Data Processing Agreement

Version 2.0 · Effective 29 October 2026 · Fikra Smart (fikrasmart.com)

Definitions

"Applicable Data Protection Law" means all data-protection and privacy laws that apply to the personal data, including UAE Federal Decree-Law No. 45 of 2021 (PDPL), the EU GDPR (2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, the US laws COPPA, FERPA and CCPA/CPRA and state student-privacy laws, and similar laws in Saudi Arabia, Qatar, Bahrain, Canada, Australia, Brazil and India. "Personal Data", "Controller", "Processor", "Process", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings in those laws. "Customer Personal Data" is personal data Processed by Fikra Smart on the Customer's behalf under the Service, including teacher, class and student data. "Sub-processor" is a third party engaged by Fikra Smart to Process Customer Personal Data. "SCCs" are the EU Standard Contractual Clauses (Decision 2021/914).

Roles and scope

The Customer is the Controller (or a Processor acting for a Controller) of Customer Personal Data; Fikra Smart is the Processor (or Sub-processor). The Customer is responsible for the lawfulness of its instructions, for having a lawful basis, for giving all notices, and for obtaining all consents (including parental/guardian consent or school authorisation for students). Fikra Smart is a Controller only for its own account administration, billing, security, and legal-compliance records, as stated in the Privacy Policy. Annex I describes the Processing.

Instructions

Fikra Smart will Process Customer Personal Data only on the Customer's documented instructions, which are: this DPA, the Terms, the Customer's use and configuration of the Service, and further written instructions we accept. Fikra Smart will not Process it for its own purposes, will not sell or share it (as defined in CCPA/CPRA), will not use it for advertising, profiling or AI model training, and will not combine it with other data except as needed to provide the Service. Fikra Smart will tell the Customer if it believes an instruction infringes Applicable Data Protection Law, unless the law forbids notice. Where the law requires Processing beyond instructions, Fikra Smart will tell the Customer first unless prohibited.

Confidentiality and personnel

Fikra Smart limits access to Customer Personal Data to personnel who need it for the purposes in this DPA, who are bound by written confidentiality duties, and who are trained on data protection. Access is limited to support the Customer requests, security, fault resolution, and legal compliance.

Security

Fikra Smart implements and maintains the technical and organisational measures in Annex II, appropriate to the risk, and may update them if protection is not materially reduced. The Customer is responsible for its own use of the Service, including securing its devices, credentials, PINs and class codes.

Sub-processors

The Customer gives general authorisation for the Sub-processors on the Sub-processors page. Fikra Smart will impose on each in writing data-protection obligations no less protective than this DPA and remains liable for their performance. Fikra Smart will give at least 30 days' notice of any new or replacement Sub-processor by updating that page and notifying account holders by email or in the app. The Customer may object on reasonable data-protection grounds within that period; if we cannot reasonably accommodate the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.

International transfers

• The Customer authorises transfers to the countries listed in Annex I and the Sub-processors page, including Japan (database), the United States, and, if enabled, the People's Republic of China (an AI Sub-processor, limited to the data in Annex I).
• EU/EEA personal data: the SCCs are incorporated by reference. Module Two (Controller to Processor) applies where the Customer is a Controller, and Module Three (Processor to Processor) where it is a Processor. Clause 7 (docking) applies; Clause 9(a) Option 2 (general authorisation, 30 days); Clause 11 optional language omitted; Clause 17 Option 1, governed by the law of Ireland; Clause 18 courts of Ireland. Annexes I-III are Annexes I-III of this DPA. The competent Supervisory Authority is the one for the Customer's establishment.
• UK: the UK International Data Transfer Addendum (version B1.0) is incorporated, completed with the information in this DPA.
• Switzerland: the SCCs apply with references to the GDPR read as the Swiss FADP and the Swiss FDPIC as the Supervisory Authority.
• UAE and other regimes: transfers are made on the conditions required by the PDPL and, for other jurisdictions, an equivalent recognised mechanism. If a mechanism is invalidated, the parties will cooperate in good faith to adopt an alternative.
• If a government or authority requests Customer Personal Data, Fikra Smart will, where lawful, notify the Customer, challenge unlawful or overbroad requests, and disclose the minimum required.

Assistance

Taking into account the nature of the Processing, Fikra Smart will, with reasonable cooperation and at no extra charge for ordinary requests: (a) forward any Data Subject request it receives to the Customer within 10 days and not respond itself except to acknowledge; (b) provide in-product tools and/or support for the Customer to access, correct, export and delete Customer Personal Data; (c) help the Customer with security, breach notification, data protection impact assessments and prior consultations to the extent the information is available to us.

Personal Data Breach

Fikra Smart will notify the Customer's account contact without undue delay and in any case within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information it then has (nature, categories and approximate numbers, likely consequences, measures taken and proposed, a contact point), and will update it as facts emerge. It will take reasonable steps to contain and remedy the breach and cooperate with the Customer's notification duties. Notification is not an admission of fault. See Security & Incident Response.

Return and deletion

The Customer can export its data during the term. Within 30 days after termination or the Customer's written request, Fikra Smart will delete Customer Personal Data from live systems, and from backups on their normal rotation (generally within a further 90 days), and on request will confirm deletion in writing, unless the law requires retention, in which case it will protect the data and Process it only for that purpose.

Audits and information

Fikra Smart will make available the information needed to show compliance with this DPA, including this documentation, security descriptions and responses to reasonable security questionnaires. If that is not sufficient, or a Supervisory Authority requires it, the Customer (or an independent auditor under confidentiality) may audit Fikra Smart's relevant controls once a year on 30 days' written notice, during business hours, without disrupting operations, at the Customer's cost, excluding access to other customers' data. Audit of Sub-processors is by their published reports. SCC audit rights are exercised in this way.

Student data commitments

• FERPA: for education records, Fikra Smart acts as a "school official" with a legitimate educational interest, under the Customer's direct control regarding use and maintenance of the records, and will not re-disclose them except as the Customer directs or the law requires.
• COPPA: Fikra Smart collects personal information from children under 13 only on behalf of and for the educational purpose of the school, which gives consent in place of parents, and will delete it on the school's request.
• State student-privacy laws (for example California SOPIPA/AB 1584 and New York Ed Law 2-d): no targeted advertising, no sale, no profile building other than for school purposes, and deletion on request; the Customer may attach any required state supplement, which will be added by agreement.
• CCPA/CPRA: Fikra Smart is a "service provider"; it will not sell or share the data, retain, use or disclose it outside the direct business relationship or other than for the business purposes in this DPA, or combine it with other data, will notify the Customer if it can no longer meet its obligations, and grants the Customer the right to stop and remediate unauthorised use.

Liability, term and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except that nothing limits liability that cannot be limited by law or any Data Subject's rights under the SCCs. This DPA lasts while Fikra Smart Processes Customer Personal Data. If this DPA conflicts with the Terms, the DPA prevails on data protection; if it conflicts with the SCCs, the SCCs prevail. Outside the SCCs, it is governed by the law that governs the Terms.

Annex I: Description of Processing

Annex II: Technical and organisational measures

• Encryption: TLS in transit with HSTS preload; encryption at rest by our database and storage provider.
• Access control: row-level security so users read only their own classes; role-based admin; service credentials held only in server-side secrets; anonymous per-device identities for students; class membership checks; PIN-based verified joins for marks.
• Application security: output encoding/sanitisation helpers, pinned third-party libraries, security headers (X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), rate and size caps on AI requests.
• Separation: customer data separated logically by account and class identifiers; no customer data in test environments.
• Availability: provider-managed backups and redundancy; ability to restore.
• Personnel: need-to-know access, confidentiality undertakings; minimal staff.
• Vendor management: due diligence and written terms with every Sub-processor.
• Incident management: documented response and breach notification within 72 hours.
• Data minimisation and deletion: only data needed for the Service; in-app deletion; account deletion workflow; retention schedule.
• Review: periodic security reviews and dependency updates; vulnerability disclosure channel.

Annex III: Sub-processors

See the current list, with locations and purposes, at fikrasmart.com/subprocessors.html. It is incorporated here.

Signature (optional)

Acceptance by use of the Service is sufficient. If your institution requires a signed copy, complete and email it to support@fikrasmart.com.