Data Processing Addendum

Effective 13 October 2026

This Data Processing Addendum ("DPA") forms part of our Terms of Service between your agency ("you", the controller) and Nuvora Digital Hub Marketing Solutions LLC (Commercial Register No. 11608, 107 Al Tahrir Street, First District, Ismailia, Egypt; "Nuvora", "we", the processor). It applies whenever we process personal data in Customer Data for you through Nuvora Agency OS or the Nuvora AI Agent. It applies automatically when you accept the Terms of Service; if you need a signed copy for your records, email support@nuvorahub.com and we will send one.

It is written to meet Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, where it applies, Article 28 of the EU General Data Protection Regulation (GDPR). Words such as "controller", "processor", "personal data" and "data subject" have the meanings those laws give them.

1. Roles and scope

You decide why and how the personal data of your students, leads, contacts and staff is processed in the Products. You are the controller, and we are your processor. The details of the processing are in Annex 1.

You are responsible for having a lawful basis for the data you put into the Products, for the instructions you give us, and for any consent you need, including from a parent or guardian where a student is under 18.

2. Your instructions

We process personal data only on your documented instructions. Your instructions are these Terms and this DPA, and what you and your authorized users do in the Products (for example adding, editing, exporting or erasing a record). We will not process the data for any other purpose, and we never sell it, use it for advertising, or use it to train AI models for anyone else.

If the law requires us to process the data in another way, we will tell you first, unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

3. Confidentiality

Only people who need access to provide, secure or support the Products can access personal data, and each of them is bound by a duty of confidentiality. Our staff do not open your workspace's data without your permission, except where the law requires it.

4. Security

We keep appropriate technical and organisational measures in place to protect personal data, as described in Annex 2, and we improve them over time without lowering the overall level of protection.

5. Sub-processors

You authorize us to use the sub-processors listed in section 6 of our Privacy Policy. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible to you for their work.

Before we add or replace a sub-processor that processes Customer Data, we will update that list and email your workspace's owner at least 30 days in advance. If you have a reasonable data protection objection, tell us within that period. We will work with you to resolve it; if we cannot, you may end your subscription and we will refund the unused part, calculated by remaining full months.

6. International transfers

Our main hosting is in the European Union (Germany), and some sub-processors may process data in other countries. Where data leaves Egypt or the European Economic Area, we make sure the transfer is protected as the applicable law requires, for example by standard contractual clauses.

7. Helping you with people's requests

The Products let you find, correct, export and erase the personal data of a student or lead yourself. If a person contacts us directly about data you control, we will pass the request to you and not answer it ourselves, unless you ask us to. Where you need more help to answer a request, we will give it.

We will also give you the information you reasonably need for a data protection impact assessment or a consultation with an authority about the Products.

8. Personal data breaches

If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data we process for you, we will:

tell your workspace's owner without undue delay, and in any case within 72 hours of becoming aware of it;
describe what happened, the kinds and approximate number of people and records affected, the likely consequences, and what we have done and will do about it, and update you as we learn more;
take reasonable steps to contain the breach and limit its effects, and help you meet your own obligations to notify authorities or the people affected.

Telling you about a breach is not an admission of fault.

9. When the subscription ends

When your subscription ends, your workspace stays available read-only for 90 days so you can export your data. After that, we delete the personal data we process for you, unless the law requires us to keep it. Deleted data leaves our backups as they expire, within 30 days. On request, we will confirm the deletion in writing.

10. Information and audits

We will make available the information you reasonably need to show that we meet this DPA, and answer your written questions about our processing. If that is not enough, you, or an independent auditor bound by confidentiality, may audit our compliance once a year, with at least 30 days' written notice, during business hours, at your own cost, and in a way that does not expose other customers' data or our security.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms of Service or the Privacy Policy about the processing of Customer Data, this DPA prevails.

12. Changes

We may update this DPA when the law or our Products change. We will post the new version here with a new effective date and, for material changes, tell you by email at least 30 days before they apply. We will not reduce the protection of your data without your agreement.

Annex 1: Details of the processing

Subject matter and purpose: providing Nuvora Agency OS and the Nuvora AI Agent to you: managing leads and students, programs and shortlists, applications, documents, agreements, payments, university commissions, messaging with students (including email and, when you connect it, WhatsApp), and related support.
Duration: for as long as your subscription lasts, plus the 90-day read-only period and the backup expiry described in section 9.
People whose data is processed: your leads and students (including people under 18), their parents, guardians or sponsors where you record them, your staff and users, and people who contact you through channels you connect.
Kinds of personal data: identity and contact details; enquiry source and campaign; study preferences; academic history and language test results; passport and other documents you upload; program choices and applications; agreements; payments and charges; messages and notes; and account and activity records of your users.
Sensitive data: the Products are not designed for special categories of data (such as health or religion). If you choose to upload documents that contain them, you are responsible for having a lawful basis, and they receive the same protections as all other data.
Processing operations: storing, organising, displaying, searching, sending, exporting, backing up, scanning uploads for malware, and erasing, as you instruct through the Products.

Annex 2: Security measures

Separation: each agency's data is isolated from every other agency's by row-level security enforced in the database itself, not only in the application.
Encryption: all traffic is encrypted in transit (HTTPS with HSTS); access tokens for connected platforms are encrypted with AES-256-GCM before they are stored; stored files and backups are kept with a provider that encrypts them at rest.
Access control: access inside your workspace follows the roles and permissions you set, with scopes such as "own students only"; sensitive areas such as commissions are hidden from roles you have not granted them to. Our own administrative access requires multi-factor authentication.
Accountability: important actions are recorded in an audit log, without storing message contents or secrets in it.
Uploads: every uploaded file is scanned for malware before it is accepted, and files are reachable only through short-lived, private links.
Resilience: the database is backed up every night to a separate provider and the backups are tested; backups are kept for 30 days.
Erasure: a built-in erasure process removes a person's data across the Products when you ask for it.
Development: every change passes automated tests, including tests that one agency can never see another agency's data, before it reaches production.

Contact

Questions about this DPA or data protection: support@nuvorahub.com.