Parties, sub-processors, and obligations
This agreement is between the contracting Organization (data controller and owner) and AverraExam (processor). Governing jurisdiction: Saudi Arabia (KSA); processing governed by the Saudi Personal Data Protection Law (PDPL).
The processor processes personal and academic data solely to operate the AverraExam platform: account and enrollment management, AI-assisted assessment, analytics, proctoring, and communications — within the scope approved by the organization.
Platform provider: ScaleX Innovation SARL — AssessX platform provider. Other disclosed sub-processors: OpenAI، Anthropic، Google، DeepSeek، Cloudflare R2، SendGrid. Each sub-processor is bound to equivalent protection controls.
Process only on the organization's instructions; apply appropriate security controls; isolate each organization's data; maintain an audit trail; and perform no deletion except by the organization's decision (see the Data Ownership Charter).
The processor assists the organization in responding to access, rectification, erasure, and consent-withdrawal requests through the in-platform governance tools.
Retention is governed by the organization's settings; the default is anonymize-not-delete; no automatic disposal is performed. A legal hold halts all disposal.
Data Protection contact: privacy@averraexam.ai. See also the Data Ownership Charter.