UNIVO LMS+ Privacy and Data Processing Notice

This Notice is issued by Business Circles for Technology and Innovation ("UNIVO"). Part A is for institutions. Part B is for students and staff.

The institution is the controller of the data it uploads or connects to LMS+ and of how it uses LMS+ insights. UNIVO processes that data as processor, on the institution's documented instructions. UNIVO is an independent controller only for its own customer account, billing and contract data. Employers are independent controllers of profile data a student chooses to share with them.

Identity and enrolment data, academic data (courses, submissions, grades, attendance, credentials), learning activity data (records of activity in courses, such as views, launches and attempts), communications, staff account data, Flamo interactions, and, only as described in A3, wellbeing data. Wellbeing data is treated as sensitive data. Data of users under 18 is processed only after the institution confirms guardian consent.

Wellbeing, mood and journal data from a student's UNIVO account never flows to the institution without that student's separate, explicit and revocable opt-in, given apart from any other consent. By default, institutional views of wellbeing are cohort-level aggregates, shown only where a cohort is large enough that no individual can be identified. Individual-level wellbeing visibility is limited to the counselor role and only for students who have opted in. Every counselor view of individual data is logged. Withdrawal stops the flow immediately.

UNIVO uses sub-processors for hosting, the AI model behind Flamo, email delivery and card payments (noon payments). The current list, with each provider's role and location, is published at univo.now/lms/subprocessors. UNIVO gives institutions 30 days' notice of a new sub-processor. An institution may object on reasonable data protection grounds. If the objection cannot be resolved, the institution may terminate the affected Order Form, treated as termination under Terms Section 8.3.

The hosting region for each institution is stated in its Order Form and on the sub-processor list. Egypt: data is transferred outside Egypt only as permitted by Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, including any licence or permit the Personal Data Protection Center requires. Saudi Arabia: data is transferred outside the Kingdom only as permitted by the Personal Data Protection Law and its transfer regulations, and data of Saudi government bodies is hosted where applicable government rules require. Self-hosted Path B data stays in the institution's environment.

UNIVO applies encryption in transit and at rest, role-based access enforced on the server, audit logging of staff access to individual-level data, least-privilege access for UNIVO personnel and regular backups. Security documentation is available to institutions on request under confidentiality.

UNIVO notifies the institution without undue delay and within 24 hours after confirming a personal data breach affecting its data, and supports the institution's notifications to the Egyptian Personal Data Protection Center or the Saudi Data and AI Authority within their deadlines.

UNIVO helps the institution answer data subject requests within legal deadlines. On request during the term, UNIVO deletes specified data within 30 days. On termination, return and deletion follow Terms Section 8.4. Audit rights are satisfied first by documentation. If that is insufficient, the institution may conduct one audit per twelve months, on 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and additionally where a regulator requires it or after a breach.

UNIVO will: process only on documented instructions and tell the institution if an instruction appears unlawful; bind personnel to confidentiality; maintain the measures in A6; impose equivalent obligations on sub-processors and remain responsible for them; assist with requests, impact assessments and regulator enquiries; keep processing records; hold the registrations and licences the law requires; and delete or return data at the end of processing. These obligations are statutory and are not reduced by the Terms. The full DPA is a separate signed schedule.

Your institution decides how your data is used in LMS+. UNIVO runs the technology for it.

Your mood check-ins, your personal wellbeing trends and your journal. Flamo alerts are computer estimates and can be wrong. They do not replace a counselor or a doctor. If you are in danger, contact local emergency services.

You can switch sharing off at any time in your privacy settings. From that moment your counselor can no longer see your individual data. Notes your institution already made are kept under its own policies.

Your institution must get consent from your parent or guardian before your account is switched on.

Depending on the law that applies to you, you can ask to be informed, to see or get a copy of your data, to correct it, to delete it, to object, and to withdraw consent. Send requests to privacy@univo.now. Requests about data your institution controls may be passed to your institution. You can complain to the Personal Data Protection Center in Egypt or to the Saudi Data and AI Authority in Saudi Arabia.