Privacy Policy

Arabic version controls. If this English text and the Arabic text disagree, the Arabic text wins.

Company: Hessity for Information Technology (Arabic: حصتي لتكنولوجيا المعلومات) Commercial register: 301420 · Tax ID: 769-507-107 Effective date: 18 August 2026 Contact: legal@hessity.com

This policy explains how Hessity processes personal data when you use the website, apps, and services. Use of Hessity is also governed by the Terms of Use. Personal data is processed under this policy, Egypt’s Personal Data Protection Law No. 151 of 2020, its executive regulations (Ministerial Decision No. 816 of 2025), and other applicable law.

Hessity does not sell student or parent lists.

Hessity for Information Technology (“Hessity”, “we”) provides software for in-person private education operations in Egypt. Hessity is not the teaching provider, does not take attendance itself, and is not entitled to the teaching fees the family pays for the teaching service. Teaching fees are due to the workspace that owns the class, although payments may be processed through payment channels made available through Hessity as described in the Terms of Use and the Payment and Refund Policy. A parent is not a member of any workspace; they see a child only after accepting a link.

For Hessity account data, operation of the platform, its security, and Hessity subscriptions, Hessity determines the purposes and means of processing under this policy. For some teaching data that the workspace owner enters and whose purposes of use the owner determines, Hessity processes that data to provide the service under the applicable legal relationship, including the Data Processing Agreement with the workspace owner. Each party’s role (controller or processor) may differ by data type and processing purpose.

Depending on how you use Hessity, we may process:

- Account data: name, phone number, hashed password, email if you give one, photo if uploaded. - Profile data: role (teacher, staff, student, parent, and so on), gender, date of birth, city, address if given, student grade, language preference. - Operational data entered by the workspace or authorised users: groups, schedules, attendance, charges, recorded payments, approvals, session files, operational messages. - Device and app data: a push-notification identifier, and technical logs needed for security and to run the service. - Payment-transaction data through third-party payment providers (we do not store full card numbers ourselves). - Aggregated or analytics usage data to improve the service and keep it stable.

We do not require a national ID number to create an account.

- Directly from you when you register, update a profile, pay, or contact us. - From a workspace: a teacher, center, or staff member may create a student profile or send an invite; the student then registers and joins the group. Parent linking is a separate path and is never automatic. - From the device and browser when you use the site or apps. - From payment and messaging providers as needed to complete a transaction or deliver a message.

We process data to run the account and workspace; provide student and parent apps; support attendance, charges, and recorded payments; run approvals and access; keep the service secure and resist fraud; send the messages in section 8; improve the service; and comply with the law.

We process data only as the law allows, including to perform the service and the relationship the user or workspace requested, to meet legal obligations, to protect the service and users, and on the basis of consent where the law requires it.

Minors may use Hessity’s services, including students from age six as the product is designed. Creating a profile or account for a minor student does not mean the child independently gives any consent the law does not allow them to give. Use of the service by a minor, and processing of their data, follows the legal requirements for children’s data, including obtaining the consent of a parent or legal representative where that is required, and according to the mechanisms approved or required by law.

In the product: a student profile may be created by the student registering themselves, by the workspace creating the profile, or by invite then registration and joining a group. Parent linking is a separate path and is never automatic. After the link is accepted, it lets the parent see the linked child’s data and carry out what the product allows for that child. Accepting the link is not, by itself, proof that the legal consent required to process the child’s data was obtained when the profile was created. That does not make a minor the owner of a paid workspace.

Children’s data is processed to run the teaching the workspace provides, not for marketing aimed at the child.

Within Hessity, access is limited by the relationships and permissions configured in the service; access is not granted by default.

We may rely on third parties to run the service, including without limitation: cloud infrastructure, file storage, fault monitoring, payment providers, email delivery, SMS, WhatsApp, push notifications, and analytics or usage tools for the site and apps. We do not list vendor names in this policy; they may change. Each provider processes what is needed to perform its service, under its contract with us and applicable law.

We may disclose data if the law or a competent authority requires it, or to protect Hessity’s or users’ rights.

Some data may be processed or hosted outside the Arab Republic of Egypt through technical service providers. When personal data is transferred, stored, or processed outside Egypt, those operations are subject to the controls and requirements of the Personal Data Protection Law and its executive regulations, including the licence, permit, and safeguard requirements that apply in each case.

Hessity may send operational messages: verification codes, attendance, billing, schedule, approvals, security. We may also send updates about the Hessity product (features, workspace subscription reminders). That is not advertising for third parties. These messages do not make Hessity the provider of teaching to the student or the family.

Channels depend on what is enabled: in-app, push, email, WhatsApp, SMS.

We keep each category of data for as long as needed to fulfil the purpose for which it was collected, or for as long as the law requires or legitimate claims or financial obligations require. Retention periods may differ by type of record. Hessity sets internal retention periods according to those purposes and legal requirements.

Stopping the Hessity subscription (wind-down) does not delete the record and does not cut off the student or parent apps.

When you request deletion of the account, a 14-day period starts during which the request may be cancelled. Completion of deletion of certain data, or closure of certain account functions, may not be immediate if there is a financial balance, a legal obligation, or a record that must be kept, without limiting the rights the law grants the data subject. After the period ends we stop login and delete or detach identifying account data that is no longer necessary to keep, according to the type of record and the legal purpose of keeping it. Some operational or financial records may continue after being detached from visible account data, or may appear as linked to a deleted user, to the extent the law allows or requires.

We take reasonable technical and organisational measures to protect data. No transmission or storage is perfectly secure.

If a personal-data breach occurs, we take the steps required to assess and contain it, and we notify the Personal Data Protection Center and affected persons when notification is required under the law and the executive regulations.

Under applicable law, you have the right — to the extent the law provides — to:

• know and access your data; correction, amendment, and update; erasure where it applies; withdraw consent; object to processing or its results where the law allows; restrict processing within the scope the law allows; complain to the Personal Data Protection Center or the competent authority.

Some requests run through the product (such as account deletion above) after you sign in. Privacy requests outside the product: legal@hessity.com. We may ask for reasonable information to verify your identity or authority before acting on a data request, to protect data from disclosure, change, or deletion by someone who is not authorised. If a request conflicts with a legal duty, a financial trail, or a workspace record, we will say so.

If the workspace owner asks, we export workspace data in a reasonable machine-readable form while it exists or during wind-down, subject to technical limits.

Hessity websites and apps may use cookies and similar technologies for operation, security, measurement, and analytics. Further detail and any choices available to the user are in the Cookie Policy, where it applies.

We may update this policy from time to time. For material changes, we notify users by appropriate means, and we obtain new consent where the law requires it.

Governed by the laws of the Arab Republic of Egypt. Arabic prevails if translations disagree.

Hessity for Information Technology حصتي لتكنولوجيا المعلومات Commercial register: 301420 Tax ID: 769-507-107 Registered office: 53 Capital Mall, behind the Court, 2nd floor, Fifth Settlement, New Cairo, Egypt (٥٣ كابيتال مول، خلف المحكمة، الدور الثاني، التجمع الخامس) Email: legal@hessity.com