Data processing agreement

1. Parties and purpose

1.1 This agreement is between Kifaya Telecommunications and IT Solutions (commercial registration 7054438085, address: Ibn Muqlah, Qurtubah District, Riyadh), "Kifaya" or "the processor", and the academy that uses Madar under the terms of service and an order form, "the academy" or "the controller".

1.2 The academy is the controller of the personal data it enters in Madar or collects through it, and Kifaya is its processor, under the Personal Data Protection Law and its Implementing Regulations (together, "the Law").

1.3 This agreement forms part of the terms of service. Where they conflict on personal data, this agreement prevails.

2. Subject, duration and nature of the processing

2.1 Kifaya processes personal data only to provide Madar to the academy: storing it, showing it to the academy's users according to their permissions, using it in invoices and reports, sending the e-mails the academy's users ask for, backing it up and protecting it.

2.2 The processing lasts for the term of the terms of service and then until return and deletion under clause 13 are complete.

2.3 The categories of data subjects and of data are set out in Annex 1.

3. Processing on instructions only

3.1 Kifaya processes personal data only on the academy's documented instructions. The terms of service, this agreement and the academy's use of Madar's functions are those instructions.

3.2 Kifaya does not use the personal data for its own purposes, does not sell it, does not use it for advertising or profiling, and does not train artificial intelligence models on it.

3.3 If Kifaya believes an instruction breaks the Law, it tells the academy at once and may pause that instruction until it is changed.

3.4 If a law requires Kifaya to disclose data to an authority, Kifaya tells the academy first, unless the law forbids it, and discloses only what is required.

4. The academy's obligations

4.1 The academy ensures it has a lawful basis for every piece of data it enters, and that it has informed the data subjects as required.

4.2 The academy obtains and keeps a guardian's consent where it is required, including the consent on the registration form and the photo consent for each player.

4.3 The academy manages its users' accounts, roles and permissions, and keeps two-step verification on where Madar requires it.

4.4 The academy notifies the competent authority and the data subjects of a breach where the Law requires it, with Kifaya's help under clause 9.

5. Confidentiality and authorised persons

5.1 Only Kifaya staff who need the personal data to provide or support the service can reach it, and each of them is bound to confidentiality in writing.

5.2 Kifaya's team works through a separate platform console with personal accounts, always with two-step verification, and its actions are recorded in an audit log that cannot be edited.

6. Security of processing

6.1 Kifaya applies the technical and organisational measures in Annex 2, reviews and improves them, and does not lower the level of protection during the term.

7. Sub-processors

7.1 The academy agrees to the sub-processors listed in Annex 3.

7.2 Kifaya tells the academy at least thirty (30) days before adding or replacing a sub-processor, by e-mail to the academy's administrator and by updating Annex 3. The academy may object in writing within that period on reasonable data protection grounds. If the parties cannot agree on a solution, the academy may end the service and receive a refund of fees paid in advance for the remaining period.

7.3 Kifaya binds each sub-processor to protection obligations no weaker than this agreement and remains responsible to the academy for its performance.

8. Transfers outside the Kingdom

8.1 Madar runs on servers operated by Kifaya. Personal data may be transferred or processed outside the Kingdom as far as needed to provide the service, and some sub-processors are in other countries, as shown in Annex 3.

8.2 Every transfer follows the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, under one of the appropriate safeguards they recognise; as a rule, the Standard Contractual Clauses issued by the Saudi Data and AI Authority, signed between Kifaya and each sub-processor without changes. Kifaya carries out and keeps up to date the transfer risk assessment the regulation requires, and gives the academy its summary on request.

8.3 Kifaya transfers data outside the Kingdom only as far as needed to provide the service, and backups are encrypted before they leave the server.

9. Personal data breaches

9.1 Kifaya informs the academy within twenty-four (24) hours of becoming aware of any breach affecting the academy's data, by e-mail to the academy's administrator and by phone or WhatsApp where possible.

9.2 The notice gives what is known at the time and is completed as more is learned: the nature and time of the breach, the categories and approximate number of data subjects and records, the likely consequences, what has been done and will be done to contain it, and a contact person at Kifaya.

9.3 The academy, as controller, notifies the Saudi Data and AI Authority within seventy-two (72) hours of becoming aware where the Law requires it, and informs the data subjects where required. Kifaya provides everything needed for this in time.

9.4 Kifaya documents every breach and what was done about it, and does not inform data subjects or third parties of a breach of the academy's data except as agreed with the academy, unless the law requires it.

10. Helping the academy with data subjects' rights

10.1 Madar lets the academy see, correct and export the data, and Kifaya helps the academy answer data subjects' requests within the legal periods (thirty days as a rule).

10.2 If Kifaya receives a request from a data subject that concerns the academy, it passes it to the academy without delay and answers it only on the academy's instructions.

11. Impact assessments and consultation

Kifaya gives the academy the information it reasonably needs for a data protection impact assessment or to consult the competent authority, including the impact assessment Kifaya prepared for Madar.

12. Audits and information

12.1 On request, at least once a year, Kifaya provides what shows that it complies with this agreement: a description of the security measures, test results and answers to a reasonable questionnaire.

12.2 With at least thirty (30) days' notice and at its own cost, the academy may carry out an audit itself or through an independent auditor bound to confidentiality, during working hours and without access to other academies' data. After a breach affecting its data, the academy may do so without the long notice.

13. Return and deletion at the end

13.1 When the service ends for any reason, the academy's account stays read-only for thirty (30) days, in which the academy exports its data: players, guardians, groups, attendance, invoices, payments and files, in common formats (Excel, CSV or JSON, and photos and files as stored).

13.2 Kifaya then deletes the academy's data from its live systems within thirty (30) days and, on request, gives the academy a written certificate of deletion.

13.3 The academy's data leaves the encrypted backups as they reach the end of their retention, at most twelve (12) months; until then it is restored from them only to recover the service after a failure.

13.4 Invoices are legal documents: they are part of what the academy exports, and the academy keeps them for the period tax law requires. After deletion Kifaya keeps only what the law requires about its own contract with the academy.

14. Minors' data

14.1 Most players are minors. Kifaya treats their data with the greatest care: limited to what the academy needs, shown only to the roles that need it, and never used for tracking, behavioural analysis or advertising.

14.2 A player's photo is stored only when the academy has recorded the guardian's photo consent, and withdrawing consent deletes the photo. Photos are shown only to authorised users and never on the parent page.

14.3 The academy obtains the guardian's consent where it is required and makes sure it serves the child's interest.

15. Liability, term and law

15.1 Liability under this agreement is subject to the limits in the terms of service, unless the law forbids it.

15.2 This agreement stays in force while Kifaya processes the academy's data, and clauses that by their nature survive its end do so.

15.3 This agreement is governed by the laws of the Kingdom of Saudi Arabia, and the competent courts in Riyadh hear any dispute about it.