Data Processing Agreement

Arabic version controls. If this English text and the Arabic text disagree, the Arabic text wins.

Company: Hessity for Information Technology (Arabic: حصتي لتكنولوجيا المعلومات) Commercial register: 301420 · Tax ID: 769-507-107 Effective date: 18 August 2026 Contact: legal@hessity.com

This agreement is part of the contract with the workspace owner (an independent teacher, a center, or an institution that owns a workspace). It is read with the Terms of Use and the Privacy Policy. Students and parents do not sign it as contracting parties; they may be data subjects. A parent is not a member of any workspace.

This agreement does not govern the Hessity subscription or teaching fees the family pays. Those matters are in the Terms of Use and the Payment and Refund Policy.

The Customer is the workspace owner who uses Hessity to run teaching. Hessity provides the software.

This agreement covers personal data processed because the Customer entered it or asked for it to be processed through the product to run their classes, groups, attendance, fees, staff, and related operational messages.

Hessity is not the teaching provider. The family is the provider’s customer, not a Hessity subscription customer.

For the processing this agreement covers, the workspace owner acts as controller and Hessity acts as processor to the extent Hessity processes that workspace’s teaching and operational data on the Customer’s instructions. This agreement does not govern processing for which Hessity independently determines the purposes and means, including Hessity accounts, platform security, the Hessity subscription, and other Hessity-controller processing.

Mandatory law still governs the legal characterisation.

A student or parent account is a Hessity account. The same person may appear in more than one workspace. Hessity does not merge a teacher’s business and a center’s into one account. If they work on the same class, they remain two businesses; each is responsible for a lawful basis for what they see or share under the arrangement configured in the product.

Data subjects: students, parents, staff, teachers invited into the workspace, and anyone else whose data the Customer enters in the product.

Types of data: as in the Privacy Policy to the extent needed to run the workspace, including name, phone, profile data, attendance, fees, recorded payments, approvals, class files, and operational messages. National ID is not required to create an account.

Purpose and nature: hosting, displaying, recording, and sending what the product needs to run the service, including operational messages on enabled channels.

Duration: while the workspace exists, and thereafter as section 7, the Privacy Policy, and the law require. Stopping the Hessity subscription (wind-down) does not delete the record and does not cut off the student or parent apps.

The Customer’s use of the product is their instruction to process, within what the product and the law allow. Hessity does not follow an instruction that is unlawful or beyond the service as designed.

The Customer is responsible for a lawful basis to store student and parent data, including children’s data and parental or legal-representative consent where that is required. Creating or inviting a student file in the product is not, by itself, proof that consent was captured. Parent linking is a separate path and is never automatic; accepting the link is not, by itself, that proof.

The Customer is responsible for who they grant into their workspace and what those people see. If they share a class with another Customer (teacher or center), that is an arrangement between them; Hessity does not decide the lawful basis for that sharing.

Hessity processes the covered data to provide the service under the product, this agreement, and the law. Hessity personnel who see it keep it confidential, limited to operating, securing, supporting, preventing fraud, and complying with the law.

We take reasonable technical and organisational measures. No transmission or storage is perfectly secure.

We may rely on third parties to run the service in the categories in the Privacy Policy (cloud infrastructure, file storage, fault monitoring, payment providers, email, SMS, WhatsApp, push notifications, measurement and usage). This agreement is not a named-vendor register. A tool inside a category may change, provided we update the information if the change is material to the type of data, the purpose, or the way processing is done. Processing may occur outside Egypt as in the Privacy Policy and the law.

Hessity does not sell student or parent lists.

If a data subject exercises rights the law grants, the parties cooperate within what the product and the law allow. Requests to delete a Hessity account follow the Privacy Policy; they are not an order to wipe a workspace.

If a personal-data breach occurs, Hessity takes the steps required to assess and contain it, and notifies the Personal Data Protection Center, affected persons, and the Customer when notification is required under the law and the executive regulations. This agreement does not invent an hour clock. The Customer must notify Hessity without undue delay if they learn of an incident on their side that affects covered data.

Deleting a user’s account is a separate path: identifying account data (login, phone, email, visible profile fields, photo) is deleted or detached after the fourteen-day period in the Privacy Policy, subject to what the law or a financial trail still requires. That is not a wipe of teaching, attendance, or fee records that still concern other data subjects or a workspace that still exists.

Ending a workspace subscription or deleting the Customer’s account does not, by itself, delete all teaching records or student and parent data. Hessity may keep records that must continue in order to serve other data subjects, to perform an ongoing relationship, to meet financial or legal obligations, or for another lawful purpose the law allows. Personal data Hessity processes solely as processor on the Customer’s behalf is erased or returned when the processing purpose ends, as the law and this agreement require. Return, where it applies, is through the export the product allows. The product does not offer a full workspace wipe. Stopping the subscription is not deletion as punishment.

If the Customer asks, we export workspace data in a reasonable machine-readable form while it exists or during wind-down, subject to technical limits. Hessity will not carry out an erasure instruction that would destroy a service a party is still using, or a financial or legal trail that must remain.

The Customer has no on-site inspection right under this agreement. Reasonable cooperation is via legal@hessity.com. Any wider institutional security addendum is a later written agreement.

Limitation of liability and indemnity are in the Terms of Use. This agreement does not create a second cap.

We may update this agreement from time to time. For material changes we notify by appropriate means, and we obtain new consent where the law requires it. A later written enterprise agreement prevails to the extent it so provides.

Governed by the laws of the Arab Republic of Egypt. Arabic prevails if translations disagree.

Hessity for Information Technology حصتي لتكنولوجيا المعلومات Commercial register: 301420 Tax ID: 769-507-107 Registered office: 53 Capital Mall, behind the Court, 2nd floor, Fifth Settlement, New Cairo, Egypt (٥٣ كابيتال مول، خلف المحكمة، الدور الثاني، التجمع الخامس) Email: legal@hessity.com