Who this is for. This Data Processing Addendum (“DPA”) applies automatically when a school, organisation or independent teacher (the “Customer”) uses Shams AI to hold records about its students, parents and staff. It forms part of the Terms of Service between the Customer and Shams AI (“Shams AI”, “we”). A Customer that needs a signed copy, or different terms, may ask at [email protected]. By using the Service as a Customer you accept this DPA.
For Customer Personal Data, the Customer is the controller (or the “business”) and Shams AI is its processor (or “service provider”). For information about a user’s own account, security records and billing, Shams AI is an independent controller, as the Privacy Policy explains. Where the Customer is itself a processor for another party (for example a school acting for a school district), it confirms that it has authority to give the instructions in this DPA, and Shams AI is a sub-processor.
We will process Customer Personal Data only to provide, secure, support and improve the Service for the Customer in line with the Terms and this DPA, and on the Customer’s documented instructions, which are given by this DPA, the Customer’s use and configuration of the Service, and its written requests that are consistent with the Terms. We will tell the Customer if we believe an instruction breaks Data Protection Laws, and may suspend the instruction until it is resolved. We will not:
We certify that we understand and will comply with these restrictions. The subject matter, duration, nature and purpose of processing, the types of data and the data subjects are described in Annex A.
The Customer is responsible for: having a lawful basis and all authority to put Customer Personal Data into the Service and to have it processed as described; giving students, parents and staff the notices that the law requires and obtaining consents; configuring permissions, features and retention settings appropriately and keeping them current; the accuracy and legality of the data; the conduct of its users, including who it authorises and how it protects credentials; responding to requests from individuals about their records; and not asking us to process special categories of data except as needed for its educational purpose.
Schools in the United States. The Customer confirms that it has authority to consent to the collection and use of students’ information, for the educational purposes of the school and not for any commercial purpose, on behalf of parents for the purposes of COPPA, and that, where FERPA applies, Shams AI is acting as a “school official” with a legitimate educational interest performing an institutional service or function under the Customer’s direct control with respect to the use and maintenance of education records. The Customer has notified parents as FERPA and applicable state law require. Optional features that go beyond the educational purpose (such as a child’s voice recording or the learning coach) rely on a parent’s own consent inside the Service.
We allow access to Customer Personal Data only to personnel who need it to provide and support the Service, who are bound by written confidentiality obligations and who receive appropriate privacy and security training.
We maintain technical and organisational measures appropriate to the risk, including those in Annex B and described on our Security page. We may update them as technology changes, provided the overall level of protection is not reduced.
The Customer authorises us to process Customer Personal Data in the United States and in other countries where we or our subprocessors operate. Where Customer Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP is transferred to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module Two, controller to processor, or Module Three where the Customer is a processor), the UK International Data Transfer Addendum, and the Swiss amendments are incorporated by reference and apply, with: the Customer as data exporter and Shams AI as data importer; the options for governing law and courts being those of Ireland (or England and Wales for the UK addendum); the competent supervisory authority being the Customer’s; and Annexes A, B and C of this DPA serving as the annexes to the clauses. If a transfer mechanism is invalidated, the parties will work together to adopt another that is lawful.
We will notify the Customer without undue delay, and where feasible within 72 hours, after we become aware of a personal data breach affecting Customer Personal Data. The notice will describe what we know about the nature of the breach, the categories and approximate number of individuals and records, likely consequences and the measures we are taking, and we will update it as we learn more. We will take reasonable steps to contain and remediate the breach and cooperate with the Customer’s investigation and any notifications to individuals and regulators, which remain the Customer’s decision unless the law requires us to make them. Notice of a breach is not an admission of fault.
We will make available information reasonably necessary to show compliance with this DPA, including answers to a security questionnaire and, on request, a summary of relevant security documentation. If that does not satisfy the Customer or a regulator, the Customer may, not more than once a year (or after a breach) and on at least 30 days’ written notice, carry out or appoint an independent auditor to carry out an audit of our relevant controls, during normal business hours, subject to confidentiality, without access to other customers’ data and without unreasonable interference, at the Customer’s expense.
In addition to the above, with respect to student data we commit that we: use it only for the Customer’s educational purpose and to operate and secure the Service; do not use it for targeted advertising or for any marketing to students or parents; do not sell it; do not build a profile of a student for non-educational purposes; do not disclose it except to subprocessors, as the Customer directs or as the law requires; and will not materially change how we collect, use or share it in a way that reduces protection without notice and, where the law requires, the Customer’s consent. If we are acquired, the successor will be bound by commitments at least as protective.
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where the law (including the Standard Contractual Clauses, as to data subjects’ rights) does not allow them. If this DPA conflicts with the Terms of Service about the processing of Customer Personal Data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail. This DPA lasts as long as we process Customer Personal Data for the Customer.
| Subject matter and nature | Hosting, storing, retrieving, displaying, analysing, transmitting, backing up and deleting the Customer’s learning, administrative and communication records through the Service, and, if the Customer enables them, AI-assisted features, messaging and payments. |
|---|---|
| Purpose | To provide Qur'ānic learning, progress tracking, class and school administration and communication for the Customer. |
| Duration | The term of the agreement, plus the deletion period above. |
| Data subjects | The Customer’s students (including children), their parents and guardians, teachers, administrators and other staff, applicants, and other people named in records. |
| Types of personal data | As listed under “Information we collect” in the Privacy Policy: identity and contact details, student profile and enrolment data, learning, attendance, exam and behaviour records, messages and communications, optional audio recordings, uploaded files, notification and device data, AI interactions, payment and billing references, technical and security data. |
| Special categories | Learning records may reveal religious belief. The Customer may also choose to collect health, safety or financial-aid information on forms. Biometric data is not collected. Children’s data is processed. |
| Frequency | Continuous for the term. |
The measures described on the Security page apply, including: encryption in transit and at rest (by our infrastructure providers); one-way password hashing; optional two-step sign-in and single sign-on; session expiry and rate limiting; role-based access with per-school separation enforced on the server; private file storage with short-lived signed links; an unalterable activity log for the Customer’s changes; limited, logged and need-to-know staff access; minimisation and placeholders for AI requests, with a block on requests that still contain a replaced name; monitoring and incident response; encrypted backups with limited retention; and change control with automated tests of permissions and privacy rules.
The current list is in the Privacy Policy under “Our subprocessors” and is part of this Annex.
Shams AI. Data-protection contact: [email protected].