Data Processing Agreement

1. Parties and scope

1.1 This Data Processing Agreement ("DPA") is between Eyad Elhawary for Programming and Artificial Intelligence Solutions (LLC), Commercial Register No. 307454 ("Processor", "we"), and the center or private teacher that accepts our Terms and Conditions ("Customer", "you").

1.2 It applies to all personal data we process on the Customer's behalf through the Service ("Customer Personal Data"). It forms part of the Terms and Conditions and lasts as long as we process Customer Personal Data.

2. Definitions

• PDPL: Law No. 151 of 2020 on the Protection of Personal Data and its executive regulations.
• PDPC: the Personal Data Protection Center established under the PDPL.
• Data Subject: a person whose personal data is Customer Personal Data, such as a student, parent or staff member.
• Sub-processor: a third party we engage to process Customer Personal Data.
• Personal Data Breach: a breach of security leading to the accidental or unlawful loss, destruction, alteration, disclosure of, or access to, Customer Personal Data.

Other terms have the meaning given in the Terms and Conditions or the PDPL.

3. Roles

3.1 The Customer is the controller of Customer Personal Data. We are the processor.

3.2 We process Customer Personal Data only on the Customer's documented instructions. The Terms and Conditions, this DPA, and the Customer's settings and actions in the Service are those instructions. We will tell the Customer if we believe an instruction breaks the PDPL, and may refuse to follow it.

3.3 Annex 1 describes the processing.

4. The Customer's obligations

The Customer:

• is responsible for having a lawful basis for the data it enters and the messages it sends, and for giving Data Subjects the information the PDPL requires;
• obtains a parent's consent before entering any data about a child, and records that consent in the Service;
• marks a student as an adult only when the student is 18 or older;
• makes a child the payer of their own fees only with the parent's consent;
• enters only the data the Service needs, and no health data, no national ID numbers of students or parents, and no religious or political data;
• controls which staff can see which data, and removes access when a staff member leaves;
• answers Data Subject requests about Customer Personal Data, with our help under section 9;
• obtains any license or permit the PDPL requires of it as a controller.

5. Our obligations

We will:

• process Customer Personal Data only to provide, secure and support the Service, and not for our own purposes except as section 11 allows;
• make sure every person who can access Customer Personal Data is bound by confidentiality;
• apply the security measures in Annex 3 and keep them under review;
• keep records of our processing as the PDPL requires;
• help the Customer with data protection impact assessments, PDPC requests and licensing, to the extent the information is ours;
• obtain the licenses and permits the PDPL requires of us as a processor.

6. Children's data

Customer Personal Data about children is treated as sensitive data. In addition to Annex 3, we:

• mask children's names and numbers in typed questions before they are sent to an AI provider;
• never load advertising measurement tools inside the Service or on pages parents or students open;
• replace children's and parents' names and phone numbers with made-up values in our weekly backups;
• never use children's data for marketing, advertising or profiling, and never sell it.

7. Sub-processors

7.1 The Customer authorizes us to use Sub-processors in the categories listed in Annex 2. We will give the Customer the current list of their names on request.

7.2 We may add or replace a Sub-processor at any time, and we update the list we give on request. If the Customer objects, its only remedy is to stop using the affected part of the Service or to cancel under the Terms and Conditions.

7.3 We impose on each Sub-processor data protection obligations no less protective than this DPA, and we remain responsible to the Customer for its performance.

8. Transfers outside Egypt

Customer Personal Data is stored and processed in the places listed in Annex 2. We transfer it outside Egypt only as the PDPL allows, including under any license or permit the PDPC requires, and only to Sub-processors bound by contract to protect it.

9. Data Subject requests

9.1 If we receive a request from a Data Subject about Customer Personal Data, we will pass it to the Customer within 5 business days and will not answer it ourselves, unless the Customer has closed or cannot be reached, or the law requires us to.

9.2 The Service lets the Customer view, correct, export and delete Customer Personal Data. Where the Customer cannot do what a request needs using those tools, we will help within a reasonable time. We may charge for help that goes beyond what those tools provide.

10. Personal Data Breaches

10.1 We will notify the Customer of a Personal Data Breach without undue delay after confirming it, and in time for the Customer to meet its legal duties.

10.2 The notice will describe, as far as we know at the time: what happened, the categories and approximate number of Data Subjects and records affected, the likely consequences, and what we have done and will do. We will add information as it becomes available.

10.3 We will cooperate with the Customer so that the PDPC is notified within 72 hours and Data Subjects as the PDPL requires, and we will make any notification the PDPL requires of us as processor.

11. AI features, service improvement and fraud prevention

11.1 Before any typed question or instruction is sent to an AI provider, we replace student names and student numbers with codes and remove anything that looks like a phone number. Photos, PDF files and voice notes the Customer sends to the assistant go to the AI provider as they are, and the Service says so before they are sent.

11.2 We may use copies of the Customer's chats with the AI assistant, with names and phone numbers removed, to improve the assistant. The Customer can switch this off in its AI settings. Recordings of voice calls with Tarek are kept by our voice AI provider and used to train and improve Tarek.

11.3 We may use data from which every personal detail has been removed, and which identifies no person and no Customer, to operate and improve the Service and to develop and train our own AI models.

11.4 Fraud prevention. We may compare phone numbers held in the Service, including Parents' phone numbers and the phone numbers of Account Owners and Staff, and the InstaPay details saved on Accounts, across Customers, only to prevent fraud and abuse of free trials, referrals and unpaid Platform Invoices. We use the result only to refuse or end a trial, to refuse or stop another account until an amount owed is paid, or to place a referral under review. We never disclose to one Customer any Customer Personal Data of another Customer.

12. Audits

We will give the Customer written answers and documents reasonably needed to show compliance with this DPA. Any other audit takes place only if the PDPC or the law requires it, at the Customer's cost, no more than once a year, on 30 days' written notice, by an independent auditor bound by confidentiality, and without access to other customers' data or to details that would weaken our security.

13. Return and deletion

13.1 During the subscription, the Customer can export and delete Customer Personal Data using the Service. During a free trial, the Customer can view, correct and delete it, and downloading it as a file opens once the first Platform Invoice is paid. Where a Data Subject request needs an export during a trial, we will provide it on request.

13.2 When the subscription ends, Customer Personal Data is kept for six months from the account's last activity, and during that time the Customer may ask us to reopen the account so it can export its data. After that period we delete Customer Personal Data, or anonymize it so that it no longer identifies anyone, except records the law requires us to keep. Backup copies are deleted when their rotation ends, within 12 months.

14. Liability

Each party's liability under this DPA is subject to the limits in the Terms and Conditions, except where Egyptian law does not allow a limit. The Customer is responsible for, and will indemnify us against, any fine, claim or cost arising from its own breach of the PDPL or of this DPA.

15. Order of precedence

On the processing of personal data, this DPA prevails over the Terms and Conditions. If the Arabic and English texts differ, the Arabic text prevails.

Annex 1: Details of the processing

• Subject matter and duration: providing the Service for the term of the Customer's subscription and the return and deletion period in section 13.
• Nature and purpose: hosting, storing, organizing, displaying and analyzing records; sending text messages the Customer chooses to send; comparing receipt images with invoices; answering questions through the AI assistant; recording screens to find and fix problems; producing reports and exports; backing up; securing the Service; comparing phone numbers and InstaPay details across accounts to prevent fraud, as section 11.4 describes.
• Data Subjects: students (most of them children), parents and guardians, the Customer's staff, and teachers working with the Customer.
• Personal data: names; phone numbers; student numbers; grades and subjects; groups and schedules; attendance; fees, invoices, balances and payment status; receipt images, which may show a payer's name and bank details; consent records, including a guardian's name and relationship; message preferences; staff names, roles and permissions; records of actions in the account; AI assistant chats and voice call recordings.
• Sensitive data: all data about children.

Annex 2: Sub-processor categories

Annex 3: Security measures

• Encryption of all connections, and encryption of stored data by our hosting providers.
• PINs, one-time codes and parent link tokens stored only in hashed form. Login codes expire after 10 minutes and data request codes after 30 minutes, and both allow a limited number of tries.
• Separation of each Customer's data in the application, and staff permissions set by the Customer.
• Rate limits on logins, codes and public forms, and bot checks on public forms.
• Masking of names and phone numbers in typed text before AI processing.
• Removal of personal data from error reports before they leave our systems.
• Parent links that expire, and that are canceled at once on erasure.
• Replacement of children's and parents' names and phone numbers in weekly backups.
• Nightly backups of stored files, and automatic deletion of logs and AI records on fixed schedules.
• Access to sensitive program data, such as national ID numbers, limited to authorized staff.
• Monitoring and alerts for failed jobs, errors and unusual activity.
• Confidentiality obligations for everyone with access.