Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions and Privacy Policy between the parties and governs the processing of personal data carried out by the Processor on behalf of the Controller in connection with the Mektebi platform. It is concluded as required by the Law on Personal Data Protection of the Republic of North Macedonia (Official Gazette of RNM No. 42/2020, as amended) (the "LPDP"), which is harmonised with the EU General Data Protection Regulation (GDPR). Where the Controller is established in Switzerland, the Swiss variant of this DPA applies instead.

1. Parties

• Processor: FETOSOFT DOOEL, Goce Delchev 2/32, 1300 Kumanovo, North Macedonia — support@fetosoft.com
• Controller: the school / mosque that accepts this DPA, as identified by its account on the platform and the person accepting on its behalf.

This DPA takes effect on the date the Controller accepts it on the platform (recorded electronically).

2. Definitions

Terms such as "personal data", "special categories of personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the LPDP. The "Agency" means the Agency for Personal Data Protection of the Republic of North Macedonia (AZLP), Skopje.

3. Roles of the parties

3.1 The Controller determines the purposes and means of processing the personal data of its students, parents and teachers and is responsible for the lawfulness of that processing — including any consent required, in particular explicit consent for special-category data (religious context) and parental/guardian consent for children where required by the law applicable to the Controller.

3.2 The Processor processes that personal data only on the documented instructions of the Controller, as set out in this DPA and Annex 1.

3.3 FETOSOFT acts as an independent controller only for the limited account-administration, security-log and website-visitor data described in its Privacy Policy; that processing is outside the scope of this DPA.

4. Subject matter and instructions

4.1 The nature, purpose, data types and data subjects are described in Annex 1.

4.2 The Processor processes the personal data only on the Controller's documented instructions — including operating the platform's features as configured by the Controller — unless required to act otherwise by law; in that case it informs the Controller beforehand, unless the law prohibits it.

4.3 The Processor informs the Controller if, in its opinion, an instruction infringes the LPDP or other applicable data-protection law.

4.4 The Processor shall not use the personal data for its own purposes, shall not sell it or make it available for commercial purposes, and shall not use it for advertising, profiling or analytics. This does not cover the Processor's own statistics on visitors to the public website (clause 3.3): Google Analytics runs only on the public website, for signed-out visitors and only with their cookie consent, and never inside the platform or the apps.

5. Processor obligations

• Confidentiality — persons authorised to process the data are bound by confidentiality and process it only as instructed.
• Security — appropriate technical and organisational measures as required by the LPDP, described in Annex 2.
• Sub-processors — only those in Annex 3 or others authorised under clause 6.
• Data-subject rights — assist the Controller, as far as possible, to respond to data subjects exercising their rights under the LPDP.
• Assistance — assist with security, breach notification, impact assessments and prior consultation with the Agency, taking into account the information available to the Processor.
• Breach notification — notify the Controller without undue delay after becoming aware of a personal data breach, with the information the Controller needs to meet its own notification obligations.
• Deletion or return — at the Controller's choice, delete or return all personal data after the services end, and delete existing copies, unless retention is required by law.
• Records and audits — make available the information needed to demonstrate compliance, and allow for and contribute to audits on reasonable notice, subject to confidentiality.

6. Sub-processors

6.1 The Controller gives a general authorisation to engage the sub-processors in Annex 3.

6.2 The Processor imposes equivalent data-protection obligations on each sub-processor by contract and remains fully liable for its performance.

6.3 The Processor gives at least 30 days' prior notice of adding or replacing a sub-processor, during which the Controller may object on reasonable data-protection grounds; if unresolved, the Controller may terminate the affected service.

7. International transfers

7.1 The application, database and uploaded files are hosted within the European Economic Area (Annex 3).

7.2 The Processor and its personnel access the personal data from North Macedonia to operate and support the platform. Where the law applicable to the Controller treats North Macedonia as a country without an adequate level of protection (for example, under the EU GDPR), this access is covered by appropriate safeguards — the EU Standard Contractual Clauses (Module Two, controller-to-processor) in Annex 4, which the parties conclude.

7.3 Certain sub-processors (Annex 3) process limited data in the United States, under the EU–U.S. Data Privacy Framework where the recipient is certified, or otherwise under the Clauses in Annex 4.

7.4 In case of conflict between this DPA and the Annex 4 Clauses regarding the protection of transferred data, the Clauses prevail.

8. Controller obligations

The Controller warrants that it has a valid legal basis under applicable law for the processing it instructs, has provided the required information to data subjects, and has obtained any consent required (including for special-category and children's data). It is responsible for the accuracy of the data it enters and for managing the access rights of its administrators, teachers and parents.

9. Liability

Each party is liable for damage caused by processing that infringes applicable data-protection law.

10. Term and termination

This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller. Clauses that by their nature should survive (confidentiality, deletion/return, the Annex 4 Clauses, liability) survive termination.

11. Governing law and jurisdiction

This DPA is governed by the laws of the Republic of North Macedonia, and the courts of Skopje have jurisdiction, without prejudice to mandatory data-protection or consumer-protection rules applicable to the Controller or data subjects in their country of residence. The Annex 4 Clauses keep their own governing-law and forum provisions for the matters they cover.

12. Acceptance

This DPA is concluded electronically by an authorised representative of the Controller accepting it on the platform; the platform records the accepting person, their role, the school, the document version, and the date and time.

---

Annex 1 — Description of the processing

• Subject matter: provision of the Mektebi platform for Islamic education and school management.
• Duration: for as long as the Controller maintains an account.
• Categories of data subjects: the Controller's students (including minors), parents/guardians, teachers, and administrators, other persons whom they name in messages or notes, and other persons whose voice can be heard in a recording.
• Types of personal data: identification & contact (name, email, phone, password hash, language); profile (honorific/Islamic title, gender, date of birth, level, mentor links); address (encrypted); educational records (enrolments, grades, lesson progress, attendance, guardian relationships); content (photos, teaching materials — text, images, audio); security (two-factor secrets).
• Family features: absence reports sent by families (dates and an optional note, which may mention a health reason; encrypted, deleted 12 months after the school year ends); notice delivery records (who received and opened a mosque notice, and which guardian confirmed it for which child; deleted 12 months after the notice expires).
• Messages: chats within the Controller's mosque between its learners, parents, teachers and administrators: message text (encrypted), voice recordings, photos, PDF files and links to lessons, courses and assignments; read status; blocks between users; reports of messages, which go to the Controller's administrators and to the Processor's moderation inbox, which reviews them within 24 hours. Kept until the author deletes a message within 15 minutes, or deleted with the course, with the person the chat is about, or with the Controller's account.
• Absence reasons and learning progress: the optional reason given in an absence report (sick, family, travel or other); recitation records (what was recited, the result and an optional encrypted note); teachers' remarks and published progress reports (encrypted snapshots), with the record that a parent has seen them; the position reached in a lesson's audio.
• Recitation recordings: optional audio recordings of a learner's recitation, made by a teacher when logging a recitation, only where the Controller has switched recordings on and not for learners it has excluded; stored with that recitation record; played only to the Controller's staff, the learner and the approved parents of a learner under 18 (or whose date of birth is not recorded), through links that expire after five minutes; never published, never shared with other mosques and not sent by email or push notification; not processed to identify anyone by their voice and not analysed automatically. Deleted at once when the Controller's staff remove the recording or delete the recitation record, when the learner is removed from the mosque or deletes their own account, and with the Controller's account.
• Lesson exercises: a learner's answers to lesson exercises, which may include drawings or handwriting, photos of a workbook page and, under the same conditions as recitation recordings, recordings of the learner reading; and a teacher's optional voice note on corrected homework. Shown to the same persons as recitation recordings, through links that expire after five minutes. The files are deleted when the learner is removed from the mosque or deletes their own account, and with the Controller's account.
• Following a learner: which member of the Controller's staff follows which learner, and the notifications this produces for that staff member (a note, a recitation or an absence recorded by someone else, or an assignment handed in by the learner). Available to the Controller's staff only and confined to the Controller's mosque.
• Technical data: sign-in session records (a hash of the session key and the times of creation and last use; no IP address); the token of a learner's or parent's private calendar link; push-notification tokens.
• Special categories: data revealing religious belief (inherent to enrolment at a mosque/mekteb, to Islamic titles, and to recordings of a learner reciting the Qur'an), processed on the Controller's explicit-consent basis. They also include health data where an absence report gives the reason "sick" or its note names an illness; these are used only so that the Controller can organise its classes and excuse absences. Recitation recordings and exercise readings are not biometric data: they are not processed by specific technical means to identify a person by their voice (GDPR Art. 4(14)).

Annex 2 — Technical and organisational measures

• Encryption in transit (HTTPS/TLS) for all traffic.
• Encryption at rest for sensitive personal data: addresses, phone numbers, dates of birth, gender, religious titles, guardian-relationship details, teacher notes, grades and grade/attendance remarks, two-factor secrets and access tokens.
• Passwords stored only as salted hashes (bcrypt); encrypted session cookies; optional two-factor authentication.
• Also encrypted at rest: chat message text, absence-report notes, recitation notes, progress-report remarks and published progress reports. Files in chats, submissions, notices and lesson exercises, and recitation recordings, are served only to authorised users, through links that expire after five minutes. Server-side sessions store only a hash of the session key and end on sign-out or after two weeks without use.
• Strict tenant isolation — each school's records are segregated, and the platform enforces that separation; a person who belongs to more than one school has a separate profile at each school, and no school can see another school's records about that person. That person's login (name, email address, profile photo and password) is a single account that they manage themselves; its name, email address and profile photo are visible to every school they belong to, and a school cannot change the login of a person who also belongs to another school.
• Least-privilege, role-based access (admin / teacher / parent / student).
• No bulk extraction or bulk import of members' personal data is exposed to school users — records are created and maintained individually.
• No analytics, advertising, tracking or profiling inside the platform or the apps (Google Analytics runs only on the public website, for signed-out visitors and only with their cookie consent), and no sale or commercial sharing of personal data.
• Hosting within the European Economic Area; error/uptime monitoring; security logging; regular backups with controlled retention.

Annex 3 — Approved sub-processors

Annex 4 — Standard Contractual Clauses

For transfers that require them, the parties conclude the EU Standard Contractual Clauses (Module Two: controller-to-processor), Commission Implementing Decision (EU) 2021/914. The Clauses' Appendix is populated from Annexes 1–3 above.

---

This document is provided for transparency and does not constitute legal advice. It is reviewed against the current applicable law before reliance.