Privacy Policy

This Privacy Policy describes how Univo collects, processes, stores, and protects personal data on three platforms: the Univo web application, the Univo instructor app, and the Univo student app. It is established in accordance with Algerian Law No. 18-07 on the protection of individuals with regard to the processing of personal data, as amended and supplemented by Law No. 25-11, and it describes your rights and the choices available to you.

The controller of the personal data processed on the Univo web application, the Univo instructor app, and the Univo student app is: Chihab Eddine Drissi, operating as an auto-entrepreneur, Cité 100 Logements El Anasser, Bordj Bou Arréridj (BBA), Algeria. Contact: univo@drissi-consulting.dz.

This Privacy Policy covers all three platforms: the Univo web application (the instructor/admin dashboard), the Univo instructor app, and the Univo student app.

Data Protection Officer (DPO)

In accordance with Law No. 18-07, the controller has designated a Data Protection Officer (DPO), who serves as the designated point of contact for user privacy inquiries and for the National Authority for Personal Data Protection (ANPDP).

DPO: Chihab Eddine Drissi, Contact: univo@drissi-consulting.dz.

You may contact the DPO at any time for any question relating to the processing of your personal data or to the exercise of your rights.

Univo collects only the data necessary for the purposes described below. The data collected varies depending on the platform used.

Web Application

• Account details: name, email address, role, academic titles and rank, and, for students, matricule, year, major, section, and group.
• Authentication data: password (stored in encrypted form), session tokens, IP address, and browser data (user-agent).
• Institution data: the name and type of your academic institution.
• Teaching data: courses, classes, schedules, class targets, and student lists you import.
• Attendance data: attendance sessions and attendance records (present, absent, justified absence).
• Subscription and payment data: chosen plan, subscription status, and start and end dates.

Instructor App (mobile)

• The same account and authentication data as the web application.
• Device information and the technical telemetry necessary for the app to function.
• If you enable push notifications, a device token used solely to deliver those notifications (revocable at any time in your device settings).

Student App (mobile)

• The same account and authentication data as the web application.
• Camera access, used solely to scan the attendance QR code displayed by your instructor. No images are stored from this use.
• Optional location data, only if the geofencing feature is enabled, used to verify proximity to the classroom. This feature is optional and can be disabled at any time.
• If you enable push notifications, a device token used solely to deliver those notifications.

Sensitive and Biometric Data

Absence justification documents. When an absence is justified with a document (medical certificate, death certificate, marriage certificate, birth certificate, military service summons, official summons, or force majeure proof), that document may contain health-related or other sensitive information within the meaning of Law No. 18-07. These documents are processed exclusively for the purpose of recording and validating justified absences, with your explicit consent, and are subject to restricted access and enhanced protection.

Biometric data. Univo does not collect facial recognition data, fingerprints, or any other biometric data.

Processing Purposes

• Providing, operating, and securing the three platforms (service performance).
• Account and identity management.
• Attendance recording and reporting.
• Subscriptions and billing.
• Sending transactional emails (verification, password reset).
• Aggregated, anonymized analytics to improve the services.
• Advertising and campaign measurement: which pages are visited and which actions (sign-up, trial start, subscription) follow an ad click, using the Meta Pixel.

The processing of your data is based on the following legal grounds:

Your express opt-in consent, where we request it (for example, push notifications or the processing of sensitive absence justification documents);

Contractual necessity, for the performance of the services you subscribe to (account management, attendance recording, scheduling);

Compliance with legal and regulatory obligations;

Legitimate interest, for the security of the services, fraud prevention, and service improvement, always weighed against your rights and freedoms.

ANPDP Declaration

Before launching processing activities, the controller has submitted, or is in the process of submitting, the mandatory declaration to the ANPDP in accordance with Law No. 18-07 as amended by Law No. 25-11. The ANPDP filing reference will be published on this page once issued.

In accordance with Law No. 18-07, you have the following rights, which you may exercise by writing to the DPO at univo@drissi-consulting.dz.

Right of Access and Information

You may request confirmation that your personal data is processed, the categories of data processed, the recipients or categories of recipients, and an intelligible copy of your data, free of charge. We respond within the time limits provided by law.

Right to Rectification and Erasure

You (or your legal heirs) may request that inaccurate or incomplete data be corrected, updated, or completed, and that unlawfully processed data be deleted. Requests are processed within the statutory ten (10) working-day period. To exercise this right, send your request to univo@drissi-consulting.dz, specifying the data concerned.

Right to Object and Marketing Opt-Out

You may object, on legitimate grounds relating to your particular situation, to the processing of your data, and you may at any time and without charge opt out of direct commercial communications or automated push notifications. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Recourse to the ANPDP

If you consider that your rights have not been respected, you may lodge a complaint with the National Authority for Personal Data Protection (ANPDP) or seek any other judicial remedy provided for by Algerian law.

Mobile In-App Notices

Before any data collection begins, the mobile applications display a prior information notice and request your express opt-in consent within the application. Collection never starts without this prior notice and consent.

Children's Consent

The platforms are not directed at minors, and the personal data of minors may only be processed with the verified authorization of their legal representative or of a competent judicial authority, in accordance with Law No. 18-07. Univo does not knowingly collect the personal data of minors without such authorization.

Third-Party Sharing (Sub-Processors)

Your data is shared only with service providers acting as sub-processors under contract, who undertake to comply with confidentiality and data protection obligations. The main sub-processors are:

• Amplitude, Inc: product analytics (aggregated usage and behavior data) United States;
• Meta Platforms, Inc: advertising measurement and remarketing through the Meta Pixel (page paths, click identifiers, IP address, user-agent, cookie identifiers, and the conversion events listed above), United States;
• DzSecurity: hosting of the Univo servers, Algeria;
• Algérie Télécom, telecommunication and network infrastructure connecting the platforms.

International Transfers

The Univo servers are hosted in Algeria by DzSecurity. However, some service providers, such as the analytics provider Amplitude and the advertising measurement provider Meta, are located outside Algeria. Where personal data is transferred outside Algeria, Univo relies on your express consent, on contractual clauses binding the recipient to appropriate safeguards, and on any prior authorization required from the ANPDP under Law No. 18-07.

Cookies and Tracking Technologies

The web application uses strictly necessary cookies to keep you signed in and to remember your language and appearance preferences. These cannot be disabled without breaking the service.

The Meta Pixel also sets advertising cookies (such as _fbp) so that page visits and the events described above can be measured, and so that ads can be shown to people who have visited the site. The pixel runs on every page, including the signed-in dashboard, and reports the page path, click identifiers (fbclid), IP address, user-agent, and cookie identifiers. It never receives student names, email addresses, matricules, or attendance records, and our event parameters contain no such data. If automatic advanced matching is enabled in Meta Events Manager, the email address typed into a sign-up or checkout form may be hashed in your browser by Meta and used only for matching.

You can block or delete these cookies in your browser settings, use a content blocker, or manage advertising in Meta's ad preferences. Blocking the pixel does not affect the service. Because this feature relies on a provider located outside Algeria, you may withdraw your consent to that transfer at any time by writing to the DPO.

Storage Limitations (Retention)

• Account data: kept for as long as your account is active, then deleted or anonymized upon deletion request.
• Attendance records and schedules: kept for three (3) academic years after the end of the academic year in which they were recorded.
• Absence justification documents: kept for one (1) academic year after the academic year in which the justification was recorded, or longer if required by the academic institution's rules.
• Session and authentication data: session tokens up to 30 days; password reset tokens 1 hour; connection logs (IP, user-agent) up to 24 months.
• Analytics data: aggregated and kept for up to twenty-four (24) months, then deleted or anonymized.

Security and Breach Notifications

We implement appropriate technical and organizational measures, including encryption in transit (TLS), encryption of passwords, access logging, restricted access to sensitive documents, and periodic security reviews. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify the ANPDP and you, in clear language, as required by Law No. 18-07.

Profiling and Automated Decisions

Univo does not use automated processing or profiling that produces decisions having legal effects or significantly affecting you. Any absence-threshold alerts or reports are based solely on recorded attendance data and are always subject to human review by your instructor or institution.

For any question concerning this Privacy Policy or the processing of your personal data, or to exercise your rights, contact the DPO:

Chihab Eddine Drissi: univo@drissi-consulting.dz, El Anasser, Bordj Bou Arréridj (BBA), Algeria.