Data Processing Agreement
ASABYA-IC3-DPA-v2.3
This Data Processing Agreement (the "Agreement") is between International Strategic Solutions Investment LLC (Commercial Registration 1609049), operating Asabya Academy from the Sultanate of Oman ("Asabya", the "Processor"), and the School identified in the e-signature record below (the "Controller").
This Agreement governs Asabya's processing of personal data on behalf of the School in connection with the School's use of the Asabya Academy platform (the "Platform"), as required by the Oman Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulations (the "Oman PDPL").
1. Definitions
Terms used in this Agreement (including "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Personal Data Breach", and "Sub-processor") have the meanings given in the Oman PDPL.
2. Roles and Scope
The School is the Controller of Personal Data processed under this Agreement. Asabya is the Processor. The categories of Data Subjects and Personal Data are set out in Annex A.
The School is responsible for obtaining all consents required under applicable law from Data Subjects (or, in the case of minors, their parents or legal guardians) before instructing Asabya to process their Personal Data. The School's consents must cover cross-border transfer.
3. Asabya's Obligations
3.1 Asabya processes Personal Data only as needed to operate the Platform.
3.2 Asabya keeps Personal Data confidential and ensures personnel with access are bound by confidentiality.
3.3 Asabya applies reasonable security measures appropriate to the risk.
3.4 If Asabya becomes aware of a Personal Data Breach, it will notify the School without undue delay.
3.5 Asabya provides the School with administrator tools to respond to Data Subject access, correction, and deletion requests.
3.6 Asabya engages Sub-processors to operate the Platform. Categories are listed in Annex B; the current named list is published at academy.asabya.com/sub-processors. Asabya will notify the School of changes.
3.7 Personal Data may be processed outside the Sultanate of Oman or the School's country, in the regions identified in Annex B.
3.8 Asabya does not use the School's Personal Data to train, fine-tune, or otherwise develop machine learning or artificial intelligence models, whether its own or a third party's. Where the Platform uses an artificial intelligence service to produce output for the School, the School's Personal Data is sent only to produce that output and is not retained by that service to train its models; that service is named in the Sub-processor register published at academy.asabya.com/sub-processors. Artificial intelligence document assistance is disabled until an administrator of the School enables it.
4. Termination and Data
The School may terminate at any time by written notice to academy@asabya.com.
On termination, Asabya will delete the School's data within a reasonable period, except for individual Data Subject records (Certificates of Completion and their substantiating records) which Asabya preserves as personal data of the individual Data Subject, separately from this Agreement.
Backups may retain Personal Data for a limited period after deletion, after which they are overwritten.
5. Liability
To the maximum extent permitted by applicable law:
(a) Asabya's total aggregate liability to the School under this Agreement is limited to OMR 100 (one hundred Omani Rials).
(b) Neither Party is liable to the other for indirect, consequential, incidental, special, or punitive damages.
(c) Each Party is responsible for any fines or penalties imposed on it by a regulator. Neither Party indemnifies the other for regulatory liability.
(d) Nothing in this Agreement limits a Data Subject's rights under applicable law.
6. Governing Law
This Agreement is governed by the laws of the Sultanate of Oman, and the courts of the Sultanate of Oman have exclusive jurisdiction.
7. Amendments
Asabya may amend this Agreement to reflect changes in law, on notice to the School.
8. Contacts
| Role | Contact |
|---|---|
| General | academy@asabya.com |
| Data Protection | privacy@asabya.com |
| Breach reporting | privacy@asabya.com |
9. Execution
This Agreement is executed electronically. The School's authorised representative confirms acceptance by completing the e-signature flow on the Asabya Academy Platform.
Annex A — Personal Data Processed
Data Subjects: students enrolled by the School; parents or legal guardians of those students; instructors and administrators authorised by the School.
Personal Data: Identity data (name, email, phone where provided, date of birth and year level for students), educational records (enrolments, progress, quiz attempts, scores, badges, points, certificates and their substantiating records), platform activity (in-platform messages, activity timestamps), authentication credentials.
Sensitive Personal Data: Save for the single category permitted below, Asabya does not process Sensitive Personal Data, and the School undertakes not to upload such data to the Platform.
Permitted category — vulnerable-group status. Where the School chooses to use the Platform's vulnerable-groups records to prepare inspection or self-evaluation evidence, the School may record that a student, identified only by the School's own internal reference, belongs to one of the following groups: special educational needs, English as an additional language, gifted, at risk, grade repeater, or a group the School itself labels as other. To the extent that this constitutes Sensitive Personal Data, the School instructs Asabya to process it, and Asabya processes it, for the sole purpose of producing that evidence for the School and its regulator.
For this purpose the Platform stores only the group, the academic year, and the School's own student reference. The School must not enter any diagnosis, medical or clinical record, assessment or psychological report, or similar detail, whether in the free-text notes field or anywhere else, and Asabya neither requests nor requires it. This category is processed only for a School that uses those records, is subject to clause 3.8, and no other Sensitive Personal Data may be uploaded to the Platform.
Annex B — Sub-processors
The current Sub-processor register is published at academy.asabya.com/sub-processors and identifies named processors, processing regions, and roles. Categories include database hosting and authentication, application hosting and content delivery, transactional email, DNS and edge security, encrypted off-site backup storage, automated backup processing, and artificial intelligence document assistance and in-platform assistant services.
E-signature Record
(Populated automatically at execution.)
| Field | Source |
|---|---|
| School (legal name) | School registration record |
| School country | School registration record |
| Authorised signatory (name) | Confirmed at signing |
| Authorised signatory (role) | Confirmed at signing |
| Authorised signatory (email) | Confirmed at signing |
| Date of execution | Server-stamped at signing |
| IP address of execution | Captured at signing |
| DPA version | ASABYA-IC3-DPA-v2.3 |
| DPA SHA-256 hash | Computed at signing |
For Asabya:
| Field | Value |
|---|---|
| Entity | International Strategic Solutions Investment LLC |
| CR Number | 1609049 |
| Data Protection Officer | privacy@asabya.com |
End of Data Processing Agreement — ASABYA-IC3-DPA-v2.3