Organization Data Processing Agreement

Version: 2026-10-29-dpa-2 · Effective date: October 29, 2026

A consolidated convenience copy of the current published documents. Each document retains its own version and effective date. The versioned legal pages and archive remain authoritative.

On this page

Parties and acceptance

This agreement is between Daniel Ashraf Ekdawi, operating Soteria as an individual in Cairo, Egypt, and the Organization identified in the acceptance record. Legal/contact address: 1 Amin Al Shamsi Basha Street, Hegaz Square, Heliopolis, Cairo, Egypt. Privacy/legal contact: [email protected]. No incorporated or registered business status is asserted. An authenticated Account accepts for the Organization only with authority to bind it, explicitly confirmed and recorded with the exact document version and language. Creating a workspace or a managed Person does not establish that authority, bind every member personally or constitute consent. Arabic is the primary maintained legal text, with equivalent English; mandatory law prevails over either text.

Roles and scope

For the Organization's scoped community records, the Organization determines the purposes, essential processing choices and authorized participants, and Soteria acts as its processor to provide the selected service. Actual purposes and decisions determine each role. Each party remains responsible for its own statutory obligations. Soteria separately determines purposes for its own Account administration, service security, support and contractual, billing and legal records, as described in the Privacy Notice. This agreement does not turn those independent purposes, another Organization's private records or an individual's independent Account information into data controlled by this Organization. Where the Organization itself processes for another controller, it must have authority for these instructions and for Soteria's appointment.

Processing schedule

Subject matter and purpose: operating the Organization's authorized community-management functions, including scoped profiles and memberships, events and attendance, assignments and check-ins, points and shop, reservations, communications, reports and support. Operations include receiving, importing, organizing, storing, retrieving, displaying, matching and applying configured rules, communicating, exporting, correcting, restricting and deleting data as instructed and lawfully permitted. People: members, staff, servants, managers, volunteers, guests, guardians and children whose processing is lawfully authorized. Data: identity and contact details, scoped profile/custom-field values, memberships and roles, relationships, dates of birth where supplied, attendance and activity, submissions and scores, messages, images and files, locations where enabled, reservation answers and relevant payment references/evidence, access and service metadata. Religious affiliation, child information and other sensitive data may arise from these functions; they are not authorized merely by being listed here. Do not upload full card numbers, card security codes or unrelated sensitive documents. Duration: while providing the instructed service, followed only by the return/deletion, required retention and restricted recovery handling below. Enabled functions, authorized settings and recorded support instructions specify the actual subset and recipients; neither package availability nor this schedule authorizes every possible use.

Documented instructions

The Organization instructs Soteria through this agreement, authorized service settings/actions and written requests to [email protected] identifying the Organization and requested operation. Soteria will verify authority and retain a restricted record of instructions and outcomes. An email does not bypass access checks or authorize disclosure of another person's or Organization's data. Soteria will process Organization data only on documented lawful instructions, including for transfers, unless applicable law requires otherwise. It will notify the Organization of that legal requirement before processing unless prohibited by law. If an instruction appears unlawful, Soteria will promptly explain the concern and suspend the affected instruction pending lawful clarification; it will not silently substitute a new purpose. If lawful performance is impossible, either party may end the affected processing, with the return/deletion safeguards below. Organization data will not be sold or used for unrelated advertising or Soteria's own model training.

Organization responsibilities and sensitive data

The Organization must establish lawful authority, give timely and accurate notices, limit data to what is necessary, keep records accurate, set appropriate retention instructions and review access, exports and public sharing. It must obtain and document specific consent where required, including verified legal-guardian authority and explicit written consent for child/sensitive processing where applicable, and obtain relevant licences or permits. Soteria must independently meet the obligations applicable to it; neither party can transfer those duties away by contract. New managed-person creation, including each import row, is held until a Super Admin records an expiring review tied to the exact request and Organization. Existing-person reviews separately record the actual age band, notice delivery, lawful basis, sensitive-data condition, purposes and recipients. Unknown or conflicting age remains held. These reviews record checked evidence; they do not themselves supply consent or a permit. Operational profile writes, attendance/check-in writes, assignment submissions/completions, media/location writes, notification delivery and ordinary server exports recheck current scoped decisions. Queued notification email and offline attendance replay are checked again at execution. Child and unresolved-age behavioural scoring, assignment rankings and activity automations are conservatively held. Other reads, recipient follow-up, reservations, independent/global processing and all external copies still require appropriate manual review; no universal enforcement is claimed. Fresh profile, user-list, attendance and check-in reads also check recorded restrictions and inactive purpose evidence before returning affected data. New reservations require linked requesters and beneficiaries with reviewed reservation-purpose coverage; unlinked/public guest intake is held for protected review rather than silently creating a managed Person. Fulfillment, answer additions, general uploads and queued optional reminders recheck current authority. Cancellation, refunds and privacy-case handling remain separate. Omitting the Organization does not allow an unregistered managed Person to bypass the scoped write guard. These targeted checks do not constitute complete global, read, recipient/category or external-copy enforcement.

Confidentiality and authorized access

Soteria will keep Organization data confidential and ensure that every person it authorizes to handle it is bound by confidentiality or an applicable statutory duty, understands the permitted work and receives only necessary access. This duty continues after access or the service ends. Operational access must be justified for an authorized support, security or maintenance task and withdrawn when no longer needed. It does not grant routine unrestricted browsing of community records. Lawfully required disclosures must be limited to what is required, with notice to the Organization unless legally prohibited. Soteria will protect the confidentiality of retained records, exports, incident material and audit evidence, not only the active application data.

Security measures

Soteria will maintain technical and organizational measures appropriate to the processing and risks: authenticated Accounts and scoped authorization; private-file access checks separate from public media; HTTPS for public service traffic; protected runtime credentials; restricted administrative access; encrypted off-site recovery copies; incident handling and review of access and changes. Security checks must cover isolation between Organizations, revoked access and the handling of exports and offline work. Soteria will regularly assess the measures and recovery capability, address identified weaknesses and document material changes without reducing the required protection. The service supports Account security controls, operational monitoring and backup/restore tooling. Their availability is not proof of every user's configuration or a successful restore on a particular date. No universal database-at-rest or end-to-end encryption, security certification, zero-risk guarantee or fixed recovery-time guarantee is asserted. Public links, authorized downloads and device caches require separate controls; server revocation cannot guarantee immediate erasure of copies on disconnected devices.

Personal-data incidents

Soteria will notify the Organization's verified administrative contact without undue delay after becoming aware of a personal-data breach affecting its data, without waiting for a complete investigation. It will provide the known nature and timing, affected data/people and approximate numbers where available, likely consequences, containment/remediation and contact details, with staged updates and a record of decisions. Lack of complete information does not justify withholding the initial notice. Soteria will investigate, contain, preserve necessary evidence and assist the Organization with assessment and legally required notifications. Each party must meet the regulator and affected-person deadlines applicable to it; notification to the Organization does not replace them. They will coordinate factual communications without requiring prior approval that delays a mandatory notice. Report suspected incidents promptly to [email protected] using safe references, not passwords or raw sensitive attachments.

Rights requests and compliance assistance

Taking account of the processing and information available, Soteria will assist the Organization with access, correction, erasure, restriction, objection, portability and withdrawal requests, required impact/risk assessments, security duties and regulator consultations. It will promptly forward requests concerning Organization-controlled data to a verified contact and respond directly where it has its own legal duty or independent processing role. Assistance includes relevant processing, security, recipient and retention information and authorized data retrieval or action; it is not limited to an automated self-service tool. For Egyptian personal-data rights requests, the response commitment is six working days from submission. Verification, internal forwarding or coordination must not restart the clock. Soteria will tell the Organization promptly if a request or assistance deadline risks being missed and prioritize the applicable mandatory period. No Account, new contract acceptance or payment is required merely to raise a privacy request. Any optional additional consulting scope/fee must be agreed in advance and must not obstruct mandatory assistance or rights.

Subprocessors and other recipients

By accepting this agreement, the Organization gives general written authorization for the listed providers only insofar as they process its data on Soteria's behalf for the described service: Hetzner for application/database hosting; Cloudflare for R2 files and DNS; Backblaze B2 for encrypted backups; AWS SES for transactional email; Zoho Mail for support/mailbox processing; Better Stack for restricted operational monitoring; and OpenAI for content deliberately submitted to enabled AI features. Relevant data categories follow the processing schedule; monitoring is minimized rather than guaranteed anonymous. Soteria will disclose the contracting legal entity, relevant function, data and processing countries before entrusting affected data where required. The published Subprocessors / International Data Transfers supplement supplies further provider information; unresolved location or contract details remain unresolved, not approved by acceptance. Google Maps, Paymob and browser/device-selected push infrastructure are additional conditional recipients. A provider's role depends on the particular processing: independently determined payment, fraud, mapping or device purposes are not reclassified as instructions-only subprocessing. Any part performed as a subprocessor remains subject to these duties. The Organization's own selected recipients and public/export sharing remain its instructions and responsibility. Before a subprocessor handles affected Organization data, Soteria will ensure a written arrangement imposing applicable equivalent protection, confidentiality, security, assistance, return/deletion and onward-processing duties. Soteria remains responsible to the Organization for its subprocessor obligations and failures in their performance. A provider's privacy-policy link alone does not prove this arrangement exists.

Provider changes and objections

For a proposed addition or replacement of a subprocessor, Soteria will send at least 30 calendar days' advance written notice to the Organization's verified administrative contact, identifying the provider, purpose, data, countries, safeguards and planned start. The Organization may object on reasonable data-protection grounds within that notice period through [email protected]; silence is not a new data-purpose consent or a transfer permit. Soteria will discuss an alternative or safeguards and will not send the affected Organization's data to the disputed provider while a timely objection remains unresolved. If no lawful workable alternative exists, either party may end the affected function/service before the change, with return/deletion and applicable cancellation/refund rights preserved. Soteria must give advance notice and an opportunity to object even for an urgent security/continuity change; if the ordinary notice period cannot be met, it must obtain specific written authorization before the affected data moves, or pause that processing. Merely editing a public list is not direct notice.

International processing

Information may be processed outside Egypt. The Privacy Notice and provider supplement distinguish confirmed settings from unknown locations. AWS email is configured for Frankfurt, Germany; the configured Zoho .com domain corresponds to its US data-center service under provider guidance, without proving every processing location. Other server, file, backup and provider countries are not all verified. Before a transfer, Soteria and the Organization must establish the applicable lawful grounds, destination protection, required regulatory permissions and enforceable safeguards for their respective duties. Soteria will provide the relevant location and safeguard information and will not carry out an instruction or provider change lacking the required authority. This agreement, a general provider authorization, encryption or guardian consent alone is not a transfer permit, an adequacy finding or an executed international-transfer instrument. Where another jurisdiction's law applies, its additional requirements must also be met; no blanket GDPR compliance or exclusive Egyptian residency is promised.

Return and deletion

On ending the processing service, the Organization may instruct return or secure deletion through its verified authorized contact at [email protected]. Soteria will confirm the scope, identity and authorized destination promptly, provide the Organization's data in a commonly usable electronic form such as CSV/JSON with relevant files where applicable, and delete remaining active copies after return, unless the Organization instead chooses deletion. This includes relevant data not covered by an ordinary screen export; other people's independent Account data and other Organizations' private data must not be disclosed. Soteria will complete active-system return/deletion within 30 calendar days of the service ending and receipt of the choice, or sooner where mandatory law requires, and give written confirmation identifying any lawful retention and recovery-copy handling. If no choice is supplied, Soteria will seek instructions promptly and restrict retained data to necessary closeout, protection and lawful retention; lack of instructions is not permission to retain indefinitely. Any exceptional practical extension must be explained and agreed in writing before the deadline without displacing mandatory rights. Statutory rights-request deadlines still apply separately. Only data required to be retained by applicable law, or independently lawfully held by Soteria for its own necessary purposes, may be retained outside the instructed closeout. Soteria will identify the categories, grounds, restriction and expiry/review criteria, protect them and delete when the grounds end. Immutable evidence requires a reviewed lawful resolution, not an assurance that all rows were automatically erased. Cancellation, archiving, suspension and deleting a membership are not themselves complete deletion instructions.

Recovery copies and devices

Backup cleanup is not instantaneous. Configured local archives use a 30-day threshold; off-site database backup selection keeps 14 daily, 8 weekly and 12 monthly snapshots; changed/deleted-object recovery history uses a 365-day threshold. Actual expiry depends on successful cleanup and the backup sets that contain the data, so these are not guaranteed exact erasure dates. Soteria will restrict retained recovery copies to recovery/security and legally required preservation, keep a protected record of approved deletions/restrictions, verify cleanup and communicate the relevant expected expiry and any exception in its completion response. If a mandatory deadline requires earlier erasure, Soteria must arrange lawful earlier removal rather than rely on ordinary rotation. Before restored data is made available for ordinary use, approved deletions and restrictions must be reapplied and verified. Authorized recipients and disconnected devices may retain copies outside direct server control; Soteria will assist with appropriate instructions and access controls without falsely certifying erasure on every device.

Information, audit and oversight

Soteria will provide information necessary to demonstrate these obligations, including relevant processing records, security measures, providers, locations, incident handling and return/deletion evidence. The Organization or an independent auditor it appoints may conduct proportionate audits, including necessary inspections, under confidentiality and security arrangements protecting other customers and service safety. Documentary or remote review may be used first where sufficient, but must not defeat a justified inspection or a regulator's powers. Request an ordinary audit through [email protected] with reasonable advance notice, normally 15 working days, describing scope and the auditor. Urgent incidents, substantiated compliance concerns or mandatory regulator deadlines do not have to wait for that period or an annual quota. Soteria will cooperate, explain any specific security concern, offer a workable equivalent access method and track corrective actions. No confidentiality, discretionary approval or fee may block a legally required audit. Optional additional work or expenses must be agreed in advance. No completed independent audit or certification is asserted by this clause.

Precedence, changes and continuing duties

For Organization-directed personal-data processing, this agreement prevails over conflicting general service terms; applicable mandatory law and data-subject/regulator rights always prevail. It does not waive either party's statutory responsibility or limit remedies that cannot lawfully be limited. Egyptian law governs, without removing other applicable mandatory protections. Material changes require a new version and explicit acceptance by an authorized Organization representative; they are not silently applied to old evidence. A lawful separately agreed written variation must be retained with the Organization's instructions and cannot reduce mandatory protection. Confidentiality, necessary assistance, audit of relevant past processing, restricted retention and return/deletion duties continue as needed after service ends. Questions, instructions and requests go to [email protected]; an unverified claim of authority must be checked before data is disclosed.