Privacy Policy

Effective Date: 7 August 2026

Version No.: 1.1

Preamble

Edvanz for Information Technology Industry L.L.C., a limited liability company subject to the provisions of Investment Law No. 72 of 2017, registered with the Cairo Investment Commercial Registry under No. (290277), and having its registered office at Office H27 – 52 Al Tayaran Main Street, opposite the Health Insurance Hospital, Nasr City, Cairo, Arab Republic of Egypt, owns and operates the Edvanz educational technology platform. The company shall hereinafter be referred to as “Edvanz” or the “Company”, and the website, applications, dashboards, systems, and related services shall collectively be referred to as the “Platform”.

Edvanz is committed to protecting the privacy of Platform users and to processing Personal Data lawfully, fairly, transparently, and securely, in accordance with Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued by Minister of Communications and Information Technology Decree No. 816 of 2025, and all applicable regulatory decisions and guidelines. Edvanz also complies with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), where and to the extent it applies to Edvanz or to the relevant Processing activity, including where services are offered to persons located in the European Union or the European Economic Area, or their behavior therein is monitored, without the mere accessibility of the Platform from those territories automatically triggering the application of the GDPR.

This Policy explains how Personal Data is collected, obtained, recorded, organized, classified, used, analyzed, hosted, stored, shared, transferred, secured, retained, and deleted, including the use of certain data for analytics, product development, artificial intelligence technologies, and marketing.

This Policy applies to students, parents and legal guardians, teachers, educational centers, center administrators, supervisors, their personnel, payers, website visitors, persons communicating with Edvanz, and every person who uses the Platform or submits data to it.

Definitions

The following words and expressions shall have the meanings assigned to them below, unless the context otherwise requires:

Platform: The Edvanz website, its applications, dashboards, systems, and associated technical services.

Company or Edvanz: Edvanz for Information Technology Industry L.L.C., in its capacity as the owner and operator of the Platform.

Data Subject: Any natural person to whom Personal Data processed through the Platform relates.

Personal Data: Any data relating to an identified natural person or a natural person who can be identified, directly or indirectly, whether alone or when combined with other data.

Sensitive Personal Data: Data that reveals psychological, mental, physical, or genetic health; biometric data; financial data; religious beliefs; political opinions; or security status. In all cases, Children’s Data shall be deemed Sensitive Personal Data.

Student: A person registered on the Platform to receive an educational service, view content, take tests, or monitor attendance and results.

Parent or Legal Guardian: The father, mother, custodian, guardian, or legal representative responsible for a minor Student.

Educational Service Provider: The educational center or Teacher that provides the educational service directly to the Student and independently from Edvanz.

User: Any person who accesses the Platform, creates an account on it, or uses any of its services.

Data Controller: The person or entity that determines the purposes and means of Processing Personal Data, whether alone or jointly with others.

Data Processor: The person or entity that processes Personal Data on behalf of and in accordance with the instructions of the Data Controller.

Processing: Any electronic or technical operation performed on data, including its collection, recording, organization, classification, analysis, combination, storage, alteration, use, access, sharing, transfer, anonymization, or deletion.

Aggregated Data: Data combined with data relating to a number of Users to produce general statistical or analytical indicators or results. Aggregated Data shall not be considered anonymized merely because it has been combined if a particular person or a limited group of persons may still reasonably be identified from it.

Anonymized Data: Data whose elements have been removed or altered in a manner that makes identifying the Data Subject, directly or indirectly, not reasonably possible using available and reasonably anticipated means. If re-identification is possible, the data shall remain Personal Data and shall be subject to this Policy and the law.

Pseudonymized Data: Data in which certain direct identifiers have been replaced with identifiers or codes, while the additional information enabling relinking is stored separately and securely. Pseudonymized Data shall remain Personal Data for as long as it can be relinked to the Data Subject.

Artificial Intelligence Technologies: Systems, models, or algorithms that use machine learning, automated analysis, language processing, computer vision, prediction, recommendation, or automated content generation.

Direct Marketing: Any message, communication, or advertisement addressed to a specific person for the purpose of promoting services, products, offers, or events.

Service Provider: Any external party engaged by Edvanz to provide technical, operational, or advisory services related to the Platform.

Consent: A freely given, specific, informed, and unambiguous expression made by the Data Subject or the person legally representing the Data Subject, in paper or electronic form, evidencing acceptance of the Processing of specified data for a specified purpose and a specified period, and which may be withdrawn without prejudice to the lawfulness of Processing conducted before such withdrawal.

Child: Any person under eighteen years of age, whose data is subject to the special controls applicable to Children’s Data and Sensitive Personal Data.

Scope of Application of the Policy

This Policy applies to data processed when an account is created, or when the website, application, or dashboard is used; when content is viewed, tests are taken, attendance is recorded, grades or fees are entered; and when technical support is contacted or a complaint, request, or Consent is submitted.

This Policy does not apply to independent third-party websites, applications, or services that may be linked through the Platform. Data submitted directly to such parties shall be subject to their respective privacy policies.

Certain new features or services may be subject to an additional privacy notice or separate Consent describing the data and purposes specific to that service. In the event of conflict, the specific notice shall prevail to the extent of the relevant service.

Edvanz’s Role in Data Processing

Edvanz acts as a Data Controller with respect to Processing activities for which the Company determines the purposes and means, such as creating and verifying accounts, managing access permissions, securing the Platform, operating technical support, managing subscriptions and invoices payable to the Company, analyzing technical performance, preventing fraud and deception, and complying with legal obligations.

Edvanz acts as a Data Processor when it hosts or processes, on behalf of an educational center or Teacher, data relating to Students, parents and legal guardians, attendance, fees, tests, grades, assignments, and educational content, within the limits of operating the Platform, providing the requested services, and the purposes lawfully determined by the Educational Service Provider.

Edvanz and the educational center or Teacher may act as Joint Controllers where they actually jointly determine the purposes and means of a particular Processing activity. The legal capacity shall be determined according to the actual facts of each activity and shall not be altered by the description or designation used in any document.

Allocation of Roles and Responsibilities

Where Edvanz acts as a Data Processor, its Processing shall be limited to operating the Platform and providing the requested services. Edvanz shall comply with confidentiality, security, and access management controls; assist Data Subjects in exercising their rights; address data breach incidents; transfer data across borders only after satisfying legal requirements; and return or delete the data when it is no longer required.

Where Edvanz and an educational center or Teacher actually jointly determine the purposes or means of a particular Processing activity, each party shall bear the legal obligations associated with its role, including providing privacy notices, obtaining required Consents, responding to requests, securing data, reporting incidents, and making material information available to Data Subjects whenever legally required.

Edvanz’s role as a Data Processor does not release the Educational Service Provider from its obligations as a Data Controller, nor does it release Edvanz from its independent legal obligations relating to security, confidentiality, implementation of lawful instructions, and protection of Data Subjects’ rights.

Sources of Personal Data

Edvanz may obtain data directly from the User when an account is created or updated, the Platform is used, Consent is given, a request or complaint is submitted, or technical support is contacted.

Edvanz may obtain data from the educational center or Teacher when initial accounts are created for Students or personnel, or when attendance, fees, collection, tests, grades, or educational content are entered.

Edvanz may also obtain data from a Parent or Legal Guardian when the Parent or Legal Guardian’s account is linked to the Student’s account, or when capacity information, Consents, or requests relating to the Student are submitted.

Certain data is collected automatically from the device, browser, or application, such as connection data, login records, technical activity, error reports, and performance reports.

Edvanz may obtain limited data from technical Service Providers, competent authorities, or lawfully available sources, to the extent necessary to provide the service, protect the Platform, or comply with a legal obligation.

Data Accuracy and the User’s Obligation to Keep Data Updated

The User shall provide accurate, complete, and up-to-date Personal Data and shall notify Edvanz or the Educational Service Provider of any change to the User’s data or to the data of any Student linked to the User’s account, including the telephone number, email address, capacity of the Parent or Legal Guardian, and relationship to the Student. Edvanz shall not be liable for failure to receive notifications, inability to provide certain services, or the granting of incorrect permissions where caused by the User’s failure to update the data or by the provision of inaccurate information, without prejudice to Edvanz’s obligation to take reasonable measures to verify the data where necessary.

Categories of Data Processed

Account and Identity Data: May include name, telephone number, email address, encrypted password, account type, profile picture, language, time zone, account status, creation date, and verification and login records. Edvanz may request appropriate data or documents to verify identity, age, legal capacity, or relationship to the Student.

Student Data: May include name, age or date of birth, educational stage or grade, associated center or Teacher, groups, courses, Parent or Legal Guardian data, attendance records, tests, assignments, answers, grades, results, reports, and educational notes.

Parent and Legal Guardian Data: May include name, telephone number, email address, capacity in relation to the Student, Students linked to the account, and records of Consents, acknowledgments, requests, and complaints.

Teacher and Educational Center Data: May include name, trade name, contact details, professional capacity, center information, personnel, supervisors, permissions, technical subscription data, invoices, and transactions payable to Edvanz.

Educational Data: May include videos, notes, curricula, assignments, tests, questions, model answers, submitted answers, grades, results, reports, notes, and records of content viewing and interaction.

Attendance and Absence Data: May include the date and time of attendance, absence, delay, or departure; the method used to record attendance; the identity of the person who entered the record; and any amendments made to it.

Fees and Collection Data: May include the amount of fees due, collection status, amounts recorded by the center or Teacher as collected or overdue, date and method of payment, discounts, exemptions, and adjustments. Edvanz does not currently collect educational fees from Students or parents and legal guardians, receive or retain such amounts, or transfer them to Teachers or centers. Edvanz also does not currently collect bank card data relating to Students or parents and legal guardians, because in-Platform payment is not currently available.

Uploaded Content: May include videos, audio recordings, images, files, notes, questions, tests, assignments, reports, and any content uploaded by the center, Teacher, or authorized administrator. Edvanz does not create, select, or upload content on behalf of the Educational Service Provider.

Platform Usage Data: May include the pages and features used, login and logout times, session duration, videos opened, viewing percentage, tests, assignments, searches, clicks, interactions, and changes made within the account.

Device and Connection Data: May include the Internet Protocol address, device type, operating system, application and browser version, device or session identifier, language, time zone, network data, and error and performance reports.

Test and Security Data: May include test start and end times, response duration, number of attempts, navigation between test pages, the device used, and certain technical data required to administer the test, prevent cheating, and protect content.

The camera or microphone shall not be activated, and facial recognition or biometric data shall not be used, unless a clear notice has first been provided and all legally required Consents and permits have been obtained.

Support and Complaint Data: May include correspondence, reports, complaints, support requests, documents, images, recordings submitted by the User, and the actions taken in relation thereto.

Acceptance and Consent Records: May include the date and time of account creation, acceptance of the terms and conditions, acknowledgment of the Privacy Policy, Parent or Legal Guardian Consents, marketing Consents, the version of the documents accepted, and device and connection data at the time of the action.

Controls Applicable to the Processing of Sensitive Personal Data

Edvanz shall not collect, transfer, store, retain, process, or make available Sensitive Personal Data unless the required license or permit has been obtained from the Personal Data Protection Center and the express written Consent of the Data Subject, or the Parent or Legal Guardian in the case of Children’s Data, has been obtained, unless the Processing falls within a case permitted by law.

The Processing of Sensitive Personal Data shall be limited to data that is essential and necessary for the specified and declared purpose. Enhanced security controls and restricted access permissions shall be applied, and secure electronic records shall be maintained for Consents, requests for erasure, amendment, or suspension of Processing, and the actions taken in relation thereto.

The camera, microphone, facial recognition, or any feature relying on biometric or health data shall not be activated except through a separate notice specifying the purpose, data, period, and recipients, and only after all legally required Consents, licenses, or permits have been obtained.

Failure to Provide Required Data

Where certain data is necessary to create an account, verify the User’s identity or capacity, link a Parent or Legal Guardian to a Student, provide a Platform service, or comply with a legal obligation, failure to provide such data, or provision of incomplete or inaccurate data, may prevent the account from being created or activated, certain features from being used, or the request from being fulfilled. Where appropriate, Edvanz shall identify mandatory data and the potential consequences of failing to provide it at the time of collection.

Purposes of Data Processing

Edvanz may process data, depending on its nature and the available legal basis, to create, manage, and verify accounts; link the Student to the Parent or Legal Guardian and the Educational Service Provider; operate the Platform; and provide its features and services.

Processing is carried out to make content, assignments, tests, results, and reports available; manage attendance, absence, fees, and collection status; and manage the permissions of Users, administrators, and supervisors.

Data is also used to send service, security, and update notifications; provide technical support and examine complaints; analyze errors, monitor performance, and improve stability; protect accounts, detect breaches, and prevent cheating, fraud, and misuse.

Data may also be used, to the necessary and proportionate extent and having regard to its nature, Edvanz’s capacity, and the appropriate legal basis, to personalize the User experience, content, and notifications; develop new features, products, and services; conduct analytics, statistics, and operational measurements; test and improve Artificial Intelligence Technologies; conduct research and studies; and measure usage and educational trends. Separate Consent shall be obtained or a specific notice shall be provided where required by the purpose, type of data, or applicable law.

Data may also be used to prepare reports, dashboards, and benchmarks; manage the commercial relationship with centers and Teachers; comply with legal and regulatory obligations; protect the rights of Edvanz and Users and defend claims; and manage financing, merger, acquisition, restructuring, or business transfer transactions.

The foregoing purposes apply where Edvanz acts as a Data Controller or has an independent legal basis. Where Edvanz acts as a Data Processor on behalf of an educational center or Teacher, its Processing shall be limited to operating the Platform, providing the service, and fulfilling the specified and declared purpose. It shall not use the data for its own marketing or commercial purposes, conduct independent analytics, or train general artificial intelligence models. Edvanz may not use Aggregated Data or Anonymized Data for its own purposes unless the data has been effectively anonymized, re-identification risks have been assessed, and the applicable legal basis and requirements have been satisfied.

Legal Basis for Processing

Personal Data subject to Egyptian law shall be processed on the basis of the express Consent of the Data Subject or the person legally representing the Data Subject, or in cases otherwise permitted by law. A natural person’s submission of data to receive a lawful service or transaction shall constitute Consent to its collection and Processing only to the extent necessary to provide that service or transaction and shall not extend to other independent purposes.

With respect to Sensitive Personal Data and Children’s Data, the specific requirements relating to express written Consent, Parent or Legal Guardian Consent, and regulatory licenses or permits shall apply. General or implied Consent shall not be sufficient for the Processing of such categories.

Where a particular Processing activity is subject to the GDPR, Edvanz may, depending on the activity, rely on Consent; performance of a contract or steps taken prior to entering into a contract; compliance with a legal obligation; protection of vital interests; or legitimate interests, following an assessment of necessity and balancing and the protection of Data Subjects’ rights, particularly Children’s rights.

Edvanz shall not use “legitimate interests” as a general, independent legal basis for Processing governed by Egyptian law except to the extent permitted by an applicable legal provision. Under the GDPR, legitimate interests shall be relied upon only where the Data Subject’s rights and fundamental freedoms do not override the interest pursued.

Data shall be used for the specified and declared purposes communicated at the time of collection. Processing for a new purpose that is incompatible with or independent from the original purpose shall not commence unless the necessary information has been provided and new Consent has been obtained, or another legal basis authorizing the new Processing is available. Withdrawal of Consent shall not affect the lawfulness of Processing carried out before withdrawal.

Children’s Data and Parent or Legal Guardian Consent

Edvanz treats Children’s Data as Sensitive Personal Data requiring a high level of protection. No account may be created for a Child, and no Child’s data may be uploaded or processed, except in accordance with the applicable legal controls and after obtaining the Consent of the Parent or Legal Guardian or legal representative where required.

For Children under fifteen years of age, express written Consent, in paper or electronic form, must be obtained from the Parent or Legal Guardian before data is collected. The Consent must specify the categories of data, the purpose of Processing, and its duration, without prejudice to the Parent or Legal Guardian’s right to amend or withdraw it.

For Children from fifteen to eighteen years of age, the Child or the Parent or Legal Guardian, as applicable, shall provide the Parent or Legal Guardian’s Consent to the collection and Processing of the Child’s data in accordance with the mechanisms and requirements adopted by the Personal Data Protection Center.

Edvanz and the Educational Service Provider shall take reasonable measures to verify the identity and capacity of the Parent or Legal Guardian and the relationship to the Child, without collecting additional data beyond what is necessary for verification, and shall retain a secure record evidencing the Consent, its date and scope, and any amendment or withdrawal thereof.

A Child’s participation in a service, activity, or competition shall not be conditioned on the provision of data exceeding what is necessary. Data collected in this context shall not be used to profile Children, track them, or monitor their behavior. Any personalization feature or educational analysis involving Children shall be subject to a prior risk assessment and safeguards designed to prevent harm to them.

The educational center or Teacher, as the Data Controller of the data it collects and uploads, shall be responsible for providing an appropriate privacy notice and obtaining the required Consents and licenses before uploading Children’s images, voices, recordings, documents, or any Sensitive Personal Data relating to them.

If Edvanz becomes aware that a Child’s data has been collected or uploaded without the required Consent or legal basis, it may restrict the account, suspend Processing, or remove the data; notify the Educational Service Provider, Parent or Legal Guardian, or competent authorities where notification is required; and take the necessary corrective measures.

Use of Data in Artificial Intelligence Technologies

Edvanz may use Artificial Intelligence Technologies to operate the Platform and provide specified features, such as searching within content, summarizing materials, generating suggestions, drafts, or supporting questions, providing educational or operational recommendations, analyzing usage and identifying patterns, and supporting automated grading in accordance with settings approved by the Educational Service Provider.

Such technologies may also be used to detect cheating, fraud, or unusual activities; improve technical support; translate, classify, or organize content; analyze errors and performance; generate synthetic data for testing; and conduct analytics aimed at improving the service, provided that the principle of data minimization is observed and no harm is caused to the Data Subject.

Inputs or content may be processed through Edvanz systems or through external artificial intelligence technology providers acting as Data Processors under written contracts. Such providers shall be required not to use the data or content to train their independent models or for their own commercial purposes and to delete or return it in accordance with the agreed periods and instructions.

Before identified data, Children’s Data, or Sensitive Personal Data is sent to an external provider, Edvanz or the Educational Service Provider shall provide a specific notice identifying the category of provider, location of Processing, purpose, data, and period, and shall obtain separate Consent and satisfy all applicable licensing, permit, and cross-border transfer requirements.

The use of artificial intelligence tools shall not result in ownership of the center’s, Teacher’s, or User’s content being transferred to Edvanz or the technology provider. Intellectual property rights shall remain subject to the terms governing use of the Platform and the rights vested in the content owner.

Training and Development of Artificial Intelligence Models

Edvanz may use effectively Anonymized Data, Aggregated Data that does not reasonably permit the identification of Data Subjects, or synthetic data to develop, test, evaluate, and improve models, algorithms, products, and services and to prepare research and benchmarks, subject to assessing re-identification risks and applying an appropriate minimum group-size threshold.

A User’s Consent to operate the Platform or receive the service shall not constitute Consent to use the User’s identified data to train a general or independent model. Edvanz shall not use Children’s Data, Sensitive Personal Data, Student answers, recordings, or private content for such purpose except for a lawful, specified, and declared purpose, on the basis of separate, demonstrable written Consent, and after obtaining all required licenses or permits.

Edvanz and its providers are prohibited from attempting to re-identify Data Subjects from Anonymized Data or combining it with other data for that purpose. The Company shall periodically review the effectiveness of anonymization methods. If a reasonable possibility of re-identification arises, the data shall be treated as Personal Data.

Artificial Intelligence Outputs and Automated Decisions

Artificial intelligence outputs may contain errors or incomplete or inaccurate information and shall not be a substitute for human or professional review. The Educational Service Provider shall be responsible for reviewing and approving content, questions, answers, grades, and educational decisions based on such tools.

Edvanz shall not make any binding educational, legal, or financial decision, or any decision materially affecting a Student, solely on the basis of automated Processing without qualified human intervention where such intervention is legally required or warranted by the nature of the decision.

The Data Subject or Parent or Legal Guardian may request understandable information regarding the general role of automated Processing in the decision, request review by a qualified person, request correction of the data used, and object to the outcome to the extent permitted by law and the nature of the service.

Analytics, Research, and Aggregated Data

Edvanz may generate indicators, analytics, statistics, and reports from the use of the Platform, such as attendance, interaction and viewing rates, feature usage, and technical performance, for the purposes of developing the Platform, improving services, and providing dashboards to centers and Teachers, in accordance with Edvanz’s legal capacity and the permitted legal basis.

Aggregated Data or Anonymized Data may be used to prepare studies, research, commercial reports, benchmarks, and measurements of education-sector and market trends, provided that the results, whether alone or combined with other information, do not reasonably permit the identification of a User, Child, or small group.

If the group size or the nature of the indicators permits the identity of a person or private information relating to that person to be inferred, the results shall be treated as Personal Data and all applicable controls shall apply. Anonymized Data may be retained for an indefinite period for as long as it remains anonymized, subject to periodic review of re-identification risks.

Direct Marketing and Personalization of Offers

Edvanz shall not send Direct Marketing communications unless it has obtained the required license from the Personal Data Protection Center and the Data Subject’s express and separate Consent to receive the specific type of communication. The Consent box shall not be preselected, and acceptance of marketing shall not be a condition for receiving a service that does not require it.

Each marketing communication shall identify Edvanz, state the marketing purpose, provide a valid means of contacting Edvanz, and include a clear and accessible mechanism for refusing messages, unsubscribing, or withdrawing Consent. Messages shall cease without delay, and marketing data shall be deleted upon withdrawal of Consent, expiry of the retention period, or cessation of the purpose, whichever occurs first.

Edvanz shall maintain a secure electronic record showing how and when Consent was obtained, its purpose, any amendment or withdrawal, and the actions taken, for three years from the date of the last marketing communication. Edvanz may retain a limited suppression list to the extent necessary to avoid sending further messages to persons who have unsubscribed.

A Student’s name, image, voice, results, educational data, or any data enabling identification shall not be used in marketing or advertising unless the Parent or Legal Guardian or legal representative has provided express, separate, specific written Consent and all required licenses and permits have been obtained. Such Consent shall not be incorporated into the Consent to use the Platform.

Use of Names, Images, and Testimonials in Marketing

Edvanz shall not use the name, trade mark, logo, testimonial, evaluation, or success story of an educational center or Teacher in client lists, informational materials, or marketing materials except pursuant to prior written authorization or Consent specifying the scope, period, and means of use, subject to withdrawal rights and removal of the content where legally possible and required.

Cookies and Similar Technologies

The Platform uses cookies, session identifiers, and similar technologies necessary to operate the website or application, maintain login status, save settings, enhance security, prevent fraud, and perform the service requested by the User. Such technologies do not require separate Consent where they are strictly necessary to provide or secure the service.

Non-essential analytics, tracking, advertisement personalization, or retargeting technologies shall not be activated before the required Consent is obtained. The User may accept or reject each category, amend the selection, and withdraw Consent as easily as it was given through the consent-management tool, without refusal of non-essential technologies affecting core services.

Edvanz shall make available a separate cookie notice or policy identifying the name or category of the technology, its provider, purpose, and duration; whether it is necessary, analytical, or marketing-related; the countries in which Processing or hosting may occur; and how it may be managed or deleted.

Data Sharing and Disclosure

Edvanz does not sell or trade Personal Data or grant third parties the right to exploit it for their independent commercial purposes in exchange for material or non-material consideration. Disclosure that is necessary to a Service Provider acting in accordance with Edvanz’s instructions, or transfer of data in connection with a lawful transaction, shall not constitute a sale, provided that the purpose, safeguards, and legal requirements are observed.

The minimum amount of data necessary for the relevant purpose may be shared with the educational center or Teacher linked to the Student’s account; the Parent or Legal Guardian; authorized personnel and supervisors; providers of hosting, cloud computing, backup, cybersecurity, email, messaging, notifications, technical support, customer relationship management, analytics, and Artificial Intelligence Technologies; and licensed payment providers when electronic payment is enabled.

Data may also be disclosed to advisers, auditors, and competent governmental, judicial, security, or regulatory authorities in compliance with a legal obligation or enforceable order, and to an actual or prospective purchaser, investor, financier, affiliate, or legal successor in connection with financing, merger, acquisition, asset sale, or restructuring, subject to confidentiality, data minimization, and appropriate legal and security due diligence.

No recipient may use the data for a purpose independent from the purpose for which it was made available unless the recipient provides the Data Subject with an appropriate notice, has an independent legal basis, and satisfies all applicable licenses, Consents, and requirements.

Service Providers and Data Processors

Edvanz selects Service Providers after assessing their ability to apply an appropriate level of security and data protection and enters into written agreements with them specifying the scope, duration, and instructions of Processing; confidentiality; security controls; incident notification; assistance to Data Subjects; retention; return or deletion of data; audit; and oversight.

A Service Provider may not appoint a Sub-Processor, transfer data to another country, or change the hosting location except in accordance with the agreement and Edvanz’s instructions and after satisfying all required Consents, licenses, or permits. The Sub-Processor shall be subject to protection obligations no less stringent than those imposed on the original Service Provider.

Edvanz shall remain responsible for the selection of and reasonable oversight over the Service Providers it appoints. Any disclaimer relating to independent third parties shall not apply to such Data Processors or Sub-Processors.

Edvanz may change Service Providers or add new providers as needed. Material categories and Processing locations shall be identified in this Policy, a separate notice, or an updated list available through the Platform where required.

Transfer of Data Outside the Arab Republic of Egypt

Edvanz may use hosting, cloud computing, support, messaging, analytics, or artificial intelligence technology providers whose systems or data centers are located outside the Arab Republic of Egypt. Data shall not be transferred, stored, processed, or made available across borders unless the required license or permit has been obtained from the Personal Data Protection Center, the Data Subject’s Consent has been obtained, and the adequacy of the level of protection in the receiving country has been verified, in accordance with the law and the Executive Regulations.

Transfers shall be limited to the countries, entities, purposes, data categories, volumes, and periods specified in the license or permit, and the license or permit shall be updated before a new country or destination is added. Encryption, access controls, binding agreements, and safeguards preventing unauthorized use shall be applied.

At the time of collection or before the transfer, the Data Subject shall be provided with a clear statement identifying the receiving country or category of countries, category of recipient, purpose of transfer, categories of data, location of temporary and final storage, retention period, available safeguards, and the means of exercising rights or withdrawing Consent.

Children’s Data and Sensitive Personal Data shall be subject to the additional requirements relating to licenses or permits, express written Consent, and Parent or Legal Guardian Consent. Data shall not be transferred to a country that does not provide the required level of protection except in the exceptional cases permitted by law and after all applicable conditions have been fully satisfied.

Edvanz shall maintain a record of transfer operations, agreements, Consents, licenses or permits, and security assessments, and shall limit transferred data to what is necessary for the specified purpose.

Data Retention Period

Edvanz retains data only for the period necessary to achieve the specified and declared purpose, provide services, comply with legal obligations, evidence transactions and rights, prevent fraud, and resolve complaints and disputes. Retention periods shall be periodically reviewed, and a longer period shall not be applied merely because the data can be retained or may potentially be useful.

Where Edvanz acts as a Data Processor, the retention period shall be determined by the purpose of Processing, the lawful instructions of the Educational Service Provider, and legal requirements. Upon termination of the service, Edvanz shall allow data to be returned or exported where the relevant feature is available and shall then delete it within a period not exceeding ninety days, unless a legal obligation, binding order, or existing dispute justifies limited retention.

Account and Identity Data Processed by Edvanz as a Data Controller: For the duration of the account’s activity and thereafter for no more than three years following closure, to the extent necessary to evidence account creation, transactions, and requests and to defend rights, unless the law requires a different period.

Student Data and Educational Files: For the duration of the service, after which they shall be returned to the Educational Service Provider or made available for export where the relevant feature is available, and then deleted in accordance with the purpose and retention periods set out in this Policy. Edvanz shall not retain such data for independent purposes after the relationship ends.

Attendance, Tests, Assignments, and Grades: In accordance with the retention schedule determined by the Educational Service Provider in its capacity as Data Controller and within the limits of the educational purpose and legal obligations, after which they shall be deleted or anonymized. Edvanz shall not determine an independent retention period for such data when acting as a Data Processor.

Educational Fees and Collection Records: In accordance with the Educational Service Provider’s instructions and for the period necessary to manage the relationship and evidence the records, noting that Edvanz is not the issuer of educational invoices or receipts. Edvanz subscription invoices and transactions shall be retained for the accounting and tax period prescribed by law.

Records of Acceptance of Terms and Consents: For the duration of the related Processing and thereafter for the period necessary to evidence compliance and rights. Records of marketing Consent, and any amendment or withdrawal thereof, shall be retained for three years from the date of the last marketing communication.

Backups: Deleted data may remain in backups for a technical period not exceeding ninety days from its deletion from active systems, unless continued retention relates to a legal obligation, security incident, dispute, or investigation. It shall not be restored for new operational purposes.

Support Requests and Complaints: For three years from the date the request or complaint is closed, unless a dispute or legal obligation requires a different period.

Technical and Login Records: For twelve months, which may be extended to the extent necessary where they relate to a security incident, investigation, or ongoing dispute.

Security Incident Records: For five years from the date the incident is closed, or for the period prescribed by law or the competent authority.

Marketing and Preference Data: Until Consent is withdrawn, the purpose ceases, or two years of inactivity have elapsed, whichever occurs first, after which the data shall be deleted or anonymized, while retaining the record of Consent or refusal for the period specified above.

Pseudonymized Data Used for Development and Artificial Intelligence: Only for the duration of the specified project or test, after which it shall be deleted or converted into effectively Anonymized Data. A single open-ended period shall not apply to all development projects.

Aggregated Data or Anonymized Data: May be retained for an indefinite period for as long as it remains anonymized and does not reasonably permit identification of Data Subjects, subject to periodic review of re-identification risks.

Upon expiry of the retention period, the data shall be deleted, anonymized, or isolated from ordinary use. Where retention is required to evidence a right or comply with a legal obligation, access shall be limited to the legal purpose and the data shall not be used for a new purpose.

Edvanz shall notify the Data Subject or the Educational Service Provider of completion of erasure or return of the data where notification is legally required, subject to data temporarily remaining in backups.

Data Security

Edvanz implements appropriate technical and organizational measures to protect data against unauthorized access, use, disclosure, alteration, loss, or destruction. Such measures may include encryption of communications, password hashing, access control, account segregation, logging of sensitive activities, backups, system monitoring, software updates, and vulnerability management.

The measures may also include multi-factor authentication where available, restriction of access by personnel and Service Providers, periodic review of permissions, incident response plans, security testing, and disaster recovery.

Notwithstanding the implementation of appropriate measures, absolute security cannot be guaranteed for any electronic system. The User shall protect login credentials, refrain from sharing them, and notify Edvanz immediately upon suspecting that the account has been compromised.

Privacy by Design and Data Protection Impact Assessment

Edvanz applies privacy by design and by default by minimizing data, assigning permissions according to actual need, configuring default settings to the minimum level of collection and sharing, and reviewing new features before launch.

Edvanz conducts a data protection impact assessment before Processing activities that are likely to involve high risks, particularly large-scale use of biometric data or Children’s Data; monitoring and tracking; automated grading and decision-making; artificial intelligence; or cross-border data transfers. Corrective measures shall be implemented before Processing begins.

Data Incidents and Breaches

Upon discovering a breach or violation that may affect the confidentiality, integrity, or availability of Personal Data, Edvanz shall investigate and contain the incident, mitigate its effects, restore systems, preserve evidence and records, and assess the nature of the data, the number of affected Data Subjects, and the potential harm.

Edvanz, in its capacity as Data Controller or Data Processor as applicable, shall notify the Personal Data Protection Center within seventy-two hours from becoming aware of the breach or violation. Notification shall be immediate if the incident relates to national-security protection considerations. Edvanz shall also notify affected Data Subjects within three business days from the date on which the Center is notified, specifying the nature of the incident, the potential effects, and the security and corrective measures, in accordance with the law and the Executive Regulations.

Where Edvanz acts as a Data Processor, it shall notify the Educational Service Provider of the incident immediately upon becoming aware of it and shall assist with the investigation, notification, and implementation of corrective measures. The educational center or Teacher shall notify Edvanz immediately of any breach, disclosure, or unauthorized use of data entered or uploaded by it.

Edvanz shall maintain a record of incidents, decisions, notifications, and actions taken and may require the User to change the password, log out of devices, or take additional measures to protect the account.

Rights of Data Subjects

The Data Subject, Parent or Legal Guardian, or legal representative, as applicable, may request to be informed of the Personal Data being processed; inspect, access, or obtain it; withdraw Consent; request correction, amendment, completion, updating, or erasure; restrict Processing to a specified scope; be informed of any breach or violation; and object to the Processing or its results where it conflicts with the Data Subject’s rights and fundamental freedoms.

A review of any material decision based primarily on automated Processing may also be requested, and a complaint may be submitted to Edvanz, the Personal Data Protection Center, or the competent authority. Rights are subject to verification of identity and capacity and to legal exceptions and limitations. Complete erasure may not be possible where retention is necessary to comply with a legal obligation, evidence a right, or address an existing dispute.

Edvanz shall examine the request and respond within six business days from the date it receives a complete request containing the necessary information and documents. If the request is refused in whole or in part, reasons shall be provided, without prejudice to the applicant’s right to submit a complaint or refer the matter to the competent authority.

Submitting Privacy Requests and Withdrawing Consent

Requests to exercise rights or withdraw Consent, and privacy inquiries and complaints, shall be sent to: [email protected]. The request shall state the applicant’s name, contact details, account type, capacity in relation to the Student where applicable, and a clear description of the request and the data concerned.

Edvanz may request appropriate information or documents to verify the identity and legal capacity of the applicant before disclosing, amending, or deleting data, limited to what is necessary for verification. Any required supplementation shall be requested without delay, and the request for supplementation shall not extend the response period except to the extent permitted by law.

Withdrawal of Consent shall not affect the lawfulness of Processing conducted before withdrawal and may make a particular feature unavailable where the data subject to Consent is necessary for that feature. Student Data shall not be disclosed, amended, or deleted at the request of a Parent or Legal Guardian until that person’s capacity and legal entitlement have been verified.

Additional Provisions Where the GDPR Applies

Where the GDPR applies to a particular Processing activity, the Data Subject shall, subject to the conditions applicable to each right, have the right to restrict Processing, data portability, object to Processing based on legitimate interests or marketing, not be subject to a decision based solely on automated Processing that produces legal effects or similarly significant effects, and lodge a complaint with the competent supervisory authority.

In the privacy notice applicable to the relevant activity, Edvanz shall specify the legal basis under the GDPR, retention period, recipients, international-transfer safeguards, and the details of its representative in the European Union or European Economic Area where appointment of a representative is required, and shall respond to requests within the periods prescribed by the GDPR.

Responsibilities of Educational Centers and Teachers

The educational center or Teacher, in its capacity as Data Controller of the data it collects or uploads, shall be responsible for the lawfulness of collection, determining the purposes, providing the privacy notice, obtaining Consents and licenses or permits, verifying and updating data accuracy, and determining retention periods.

The Educational Service Provider shall collect only necessary data, specify the purposes of use clearly and lawfully, refrain from using or requesting Processing for an undeclared or unlawful purpose, and provide Edvanz with the information necessary to operate the Platform and implement Data Subjects’ rights and legal obligations.

The Educational Service Provider shall also assign personnel and supervisor permissions on a need-to-know basis, obtain confidentiality undertakings, review and revoke permissions immediately when the need or employment relationship ends, and refrain from sharing login credentials or creating shared accounts that cannot be traced.

The Educational Service Provider shall not upload Children’s images, voices, recordings, documents, or Sensitive Personal Data unless all applicable Consents, licenses, and special controls have been satisfied. It shall notify Edvanz immediately of any breach or unauthorized use and cooperate in relation to requests, incidents, and investigations.

Edvanz’s provision of tools for collecting, uploading, or hosting data shall not constitute approval of the lawfulness of the data or release the Educational Service Provider from its responsibilities, nor shall the Educational Service Provider release Edvanz from its independent responsibilities as a Data Processor or Data Controller.

Account Closure and Termination of the Relationship

The User may request closure of the account through the settings or by contacting technical support. Implementation may require verification of identity or the Parent or Legal Guardian’s capacity in accounts belonging to minors.

Account closure does not mean that all data will be deleted immediately where limited retention is necessary to comply with a legal obligation, evidence a transaction, prevent fraud, resolve a dispute, or protect a right, provided that the data is isolated and not used for a new purpose.

Upon termination of the relationship between Edvanz and the Educational Service Provider, the Educational Service Provider’s access to the Platform shall be suspended or restricted. Edvanz shall allow the data to be exported where the relevant feature is available and shall then return or delete the data in accordance with the retention periods set out in this Policy and applicable legal requirements. The Educational Service Provider shall be responsible for requesting export before the available period expires.

Deleted data may temporarily remain in backups until replaced or deleted in accordance with the backup cycle, without being used for new operational purposes and without exceeding the period specified in this Policy.

Service Notifications and Electronic Communications

Edvanz may use contact data to send necessary messages relating to the account, security, attendance, tests, results, fees, content, and technical updates.

Such messages shall not constitute Direct Marketing, and it may not be possible to stop some of them where they are necessary to operate or protect the account. The User shall be responsible for updating contact details and reviewing notifications.

Third-Party Links and Services

The Platform may contain links to or integrations with independent websites, applications, or services with which the User chooses to deal directly. Data submitted directly by the User to such parties shall be subject to their respective privacy policies.

Edvanz shall not be responsible for the practices of an independent third party that is not subject to its selection or control, and the User should review such third party’s policies before submitting data. This disclaimer shall not extend to Service Providers or Data Processors appointed by Edvanz to process data on its behalf, as Edvanz shall remain responsible for their selection, contracting, and oversight to the extent prescribed by law.

Transfer of the Company or Business

Data may be transferred in connection with a merger, acquisition, investment, financing, asset sale, restructuring, or transfer of operation of the Platform to an affiliate or legal successor.

The receiving party must use the data in accordance with lawful purposes and legal safeguards, and Data Subjects shall be notified or required Consents obtained where required by law.

Amendments to the Privacy Policy

Edvanz may amend this Policy when services are developed, new features are added, Artificial Intelligence Technologies, analytics tools, or payment methods are used, or a legal or regulatory change occurs.

The updated version shall be published on the Platform, specifying the version number, date of last update, and effective date. The User may be notified of material amendments through the account, email, telephone, or any appropriate means.

If an amendment introduces a new purpose requiring separate Consent, such Consent shall be requested before the new Processing begins. Prior Consent shall not automatically constitute Consent to new incompatible purposes.

Governing Law and Submission of Complaints

This Policy shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, particularly legislation governing Personal Data protection, electronic transactions, communications, and information technology, without prejudice to foreign laws applicable to a specific Processing activity.

No provision of this Policy shall prejudice any right of a Data Subject that may not be waived, derogated from, or diminished by agreement. Complaints or inquiries may be submitted to Edvanz using the contact details below, without prejudice to the right to lodge a complaint with the Personal Data Protection Center or the competent supervisory authority or to resort to the courts.

Regulatory Licenses, Permits, and Records

Edvanz shall obtain the required regulatory licenses, permits, or approvals before undertaking the collection, storage, Processing, or cross-border transfer of data; Processing Sensitive Personal Data or Children’s Data; or conducting electronic Direct Marketing, according to the nature of each activity.

Edvanz shall maintain a Controller register, a register of Processing activities, and any registers relating to Consents, incidents, cross-border transfers, marketing, and Sensitive Personal Data; keep them updated and protected; and make them available to the Personal Data Protection Center upon request. No feature requiring a specific license or permit shall be activated before that requirement has been satisfied.

Data Protection Officer

Edvanz shall appoint a qualified Data Protection Officer and register the officer in the designated register maintained by the Personal Data Protection Center in accordance with the legal requirements and timelines, and shall provide the officer with the necessary independence and resources. The officer shall monitor compliance, review policies, records, and security measures, receive requests and complaints, coordinate in relation to breach incidents, and act as the point of contact with the Center.

Privacy matters and the Data Protection Officer may be contacted at [email protected] or through the Company’s registered address stated in this Policy.

Contact Details

Legal Name: Edvanz for Information Technology Industry L.L.C.

Commercial Registry: Cairo Investment Commercial Registry No. (290277)

Address: Office H27 – 52 Al Tayaran Main Street, opposite the Health Insurance Hospital, Nasr City, Cairo, Arab Republic of Egypt

General Email Address: [email protected]

Technical Support Email Address: [email protected]

Privacy and Data Protection Officer Email Address: [email protected]

Legal Affairs Email Address: [email protected]

Technical Support Working Hours: Sunday through Thursday, from 10:00 a.m. to 6:00 p.m. Cairo time, excluding official holidays.

Acknowledgment of Review and Separate Consents

By selecting the “I have read the Privacy Policy” checkbox, the User acknowledges that this Policy has been made available and that the User has been able to read it and understand the categories of data, purposes of Processing, recipients, and the User’s rights. This acknowledgment shall not, in itself, constitute bundled Consent to all optional Processing activities.