Parties, sub-processors, and obligations
This agreement is between the contracting Organization (data controller and owner) and ScaleX Innovation SARL (processor). Governing jurisdiction: Tunisia (operator); processing governed by the controlling institution's applicable law (e.g. KSA PDPL).
The processor processes personal and academic data solely to operate the AssessX platform: account and enrollment management, AI-assisted assessment, analytics, proctoring, and communications — within the scope approved by the organization.
Other disclosed sub-processors: OpenAI، Anthropic، Google، DeepSeek، Cloudflare R2، SendGrid. Each sub-processor is bound to equivalent protection controls.
Process only on the organization's instructions; apply appropriate security controls; isolate each organization's data; maintain an audit trail; and perform no deletion except by the organization's decision (see the Data Ownership Charter).
The processor assists the organization in responding to access, rectification, erasure, and consent-withdrawal requests through the in-platform governance tools.
Retention is governed by the organization's settings; the default is anonymize-not-delete; no automatic disposal is performed. A legal hold halts all disposal.
Data Protection contact: privacy@scalexi.ai. See also the Data Ownership Charter.