Data Processing Agreement
ASABYA-IC3-DPA-v2.0
This Data Processing Agreement (the "Agreement") is between International Strategic Solutions Investment LLC (Commercial Registration 1609049), operating Asabya Academy from the Sultanate of Oman ("Asabya", the "Processor"), and the School identified in the e-signature record below (the "Controller").
This Agreement governs Asabya's processing of personal data on behalf of the School in connection with the School's use of the Asabya Academy platform (the "Platform"), as required by the Oman Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulations (the "Oman PDPL").
1. Definitions
Terms used in this Agreement (including "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Personal Data Breach", and "Sub-processor") have the meanings given in the Oman PDPL.
2. Roles and Scope
The School is the Controller of Personal Data processed under this Agreement. Asabya is the Processor. The categories of Data Subjects and Personal Data are set out in Annex A.
The School is responsible for obtaining all consents required under applicable law from Data Subjects (or, in the case of minors, their parents or legal guardians) before instructing Asabya to process their Personal Data. The School's consents must cover cross-border transfer.
3. Asabya's Obligations
3.1 Asabya processes Personal Data only as needed to operate the Platform.
3.2 Asabya keeps Personal Data confidential and ensures personnel with access are bound by confidentiality.
3.3 Asabya applies reasonable security measures appropriate to the risk.
3.4 If Asabya becomes aware of a Personal Data Breach, it will notify the School without undue delay.
3.5 Asabya provides the School with administrator tools to respond to Data Subject access, correction, and deletion requests.
3.6 Asabya engages Sub-processors to operate the Platform. Categories are listed in Annex B; the current named list is published at academy.asabya.com/sub-processors. Asabya will notify the School of changes.
3.7 Personal Data may be processed outside the Sultanate of Oman or the School's country, in the regions identified in Annex B.
4. Termination and Data
The School may terminate at any time by written notice to academy@asabya.com.
On termination, Asabya will delete the School's data within a reasonable period, except for individual Data Subject records (Certificates of Completion and their substantiating records) which Asabya preserves as personal data of the individual Data Subject, separately from this Agreement.
Backups may retain Personal Data for a limited period after deletion, after which they are overwritten.
5. Liability
To the maximum extent permitted by applicable law:
(a) Asabya's total aggregate liability to the School under this Agreement is limited to OMR 100 (one hundred Omani Rials).
(b) Neither Party is liable to the other for indirect, consequential, incidental, special, or punitive damages.
(c) Each Party is responsible for any fines or penalties imposed on it by a regulator. Neither Party indemnifies the other for regulatory liability.
(d) Nothing in this Agreement limits a Data Subject's rights under applicable law.
6. Governing Law
This Agreement is governed by the laws of the Sultanate of Oman, and the courts of the Sultanate of Oman have exclusive jurisdiction.
7. Amendments
Asabya may amend this Agreement to reflect changes in law, on notice to the School.
8. Contacts
| Role | Contact |
|---|---|
| General | academy@asabya.com |
| Data Protection | privacy@asabya.com |
| Breach reporting | privacy@asabya.com |
9. Execution
This Agreement is executed electronically. The School's authorised representative confirms acceptance by completing the e-signature flow on the Asabya Academy Platform.
Annex A — Personal Data Processed
Data Subjects: students enrolled by the School; parents or legal guardians of those students; instructors and administrators authorised by the School.
Personal Data: Identity data (name, email, phone where provided, date of birth and year level for students), educational records (enrolments, progress, quiz attempts, scores, badges, points, certificates and their substantiating records), platform activity (in-platform messages, activity timestamps), authentication credentials.
Sensitive Personal Data: Asabya does not process Sensitive Personal Data. The School undertakes not to upload such data to the Platform.
Annex B — Sub-processors
The current Sub-processor register is published at academy.asabya.com/sub-processors and identifies named processors, processing regions, and roles. Categories include database hosting and authentication, application hosting and content delivery, transactional email, DNS and edge security, encrypted off-site backup storage, and automated backup processing.
E-signature Record
(Populated automatically at execution.)
| Field | Source |
|---|---|
| School (legal name) | School registration record |
| School country | School registration record |
| Authorised signatory (name) | Confirmed at signing |
| Authorised signatory (role) | Confirmed at signing |
| Authorised signatory (email) | Confirmed at signing |
| Date of execution | Server-stamped at signing |
| IP address of execution | Captured at signing |
| DPA version | ASABYA-IC3-DPA-v2.0 |
| DPA SHA-256 hash | Computed at signing |
For Asabya:
| Field | Value |
|---|---|
| Entity | International Strategic Solutions Investment LLC |
| CR Number | 1609049 |
| Data Protection Officer | privacy@asabya.com |
End of Data Processing Agreement — ASABYA-IC3-DPA-v2.0