Data processing addendum

This addendum forms part of the Mudarraj Platform Terms and governs how Devya processes personal data on your academy's behalf. The academy owner accepts it together with the terms when opening the academy, and it applies for as long as Devya processes the academy's data.

1. Roles and definitions

• The academy is the controller of the personal data of its students, instructors and team within the academy, under the Personal Data Protection Law No. 151 of 2020 and its executive regulations ("the Law").
• Devya is the processor, handling that data for the academy and on its instructions.
• Data subject: any individual the data is about, such as a student or an instructor.
• Breach: any unauthorised access to, disclosure, alteration, loss or destruction of personal data.
• This addendum does not cover data Devya processes as a controller: platform-level account data, sign-in security, academy billing and platform security logs. Those are covered by the privacy policy.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Mudarraj platform to the academy.
• Duration: the term of the contract, followed by the return and deletion period in section 11.
• Nature: hosting, storage, organisation, display, streaming, video transcoding, watermarking, backup and deletion; sending emails and notifications on the academy's behalf; passing orders to the payment gateways the academy connects.
• Purpose: running your academy: course enrolments, lessons, quizzes, certificates, questions and reviews, orders and payments, instructor earnings, notifications, performance reports and anti-sharing tools.

3. Data subjects and categories of data

3.1 Data subjects

• Students, including students under 18 with their guardian's consent.
• Instructors.
• The academy's team: its owner and admins.
• People who submit the academy's contact forms.

3.2 Categories of data

• Identity and contact: name, photo, email address, phone number, and date of birth and city where given.
• Study details: university, faculty, and academic year or level.
• Device data within the academy: device name and type, a hash of the random device ID, last IP address and last seen time.
• Learning data: enrolments, lesson progress, watch days, notes, quiz attempts and answers, certificates.
• Community data: course questions, reviews, blog posts and comments.
• Sales data: carts, orders, payment status and method (never full card numbers), promo codes and referral points.
• Instructor finances: revenue shares, statements, earnings and payout account details (encrypted where sensitive).
• Uploaded files: images and course files.

The platform is not designed for highly sensitive data such as health or religious information, and the academy should not collect it through the platform. Children's data is handled with particular care, and the academy is responsible for obtaining a guardian's consent.

4. Processing on documented instructions

• We process the data only on your documented instructions: this addendum, the Platform Terms, the settings and actions you take in the dashboard, and written requests from the academy owner.
• If the law requires us to carry out processing you did not ask for, we tell you first unless the law forbids it.
• If we believe an instruction breaks the law, we tell you straight away and may stop following it.
• We do not sell your academy's data or use it for our own purposes or for advertising. We may produce aggregated statistics that identify no one, to run and improve the platform.

5. Confidentiality and personnel

• Only Devya staff who need your academy's data to do their job, such as technical support and system operations, can access it.
• Everyone with access is bound in writing to confidentiality and knows their data protection duties.

6. Security measures

We apply technical and organisational measures appropriate to the risk, including:

• TLS encryption for every connection.
• Passwords stored with one-way hashing; session and verification tokens stored only as hashes.
• Payment gateway credentials and other secrets encrypted at rest.
• Private files and video served only through short-lived signed links, after an access check.
• Each academy's data isolated from every other academy's in every query.
• Role-based permissions for the academy's team.
• An audit log of privileged actions.
• Rate limiting against abuse.
• Regular backups.

We review and improve these measures, and we will not lower the overall level of protection during the contract.

7. Sub-processors

• The academy gives general authorisation for the sub-processors listed on the sub-processors page.
• Before we add or replace a sub-processor, we give you at least 30 days' notice, by email to the academy owner and by updating that page.
• You may object in writing within that period on reasonable data protection grounds. We will work with you on a solution; if we can't find one, you may end the affected service and get back what you prepaid for the unused period.
• We bind each sub-processor to protection obligations no weaker than this addendum, and we remain responsible to you for its performance.

8. Transfers outside Egypt

• We transfer personal data outside the Arab Republic of Egypt only with the safeguards and the licences or permits the Law requires.
• The processing locations of each sub-processor are listed on the sub-processors page.

9. Help with data subject requests

• If a student or instructor sends us a request about your academy's data (for example to access, correct or delete it), we pass it to you within 5 working days, and we don't answer it ourselves unless you authorise us or the law requires it.
• We help you meet these requests within the legal deadlines with the tools and information available, such as exports, corrections and deletion.
• We give reasonable help with data protection impact assessments and with enquiries from the Personal Data Protection Centre.

10. Breach notification

• If we become aware of a breach affecting your academy's data, we notify you without undue delay and within 48 hours at most.
• The notice includes what we know at the time: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures we have taken or propose, and who to contact. We send updates as we learn more.
• We help you notify the Personal Data Protection Centre and the people affected when that is required. Where the Law requires us, as processor, to notify the Centre directly, we do so within 72 hours and tell you.

11. Return and deletion of data

• You can export your academy's data during the contract, as the Platform Terms describe.
• When the contract ends, we keep the data for 30 days so you can export it, then delete it within 90 days, except what the law requires us to keep. Backups are erased automatically as they roll off.
• We confirm the deletion in writing if you ask.

12. Audits and information

• On request, we give you the information needed to show we comply with this addendum, such as a description of our security measures and the list of sub-processors.
• Once a year, at your own cost, you may carry out a reasonable audit yourself or through an independent auditor bound by confidentiality, with 30 days' notice, during working hours, without disrupting the service or accessing other academies' data.
• An additional audit is possible after a breach affecting your data, or when the Personal Data Protection Centre asks for one.

13. Liability

• Each party's liability under this addendum is subject to the limits in the Platform Terms.
• Each party is responsible for its own breach of its legal data protection obligations to the extent the law provides.

14. Precedence and contact

• If this addendum conflicts with the Platform Terms on a data protection matter, this addendum prevails.
• The Arabic text governs if it differs from this English translation.
• For anything about data protection: privacy@mudarraj.dev. Our company details are at the end of this page.