Data processing
These terms apply between Athar and each school that uses it, as part of the school’s agreement. Schools that need a signed copy can ask us.
Roles and purpose
The school is the controller of personal data its staff put into Athar; Athar is the processor. We process it only to provide Athar (collecting, reviewing, organising and exporting staff work and growth records) and only on the school’s documented instructions, which include using the product’s features.
Data and people
People: school staff (teachers, Heads of Department, managers) and, only where included in work samples, students. Data: names, email addresses, roles and subjects; work files, notes, reviews, standards tags, goals, training and observation records; sign-in and security logs.
Our commitments
- People who can access the data are bound to confidentiality, and access is limited to what support requires (logged “log in as” that ends after 30 minutes).
- We keep the security measures described under Security and improve them over time.
- We use the sub-processors listed below and tell school managers by email at least 30 days before adding or replacing one, so they can object.
- We help the school answer data-subject requests (access, copy, correction, deletion) and data protection assessments.
- We tell the school about a personal-data breach without undue delay and within 48 hours of becoming aware of it, with what we know and what we are doing.
- When the agreement ends, the school can download its data (Admin export) and we delete it within 30 days, and from backups within a further 30 days, unless the law requires us to keep it.
- We give the school the information needed to show compliance and answer reasonable audit questions.
- Transfers outside Saudi Arabia happen only as the PDPL and its regulations allow (and, for EU schools, under appropriate GDPR safeguards).
Sub-processors
| Provider | What for | Where |
|---|---|---|
| Hostinger | Hosting, database, file storage, email | Germany (EU) |
| GitHub (Microsoft) | Encrypted database backups (30 days), code deployment | United States |
| PayPal | Online payments (only for departments that pay online) | Global |
| Sign-in, and Google Drive storage when a school connects it | Global | |
| Microsoft | Sign-in, and OneDrive storage when a school connects it | Global |
| Have I Been Pwned | Checking new passwords against known breaches (only the first 5 characters of a hash are sent) | Global |
Who we are
Athar
Contact: hello@example.com