Legal
Data processing agreement
Draft, under owner review. This agreement describes how we handle personal data we hold on behalf of an internet provider that uses X-Radius. Values in square brackets are still to be confirmed, and this page is not indexed until they are.
1. Who this is between, and when it applies
This agreement is between the business that holds an X-Radius licence ("you", the controller) and [company legal name], registered in the Arab Republic of Egypt under commercial registration no. [number] ("we", the processor). It forms part of the terms of service.
It applies whenever we hold personal data that belongs to your system: when we host your instance, when your encrypted backups are sent to us, and during a support session you open. If your instance runs on your own server and you send us neither backups nor support access, we hold none of your subscribers' data and this agreement has nothing to act on.
2. What is processed
| Item | What it covers |
|---|---|
| People the data is about | Your internet subscribers; your staff and resellers who sign in to the panel; people who contact you through tickets or your subscriber portal. |
| Subscriber data | Name, username, password, phone, email, address, and any identity details you choose to collect (for example a national ID number); plan, balance, invoices and payments; support tickets. |
| Usage data | Session records: login and logout times, the IP address assigned, the device MAC address, the router it came through and the amount used; the authentication log. |
| Staff data | Name, username, contact details, permissions, and the System Log of what each staff account did. |
| Purpose | Running your billing and access control, and nothing else: authenticating subscribers, applying plans and limits, billing, sending the notifications you set up, backups and support. |
| Duration | For as long as your licence runs, and then until deletion as described in section 10. |
3. Processing only on your instructions
We process your data only to provide the service you licensed and on your documented instructions. Your use of the panel and its settings, these terms and anything you put to us in writing are those instructions. We do not use your data for any purpose of our own, do not sell it, and do not combine it with data from other customers.
If we believe an instruction breaks the law, we will tell you before acting on it. If the law requires us to process your data in a way you did not instruct, for example to answer a court order, we will tell you first unless the law forbids it.
4. People who can see it
Only our staff who need it to run or support the service can reach your data, and each of them is bound by a duty of confidentiality. Support access to your instance is not standing: it is opened for a task, and every session is recorded.
5. How it is protected
The measures in place today are:
- HTTPS for every connection to the panel, the subscriber portal and our licensing system.
- Separation between providers enforced by the database itself (row-level security), so that a query cannot reach another provider's rows even if the application code above it is wrong.
- Staff passwords stored as a one-way hash, optional two-factor sign-in, sessions that can be revoked, and an automatic lockout after repeated failed logins.
- Permissions per staff role, and a System Log of what each staff account did.
- Backups encrypted on your instance before they leave it.
- Any password typed at a refused login, where you have chosen to record it, erased after 7 days.
Some data is stored in readable form because the service needs it that way: subscriber passwords, which the most common router login methods (CHAP and MS-CHAP) can only check against the original, and prepaid card codes and passwords. Section 9 of the privacy policy lists these. You should tell your subscribers about them.
6. Sub-processors
We use the following third parties to provide the service.
Each one is bound by terms at least as protective as this agreement.
| Sub-processor | What for | What it receives | Where |
|---|---|---|---|
| [Hosting provider] | Servers for hosted instances and for our licensing system | Everything in a hosted instance, at rest on its disks | [Country / region] |
| Email (self-hosted) | Email we send ourselves: signup, licence and account notices from X-Radius. Notification email your instance sends to your subscribers goes through your own SMTP server, not this one. | Recipient address and the message. The mail server is our own; the message then travels to the recipient's email provider. | [Same as hosting] |
| Google (Firebase Cloud Messaging) | Push notifications from the X-Radius-owned mobile apps and browser notifications. If you connect your own Firebase project, pushes sent through it are not covered by this row. | A device token and the notification text | [Google regions, to confirm] |
| Google (Google Drive) | Off-site copies of backups | Backup files, encrypted before upload; Google cannot read them | [Google regions, to confirm] |
| Cloudflare | DNS for instance addresses and TLS certificate issuance | Host names and server IP addresses [confirm: no subscriber data] | [Global] |
The payment gateways, SMS, WhatsApp and Telegram channels, your own SMTP server, your own Firebase project, and your own cloud storage are not our sub-processors: you choose them, you hold the accounts and you give the instance their credentials.
We will tell you at least [number] days before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot meet the objection, you may end the licence and receive a refund of the unused part of the term.
7. Transfers outside Egypt
Where a sub-processor above handles data outside Egypt, the transfer is made on the basis set out here: [legal basis, licence or permit reference]. You can ask us at any time where your instance runs, and we will answer for your instance specifically.
8. Personal data breaches
If we become aware of a breach affecting your data, we will tell you without undue delay and in any case within 72 hours. The notice will say what happened, what data and roughly how many people are involved, what we have done to contain it, and who to contact. Where we do not yet know everything, we will send what we know and follow up as we learn more.
We will help you meet your own duty to notify the Personal Data Protection Center and the people affected, and we will not notify them on your behalf unless you ask us to or the law requires it.
9. Helping you answer requests
Your subscribers' requests to see, correct or delete their data are yours to answer, and the panel has the tools to do it. If one reaches us, we will pass it to you and not answer it ourselves. Where you need our help, for example with an assessment or a question from the Center, we will give it [at no extra charge / at our standard rates].
On request, we will give you the information you reasonably need to show that this agreement is being kept, and allow an audit once a year on [number] days' notice.
10. Return and deletion when the licence ends
Take your export before the licence ends: while it is in force and the panel is not blocked, the panel exports a full SAS4-format backup and its CSV or XLSX lists. The panel is blocked, and its exports refused, once the licence ends, and also while the licence is disabled or your subscriber count is at the licence cap, as described in section 3 of the terms. For [number] days after the licence ends, we will return a full SAS4-format backup of your data to you on request. After that, we delete your hosted instance and its database within [number] days, and the backups we hold within [number] days. We will confirm the deletion in writing on request.
We keep only what the law requires us to keep, such as licence and invoice records, which contain no subscriber data.
11. Liability and governing law
The liability provisions of the terms of service apply to this agreement. If this agreement and the terms differ on how personal data is handled, this agreement prevails. It is governed by the laws of the Arab Republic of Egypt, and disputes go to the forum named in the terms.