices, please contact: