This agreement forms part of the terms of use between the center and Afaq Digital Ltd. It covers the personal data the center enters or collects about its customers through the platform. Article 28 of the UK GDPR applies to it, as do any other data protection laws that bind the center in its own country.
01Roles
- The center is responsible for its customers' data (the controller) and decides why it is collected and how it is used.
- Afaq processes that data only on the center's behalf (the processor), and only to provide the service.
02The data covered
- Data subjects: visitors to the center's site, people who send booking requests, parents, students and the center's staff.
- Types of data: names, mobile numbers and email addresses, booking and enrolment details, groups and attendance, invoices and payments, messages, AI assistant chats, and any other data the center chooses to enter.
- Children's data: this may include data about students who are minors; the center is responsible for getting a parent's consent where it is needed.
- Duration: for as long as the center's subscription lasts, then as set out in section 08.
03Afaq's obligations
- We process the data only on the center's documented instructions; this agreement and the platform settings are those instructions. If we believe an instruction breaks the law, we will tell the center.
- Everyone working for us who can reach the data is bound by confidentiality.
- We apply appropriate security measures, including encryption in transit, separation of each center's data, limited access rights, daily backups and records of important actions.
- We help the center, as far as reasonable, to answer its customers' requests about their rights, with impact assessments and with dealing with the authorities.
- We tell the center without undue delay, and at the latest within 72 hours of becoming aware, of any breach affecting its data, with the information we have.
- We give the center the information it needs to show we comply with this agreement, and accept reasonable audits with suitable notice.
04The center's obligations
- To have a lawful basis for collecting the data, and to tell its customers about it through the privacy and terms pages on its site.
- To get the consents needed, including recipients' agreement before WhatsApp messages and a parent's consent for data about minors.
- Not to enter sensitive data that is not needed, such as health data, unless it has a clear lawful basis for it.
05Sub-processors
The center agrees to our use of the sub-processors below. We will tell the center at least 30 days before adding or replacing one. The center may object on reasonable grounds; if we cannot resolve the objection, the center may cancel its plan. We bind every sub-processor to data protection terms equivalent to this agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Server hosting and backups | European Union |
| Stripe | Processing online payments through the payment links the center sends from its dashboard, if it uses them | European Union and United States |
| Meta Platforms (WhatsApp) | Delivering the WhatsApp messages the center sends | Several countries, including the United States |
| Anthropic | The AI assistant on the center's site, if turned on | United States |
| Google Fonts | Loading the fonts of the center's site template; receives the visitor's IP address and browser type | Several countries, including the United States |
| Afaq Digital's email | Sending system emails from the company's own email | As set by the company's email provider, named in the privacy policy on the company's website |
06International transfers
Where data is transferred to a country the UK does not recognise as providing adequate protection, the transfer relies on the UK Extension to the EU-US Data Privacy Framework or on the contractual clauses approved for transfers from the UK.
07Requests from data subjects
If one of the center's customers contacts us directly about their data, we pass the request to the center and do not answer it ourselves unless the center instructs us or the law requires it. The center's dashboard gives it the tools to correct, delete and export the data.
08End of the service
When the subscription ends or the account is closed, the center can download its data within 30 days. After that we delete it, and it is gone from backups within a further 14 days, except what the law requires us to keep, such as invoices issued by the platform.
09Order of precedence
If this agreement and the terms of use conflict on personal data, this agreement prevails.