Data Processing Agreement

This Data Processing Agreement ("DPA") is between Labbaik Labs Ltd ("Labbaik", "we", "us"), Company No. 17166064, Unit 21 Walker Avenue, Milton Keynes, MK12 5TW, ICO registration ZC136003, and each organisation that uses Labbaik (the "Organisation" — for example a maktab, madrasah, mosque, school, charity or community group).

It forms part of our Terms of Service and applies automatically to every Organisation from the moment it creates a Labbaik account, on every plan, at no cost. There is nothing extra to sign. If your committee or trustees would like a countersigned copy for your records, email [email protected] and we will send one.

It sets out the terms required by Article 28 of the UK GDPR. Where this DPA and the Terms of Service disagree about personal data, this DPA wins.

For the personal data an Organisation puts into Labbaik — about its students, parents and guardians, staff, volunteers, donors, event attendees and certificate applicants — the Organisation is the data controller and Labbaik is the data processor. We process that data only to provide Labbaik to the Organisation.

Labbaik is a controller in its own right only for the limited data described in our Privacy Policy that we need to run our own business — for example account sign-in records, billing with the Organisation, support conversations and security logs. Stripe acts as an independent controller for card and Direct Debit payment data, under its own terms.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law").

• Subject matter and purpose: providing the Labbaik platform — registration, attendance, curriculum and Qur’an progress, exams, fees and payments, donations, events, certificates, communication with parents, staff records and payroll, safeguarding records, online classes, and the other features the Organisation chooses to use.
• Duration: for as long as the Organisation uses Labbaik, then until the data is deleted or returned under End of Service below.
• Nature of processing: storing, organising, displaying, sending messages and notifications, generating reports and exports, and the other operations needed to provide the features the Organisation uses.
• Data subjects: students (including children), parents and guardians, staff and teachers, volunteers, donors, event attendees, certificate applicants and witnesses, and anyone else the Organisation records in Labbaik.
• Types of personal data: names, contact details, dates of birth, addresses, class and attendance records, progress and exam results, fee and payment records, messages, staff and payroll records, and the other data listed in our Privacy Policy.
• Special category and criminal offence data: depending on how the Organisation uses Labbaik, this can include health information (such as allergies or medical notes), data that may indicate religious belief (attendance at an Islamic institution), and staff DBS check details. The Organisation decides whether to record this and is responsible for having a lawful basis and condition for doing so.

• Instructions. We process personal data only on the Organisation’s documented instructions. The Terms of Service, this DPA, and the Organisation’s use and settings of the platform are those instructions. If we believe an instruction breaks Data Protection Law, we will tell the Organisation. If the law requires us to process data in some other way, we will tell the Organisation first unless the law forbids it.
• Confidentiality. Everyone at Labbaik who can access Organisation data is bound by a duty of confidentiality, and accesses it only to provide the service, give support the Organisation asks for, investigate a problem, or meet a legal obligation.
• Security. We maintain the technical and organisational measures in Security Measures below, and keep them under review.
• Data subject requests. Most requests can be handled by the Organisation directly in Labbaik — finding, correcting, exporting and deleting records. Where it can’t, we will help. If a data subject contacts us directly about Organisation data, we will pass the request to the Organisation and not respond on its behalf unless it asks us to.
• Helping the Organisation comply. Taking into account what we know about the processing, we will give reasonable help with the Organisation’s security, breach notification, data protection impact assessments and any consultation with the ICO.
• No other use. We do not sell Organisation data, use it for advertising, or use it to train AI models.

The Organisation gives general authorisation for us to use the sub-processors below. We have a written contract with each one that protects personal data to the standard Data Protection Law requires, and we remain responsible to the Organisation for their work.

• Supabase Inc. — database, sign-in, file storage and server functions. Hosted in London, UK.
• Cloudflare Inc. — hosting and network delivery of the Labbaik app and websites, and bot protection (Turnstile) on sign-in and public forms. Global network.
• Resend Inc. — sending emails such as sign-in links, receipts and notifications. United States.
• Twilio Inc. — sending WhatsApp messages and WhatsApp sign-in codes, delivered through Meta’s WhatsApp service. United States.
• Anthropic PBC — AI features, including the in-app assistant, spreadsheet import (Hijrah) and the curriculum builder. United States.
• OpenAI — AI features, including voice-note transcription. United States.
• Daily (daily.co) — Labbaik Live video classes and events: participants’ display names and, if the Organisation records a session, the recording before it is copied to the Organisation’s own Google Drive or Dropbox. United States.
• Ideal Postcodes Ltd — UK address lookup when someone types an address. United Kingdom.
• LocationIQ — address lookup for addresses outside the UK. United States.
• Apple, Google and Mozilla push services — delivering push notifications to people who turn them on. Global.

How each AI provider is used, and what is and isn’t sent, is set out in our Privacy Policy. Services the Organisation connects itself — such as its own Zoom, Google Drive or Dropbox account — are used under the Organisation’s own agreement with that provider.

Changes. We will update this list and email the Organisation’s admins at least 14 days before a new sub-processor starts processing Organisation data. If the Organisation has a reasonable data protection objection, it can tell us at [email protected]; we will try to resolve it, and if we can’t, the Organisation may stop using the affected feature or close its account.

Organisation data is stored in London, UK. Some sub-processors above process data outside the UK, mainly in the United States. Where personal data leaves the UK, we rely on a safeguard recognised by Data Protection Law — the UK–US data bridge where the provider is certified to it, or the ICO’s International Data Transfer Agreement or Addendum to the standard contractual clauses — as set out in our contract with each provider.

If we become aware of a personal data breach affecting Organisation data, we will notify the Organisation’s admins without undue delay, and no later than 72 hours after becoming aware of it, so the Organisation can meet its own deadline for reporting to the ICO. We will tell the Organisation what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it — sending further details as we learn them — and we will take reasonable steps to contain the breach and reduce its effects.

The Organisation can download its data at any time, before or after deciding to leave: admins can download a ZIP of CSV files of all the records it keeps in Labbaik from Account → Settings → Export data, and the account-closure step offers this export before anything is deleted. On request to [email protected], we will provide a complete copy of the Organisation’s data, including uploaded documents, in a structured, machine-readable format within 72 hours, free of charge.

When an Organisation closes its account, we delete its personal data — its records and the files it uploaded — within 30 days, except where UK law requires it to be kept — for example payment records and Gift Aid declarations, which HMRC requires to be kept for set periods. Deleted data may remain in our encrypted backups until those backups expire, currently after about a week. Our Delete Your Account page explains the process.

We will make available the information reasonably needed to show that we meet this DPA — including this page, our Security page, and written answers to reasonable security and data protection questionnaires from the Organisation. Where that isn’t enough, the Organisation (or an independent auditor it appoints, bound by confidentiality) may audit our compliance, on at least 30 days’ notice, no more than once a year unless a personal data breach or the ICO requires it, and in a way that doesn’t expose other organisations’ data. Email [email protected].

• Having a lawful basis, and where needed a condition for special category or criminal offence data, for the personal data it puts into Labbaik.
• Giving the people whose data it records the privacy information Data Protection Law requires.
• Deciding who in the Organisation has admin, head teacher and teacher access, and keeping that up to date when people leave.
• Recording only the data it needs, and keeping sign-in methods secure — we recommend turning on two-step verification for all staff.

The measures we maintain include:

• Hosting: database and file storage in London, UK, on Supabase, which is SOC 2 Type 2 audited and ISO 27001 certified.
• Encryption: in transit with TLS and at rest with AES-256. Connection tokens for Zoom, Google Drive and Dropbox, and any Stripe credentials, are kept in an encrypted vault.
• Separation between organisations: each Organisation’s data is isolated by row-level security enforced in the database, with automated isolation tests run on every change to the platform.
• Role-based access: admins, head teachers, teachers and parents each see only what their role needs; admins can grant individual staff extra permissions. Staff DBS records are limited to admins and head teachers.
• Sign-in: no passwords. Staff can use passkeys and two-step verification, and admins can require every staff member to set up two-step verification. Account holders are emailed when these settings change, and anyone can sign out of every device at once.
• Private files: documents such as DBS certificates, payroll files and data exports are kept in private storage and opened only through short-lived signed links. Data exports are deleted from our storage within 24 hours of being created. Columns holding secrets or tokens are never included in exports.
• Change history: changes to attendance, progress, student records, registrations and admin access are logged with who made them and when.
• Abuse protection: bot protection and rate limits on sign-in, registration, donation and other public forms.
• Backups: automatic daily backups of the database, kept in the same London region.
• Payments: handled by Stripe, a PCI DSS Level 1 provider; card details never pass through Labbaik.

This DPA lasts as long as we process personal data for the Organisation. Each party’s liability under it is subject to the limits in the Terms of Service, except where Data Protection Law doesn’t allow that. We may update this DPA to reflect changes in the law or our service; we will give at least 14 days’ notice of material changes, and we will not reduce the overall protection it gives Organisation data. It is governed by the laws of England and Wales.