Your data with us

Who we are

• GoBachaloria (جوبكالوريا) is an online school in Egypt for Bachaloria students. We are the "controller" of your data in the law's sense: we decide why and how it is used, and we answer for it to you and to the Personal Data Protection Centre.
• We have a data protection officer, reachable at the email at the bottom of this page.

What we collect

• Account: your name, email and picture from Google, your phone number, school year, track and school type.
• Your parent: their name, relation to you and phone number — required before you use the platform.
• Learning: lessons watched and progress, live-session attendance, homework and exam answers, points and certificates.
• In live sessions: if you turn on your camera or microphone, your picture and voice reach the teacher and classmates in that session. Turning them on is optional.
• Help messages: what you write to support, and any voice notes, pictures or videos you send with it.
• Payments: codes and cards you redeemed, orders and invoices. Online card payments are handled by our payment company (Paymob) — we never see or store bank card numbers.
• Device and sign-in: device and browser type, IP address and sign-in times — to keep your account safe and fix problems.

Why, and on what basis

• To provide the service you signed up for: open your lessons, record attendance and progress, let your teacher mark and follow your work, answer your questions, issue invoices.
• Because the law requires it: for example keeping money records for tax.
• To protect your account and the platform: detecting someone using an account that isn't theirs, or sharing one.
• With your parent's consent: for example the weekly report sent to your parent on WhatsApp, and any offers.
• We do not sell your data, and we do not use it for third-party advertising.

If you are under 18

• The law treats anyone under 18 as a child, and children's data as sensitive data with extra protection. So nobody under 18 uses the platform without their parent's or guardian's consent.
• We ask for the parent's name, relation and phone, and that consent, before anything else — and we may contact the parent on that number to confirm they really agree.
• A parent may at any time see, correct or delete their child's data, or withdraw consent — from their number or the account's email.
• We collect from a child only the data needed for studying.

Who sees your data

• Teachers: only their own students' work — homework, exams, attendance and progress in their subject.
• School staff: only what their role needs (support, accounts, management), and everything they do is logged.
• Your parent: a report on your attendance and progress, through a private link sent to their phone that stops working after 14 days.
• Companies that run the platform for us, on our instructions only: hosting (Vercel), database (Neon), email (Resend), file storage (Cloudflare R2), error monitoring (Sentry), payments (Paymob), sign-in (Google) and live sessions (Jitsi, Zoom and Google Meet). They are bound to protect the data and use it for nothing else.
• A public authority: only under a lawful order.

Data kept outside Egypt

• Some of the companies above have servers outside Egypt (in the US and Europe). We transfer data to them under the conditions the Data Protection Law sets for transfers abroad, choosing companies whose protection is no lower than Egyptian law requires.
• A parent's consent to this policy includes explicit consent to that transfer.

How long we keep it

• Account and learning data: for as long as your account exists.
• Help messages: the words stay; voice notes, pictures and videos are permanently deleted 14 days after the question is closed, leaving a written summary of what happened.
• When you delete your account: your personal data is deleted or anonymised within 30 days.
• Money records (orders and invoices): the Unified Tax Procedures Law requires us to keep them for 5 years, so they are kept for that period and used for nothing else.
• Sign-in and security logs: for a limited period, as long as security needs them.

Your rights

• Know what data we hold about you, see it and download it: press «Download my data» on your profile page.
• Correct or complete it: edit your name and number on your profile page, or contact us.
• Delete it: press «Delete my account» on your profile page; the office confirms and deletes within 30 days.
• Object to a particular use, or ask us to limit it to what the service needs.
• Withdraw your consent at any time — you may then no longer be able to use the platform.
• Be told if a breach affected your data.
• We answer any of these requests within the period the law sets, free of charge. If you believe your rights were not respected, you may complain to the Personal Data Protection Centre.

Messages and cookies

• We send messages the service needs (the bell, email, WhatsApp): a live-session time, an answer to your question, an invoice. Offers only with your consent, and you can stop them at any time.
• The site uses only necessary cookies: to keep you signed in and remember your language and theme. No advertising cookies.

Security

Connections are encrypted, sign-in is through Google, and staff access is limited to what their work needs and logged. No system is 100% secure: if a breach affects your data, we will notify the Personal Data Protection Centre within 72 hours as the law requires, and tell you and your parent without delay, with what we did about it.

Changes

We will update the date below, tell you inside the platform beforehand if a change is significant, and ask for fresh consent where a change needs it.