Organization Data Processing Agreement
Version: 2026-10-15-review-3 · Effective date: October 15, 2026
Parties and contact
Soteria is currently operated by Daniel Ashraf Ekdawi, an individual based in Cairo, Egypt. Legal/contact address: 1 Amin Al Shamsi Basha Street, Hegaz Square, Heliopolis, Cairo, Egypt. Privacy/legal contact: [email protected]. No incorporated or registered business status is asserted. This DPA is accepted by an authorized Account for the identified Organization. It does not make every member an Account holder or an individual contracting party.
Scope and instructions
This DPA applies when an authorized Account accepts it for an Organization. The Organization determines the purposes and permitted participants of its community activities; Soteria processes its scoped data to provide the selected functions on documented instructions through authorized settings and support requests. Soteria separately operates Account security, service protection and its own contractual records.
Processing schedule
Processing lasts while providing the service and during justified retention/recovery. It covers storage, organization, retrieval, display, communication, export and deletion of Person/Profile information, membership/roles, attendance/activity, media, locations, custom fields, reservations and communications as enabled. Subjects include members, staff, guests, guardians and children where lawfully authorized. Sensitive religious or child information requires special care and applicable authorization.
Organization and Soteria duties
The Organization must provide notices, establish lawful authority, verify guardian consent, limit collection and keep access assignments accurate. Soteria applies scoped access, Account security and private-file authorization, and restricts operational access to what is necessary. Neither side may instruct unlawful processing. Report suspected incidents promptly to [email protected]; Soteria will investigate, contain and make legally required regulator and data-subject notifications within applicable mandatory deadlines, coordinating with the Organization as appropriate. Soteria requires guardian consent for consent-dependent processing of data of every Person under 18. A profile relationship, membership or administrator’s action cannot grant it. An authorized editor may record verified offline evidence explicitly, identifying the guardian and actual consent date; this is distinct from direct guardian Account acceptance.
Providers and international processing
The Subprocessors / International Data Transfers page identifies current providers and known or unverified locations. Processing may occur outside Egypt. This DPA is not itself a transfer permit or proof of provider contractual safeguards. Before sensitive/child or international processing, resolve applicable approvals and safeguards. Provider changes require notice review and Organization communication; raise objections through the legal contact before extending processing.
Requests, assurance and ending service
Soteria assists with proportionate data-rights and security inquiries through the privacy contact, taking account of access scope and other people’s rights. Request available exports before ending service. Agree deletion or return instructions and any necessary retention with Soteria; archiving is not deletion and recovery copies may remain under backup rotation. Reasonable compliance information can be requested; no certification or completed audit is asserted.
Privacy requests
Request access, correction, deletion where applicable, consent withdrawal, or raise a privacy concern. Include the relevant Organization and a safe reference; never send passwords or recovery codes. We may verify identity and coordinate with the responsible Organization.
[email protected]