Data processing agreement

1. Agreement, roles and priority

This data processing agreement (DPA) forms part of the Riwaq customer terms between the subscribing organisation (the customer) and AML SOLUTIONS LTD, company number 17075113, 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. It applies when we process personal data on the customer’s behalf, for as long as we hold that data, including the exit period. The customer is the controller and we are its processor, or the equivalent service provider under applicable US state privacy law.

Applicable data protection law includes the UK GDPR and Data Protection Act 2018, and the EU GDPR or US state privacy laws where they apply to the processing. This DPA takes priority over conflicting customer terms about processing customer personal data. Mandatory law and any applicable, validly completed international transfer clauses take priority over both. Nothing in the customer terms limits individuals’ mandatory data protection rights.

Our separate use of account, subscription and direct support records for our own business purposes is described in our privacy policy.

2. Processing schedule and instructions

• Subject matter and purpose: hosting and operating Riwaq’s registration, teaching administration, attendance, communications, safeguarding records and fee administration for the customer.
• Operations and frequency: collection, recording, organisation, storage, retrieval, display, amendment, transmission, export, restriction and deletion, on an ongoing basis as users use the service.
• People: pupils or students, applicants, parents and guardians, emergency contacts, teachers, administrators and other authorised staff.
• Data: names, contact details, family relationships, registration information, attendance, lessons, homework, progress, behaviour, messages, files, payment references and fee records.
• Sensitive information: health and learning needs, religious information, and safeguarding or child-protection records, including allegations or criminal-offence information where lawfully entered. Access must be limited to staff with a need to know.
• Duration: the subscription and exit period described in section 6 of the customer terms, with restricted retention only where lawful and necessary.
• Customer and contact: the subscribing organisation identified in its account and subscription records; its verified administrator is the operational contact. Data protection instructions can be sent to contact@riwaq.uk.

We process personal data only on documented instructions, including this DPA, the customer terms and authorised actions in Riwaq. Instructions include any international transfers. If law requires other processing, we will notify the customer before processing unless prohibited by law. We will promptly tell the customer if we consider an instruction unlawful. Changes outside the agreed service require written agreement; they do not permit us to disregard mandatory processor duties.

The customer must provide required privacy information, identify lawful bases and any conditions for health, religion, safeguarding or criminal-offence information, and collect only information it needs. The customer manages user permissions and the security of its devices and downloaded exports. Our own duties under this DPA continue to apply.

3. Confidentiality and security measures

People we authorise to handle customer data must be bound by confidentiality. We maintain technical and organisational measures appropriate to the nature of the data and the risks to individuals. We may improve those measures without materially reducing the overall protection.

• Encrypted HTTPS connections to the application, protected authentication sessions, verified email accounts and mandatory two-factor verification for staff access.
• Role-based access and organisation-scoped authorisation checks, with additional restrictions for safeguarding information and private support pictures.
• Restricted, logged support access; private support conversations are accessible to the requester and authorised Riwaq staff and are excluded from school-wide exports.
• Input and upload validation, limits on sensitive operations, and operation references that help prevent duplicate financial and messaging actions.
• Verified-owner checks and private, time-limited links for departure exports, with controlled deletion and legal-hold review.

The customer should review these measures for its setting, restrict sensitive records and tell us promptly about suspected compromise. No internet service can guarantee absolute security.

4. Breaches and assistance

We will notify the customer without undue delay after becoming aware of a personal-data breach affecting its data. We will provide the nature of the breach, affected data and people where known, likely consequences, a contact point and measures taken or proposed. We may provide information in stages as it becomes available and will cooperate with investigation and mitigation. The customer decides and meets its own notification duties; our assistance does not remove duties imposed directly on us.

Taking account of the processing and information available to us, we will assist with individual rights requests, security obligations, data protection impact assessments and prior consultation with regulators. If a request about customer-controlled records reaches us directly, we will promptly refer it to the customer and help it respond, unless law requires a different response. Any separate optional work and its price must be agreed before it is undertaken; mandatory assistance is not conditional on accepting an unagreed fee.

5. Subprocessors and international transfers

The customer gives general written authorisation for third-party hosting, data storage, account authentication and security, payment processing, email and SMS delivery providers, where available under the customer’s plan and region and where they process data on its behalf. A payment provider’s independent-controller activity is covered by its own notice. Email contact@riwaq.uk for the current providers’ identities, functions, locations and transfer safeguards. Public website statistics are separate from processing school records.

We will give the administrator at least 30 days’ written notice before adding or replacing a subprocessor, identifying the provider, location and work involved. The customer may object during that period on reasonable data protection grounds. We will work with it to address the concern before the change affects its data. If it cannot be resolved, we will discuss an alternative or termination of the affected service under the customer terms. We impose equivalent data protection duties by written contract and remain responsible for the subprocessor’s performance.

For a restricted transfer outside the UK, EEA or another protected jurisdiction, we will use a valid mechanism required by applicable law, such as an adequacy decision, the EU Standard Contractual Clauses, a UK International Data Transfer Agreement or UK Addendum, with required assessments and supplementary measures. Details and copies of relevant safeguards are available on request, subject to appropriate protection of confidential information. The relevant transfer arrangements are documented separately for the providers and processing concerned.

6. Information, audits and compliance

We will make information reasonably needed to demonstrate compliance available to the customer and allow and contribute to reasonable audits and inspections by it or an independent auditor it appoints. Arrangements must protect other customers’ data and system security. Reasonable notice and confidentiality terms do not prevent an urgent or legally required audit, regulator access or an individual’s mandatory rights. We will inform the customer if we can no longer meet an applicable processing obligation and cooperate to stop and remedy unauthorised processing.

7. Return, deletion and surviving duties

At the customer’s choice, we will return or delete its personal data when the service ends, unless law requires storage. The default instruction is the private CSV export followed by deletion under section 6 of the customer terms. Contact us before deletion for another lawful return format or instruction. A customer must preserve records it needs for its own educational, safeguarding or legal duties. Data already deleted cannot be restored by restarting a subscription.

Any retained exception must have a documented lawful reason, restricted access and a review of when deletion is due. Backup copies remain protected, are put beyond routine use and expire through their normal cycle. On request, we will provide information confirming completed deletion or explaining a remaining lawful exception. This DPA continues to protect data for as long as we or our subprocessors retain it.

8. US state service-provider restrictions

Where US state privacy law applies, we act only for the limited and specified service purposes in section 2. We will comply with applicable processor, contractor or service-provider obligations and provide the level of privacy protection that law requires. We do not sell customer personal information, share it for cross-context behavioural advertising, use it outside the direct customer relationship, or combine it with information from other customers or our own interactions except where law permits and necessary to provide the service. We understand and will comply with these restrictions.

The customer may take reasonable steps to check compliance and, on notice, stop and remedy unauthorised use. Our confidentiality, rights-assistance, subcontracting, security, audit and return/deletion duties also apply to this processing. We do not use customer personal data for general-purpose AI model training or our own targeted advertising.

9. Children and education records

Riwaq’s accounts and portals are for authorised staff, parents and guardians; they handle records about children. The customer must identify any educational-record, parental-notice or consent requirements for its setting. Where a US school’s authorisation is legally available for an educational service, it is limited to the educational purpose and does not authorise unrelated commercial use. We will cooperate with lawful access, correction and deletion requests. Use of this DPA alone does not establish a school’s eligibility for an exception or certify compliance with FERPA, COPPA or another education law.