ATA7ADAK Privacy Policy

ATA7ADAK ("ATA7ADAK", "we", "us") is a physical activity and wellbeing technology platform owned and operated by Youth Challenge Company (شركة تحدي الشباب), a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 1010692540, with its registered address at 3966, Ar Rafiah District, Riyadh 12751, Kingdom of Saudi Arabia.

Youth Challenge Company is responsible for personal data processed under this Policy, except where Section 4 explains that a school or organization is responsible.

Privacy contact: support@ata7adak.com

This Policy applies to the ATA7ADAK mobile application, the website www.ata7adak.com, the dashboards used by teachers, school administrators and organization administrators, the parent features, and any related services (together, the "Services").

It also applies to versions of the Services provided under a customer's own brand (white-label), unless a separate privacy notice is provided for that version. It does not apply to third-party websites or services linked from the Services.

• Program participants: students, teachers and employees enrolled by their school or organization.
• Parents and guardians: who follow their child's participation and progress.
• Institution administrators: school and organization staff who manage programs and view reports.
• Individual users: adults who register directly for the Services.
• Website visitors: including people who request a demo or contact us.

When a school or organization (an "Institution") enrolls its students or employees, the Institution decides the purpose of its program and who participates. For that program data, the Institution acts as the controller and Youth Challenge Company acts as a processor on the Institution's behalf, in accordance with our agreement with the Institution.

Youth Challenge Company acts as controller for the limited purposes described in this Policy that we carry out for our own operations, including account security, billing, legal compliance, and creating de-identified and aggregated data (Section 11).

If you are enrolled through an Institution, you may also contact the Institution about how it uses your data. Where you contact us, we may coordinate your request with the Institution.

For individual users who register directly, Youth Challenge Company is the controller.

We collect only the personal data needed to provide and improve the Services:

• Account and profile data: name, email address, mobile number, login credentials, date of birth or age group, gender, profile picture (optional), and your school, class or grade, organization, department and role.
• Activity and performance data: steps, activities completed, challenge participation, exercise repetitions, scores, points, streaks, rankings, team results, and fitness measurements recorded by you or your teacher.
• Health and body data: height, weight, body mass index (BMI), heart rate, calories burned and sleep data, either entered by you (or your teacher) or read from Apple Health or Google Health Connect with your permission. This is sensitive data and is handled as described in Sections 6 and 12.
• Camera and movement data: see Section 7.
• Device and usage data: device type, operating system, app version, IP address, language settings, crash logs, notification tokens and how you use features of the Services.
• Communications: messages, feedback, ratings and complaints you send to us.
• Transaction data: for individual subscriptions purchased through the App Store or Google Play, we receive confirmation of your subscription status. We do not receive or store your full payment card details. For Institutions, we keep invoicing and contract records.
• Website and demo request data: name, organization, job title, email, phone number and message when you contact us or request a demo, plus cookie data (Section 18).

We collect a postal address only where needed to deliver physical rewards or devices.

We use personal data for the following purposes, on the legal bases permitted by the Personal Data Protection Law (PDPL) and its regulations:

• Providing the Services: creating accounts, running challenges, leaderboards and team competitions, recording activity, and showing progress (to perform our agreement with you or your Institution).
• Personalization: adapting activities and showing personal progress. Health and body data is used for this only with your explicit consent or, for students, the consent of a parent or guardian.
• Reporting to Institutions: providing participation, engagement and program indicators to the school or organization that enrolled you (to perform our agreement with the Institution).
• Support and service communications: responding to requests and notifying you about changes to the Services.
• Safety and security: protecting accounts, preventing fraud and misuse, and detecting and fixing technical issues.
• Improvement and research: improving the Services and developing new features, primarily using de-identified or aggregated data (Section 11).
• Legal compliance: meeting tax, accounting and other legal obligations, and responding to lawful requests from competent authorities.
• Marketing: sending marketing messages to adult users only, and only with their consent. We never send marketing to students.

Some activities use your device camera so that ATA7ADAK can recognize body movement, count repetitions and give feedback on technique. The app accesses the camera only after you grant permission, and only while a camera-based activity is running.

We do not use the camera for facial recognition or to identify individuals. You can deny or withdraw camera permission at any time in your device settings and continue to use other features.

ATA7ADAK Schools may be used by students under 18. We apply additional protections to their data:

• Student accounts are created as part of a school program. Before a student uses the Services, the consent of the student's parent or legal guardian is obtained through the school and through the ATA7ADAK parent consent process.
• We collect only the data needed to run the school program.
• We do not sell student data, show advertising to students, or use student data for marketing or advertising profiles.
• Leaderboards visible to students show only first name or nickname, class, points and rank, and only within the student's own school or program.
• Parents and guardians can review, correct or request deletion of their child's data through the school or by contacting us.

• Within your Institution: teachers see data for their own classes; school administrators see school-level data; parents see data for their own child only. Organization administrators see participation and program indicators. Employers see aggregated data only and do not see an individual employee's health or body data.
• Other users: your display name, points, rank and team may appear on leaderboards within your program.
• Service providers: companies that host, operate or support the Services on our behalf, such as cloud hosting, analytics, crash reporting, SMS and email delivery, and customer support tools. They may use personal data only to provide services to us and under contractual confidentiality and security obligations.
• Program partners: for the ATA7ADAK Schools program, Al-Ostath Foundation (a non-profit partner) may receive aggregated reports only.
• Government entities: aggregated and de-identified statistics for program evaluation and research. Individual data is shared only where required by law or at the instruction of the Institution responsible for it.
• Health partners and insurers: only with your explicit consent.
• Legal requirements: when required by law, court order or a competent authority, or to protect the rights, safety and property of users, Youth Challenge Company or others.
• Business transfers: if Youth Challenge Company is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy and applicable law.

We do not sell personal data.

If you connect with Apple Health (HealthKit) or Google Health Connect, ATA7ADAK reads only the data types you allow, such as steps, heart rate, calories and sleep. We use this data only to provide and improve fitness features of the Services. We do not use it for advertising, we do not sell it, and we do not share it with third parties for advertising or data brokerage.

Use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. You can disconnect these integrations at any time in your device settings.

We may create data that has been aggregated or de-identified so that it can no longer reasonably identify any individual. We use this data to measure program impact, produce benchmarks and research insights, report to Institutions and partners, and develop and improve our products. Because this data does not identify individuals, it is not personal data, and we may retain and use it after an account is deleted.

Health data and data relating to children are treated as sensitive. We process them only with explicit consent (from you, or from a parent or guardian for students) or where otherwise permitted by law. You can withdraw your consent at any time through the app settings or by contacting us. Withdrawal does not affect processing carried out before it, but some features may stop working.

Personal data is stored on servers located in the Kingdom of Saudi Arabia. If personal data is transferred outside the Kingdom, we do so only in accordance with the PDPL and its regulations on cross-border transfers, with appropriate safeguards.

We use technical and organizational measures designed to protect personal data, including encryption in transit and at rest, role-based access limited to staff who need it, access logging, and security controls with our service providers. No system is completely secure. If a personal data breach occurs that requires notification, we will notify the competent authority and affected individuals as required by law.

• Active accounts: for as long as the account is active, or as set out in our agreement with your Institution.
• Institution programs: within 90 days after an Institution's agreement ends, we delete or de-identify program data, unless the Institution renews or asks us to return it.
• Inactive individual accounts: deleted after 24 months of inactivity.
• Camera data: as described in Section 7.
• Transaction and invoice records: for the period required by applicable tax and commercial laws.
• Support communications and demo requests: 24 months.
• De-identified and aggregated data: may be kept indefinitely (Section 11).

Subject to the PDPL, you have the right to:

• be informed about how your personal data is collected and used;
• access your personal data;
• obtain a copy of your personal data in a clear and readable format;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data when it is no longer needed;
• withdraw your consent at any time;
• lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

To exercise your rights, email support@ata7adak.com. We will verify your identity and respond within 30 days. Parents and guardians may exercise these rights on behalf of their children. For accounts provided by an Institution, we may handle your request together with that Institution.

We will delete your personal data within 30 days of verifying your request. We may keep: (a) records we must retain by law, such as invoices; (b) de-identified and aggregated data; and (c) data that your Institution is entitled to keep under its agreement with us. Deleted data cannot be recovered.

Our website uses essential cookies needed for it to work, and analytics tools, such as Google Analytics, to understand how visitors use the site. Where required, we ask for consent before setting non-essential cookies. You can control cookies through your browser settings.

We may update this Policy from time to time. We will post the updated version with a new version number and effective date. If changes are material, we will notify users through the app or by email, and notify Institutions, before the changes take effect.

If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

This Policy is available in Arabic and English. In case of any conflict between the two versions, the Arabic version prevails.