Privacy Policy

Who is responsible

FOFA supports academic training administration for the Faculty of Fine Arts, Capital University (formerly Helwan University), Egypt. The responsible institution determines why and how personal information is processed. Contact the training team at the email below for privacy requests and to obtain the confirmed legal entity, postal address, and designated privacy contact.

This notice describes the implemented portal. The institution must confirm its formal controller details, lawful grounds, retention schedule, service-provider arrangements, and any required authorisations before adopting this notice as final.

Information we process

The portal processes information supplied by the institution, users, and participating firms. Please avoid including unnecessary personal information about yourself or others in uploaded work.

• Identity and account information: student ID, name, university email, faculty, department, program, academic term, authentication identifiers, and session information. Authentication is managed through Supabase; application administrators should not request your password.
• Academic and training records: subject grades, GPA, eligibility results, preferences, application timestamps, change history, lock status, allocations, attendance, trainer reports, completion reviews, certificates, and related administrative decisions.
• Portfolio information: uploaded PDF files, file names and storage references, evaluation scores, written feedback, academic term, and processing status.
• Firm information: business and contact names, email, phone, address, city, industry, training description, available capacity, duration, and approval status. A business contact’s details can be personal information.
• Operational records: administrative activity, authentication and error information, request metadata, and service-provider logs where generated.

Why information is used

Information is used to authenticate authorised users, maintain academic records, calculate training eligibility, process preferences, manage firms and opportunities, allocate places, communicate about account setup and support, prevent misuse, investigate errors, and maintain accountability.

The institution must identify and communicate the applicable legal ground for each purpose under Egyptian law. Accepting terms or continuing to browse is not treated as blanket consent to all processing. Where consent is required, it must be specific and capable of withdrawal; withdrawal does not automatically erase records subject to a lawful retention obligation.

Optional AI portfolio processing

The portal can send a PDF portfolio and academic term to Google Gemini for scores and feedback about design, technical competence, presentation, process, and originality. This is a separate processing purpose from storing your portfolio. The interface asks you to opt in before making an AI evaluation request.

Do not upload identity documents, medical information, confidential client material, or other sensitive information into a portfolio. Obtain permission for third-party material and remove unnecessary identifying details.

AI outputs can be inaccurate, inconsistent, or incomplete. You can ask the training team for a human review or an alternative assessment route. AI portfolio scores are not used by the current automatic placement algorithm. Declining optional AI evaluation does not prevent portfolio upload or application submission.

Withdrawing permission stops future optional requests once acted on; it cannot undo a request already processed. Ask the team about existing copies and provider retention. Provider training use, retention, region, and contractual protections must be verified for the actual Gemini service tier; this notice does not promise that submitted data is never retained or used by a provider.

Who may receive information

Authorised institutional staff access information needed for training administration. University-assigned company accounts may access their own project plans, messages, files and assigned student training records. Department coordinators access only their assigned departments. Photos and posters selected for approved, published announcements become public; private student reports remain restricted.

Technical providers include Supabase for authentication and database services, AWS S3 for portfolio storage, Amazon SES for account emails and Amazon SNS for bounce/complaint alerts, Google Gemini for optional AI assessment, and Upstash Redis if configured for invitation throttling. Hosting and email-delivery providers may also handle information needed for their services. The institution must maintain the actual provider list and contracts.

Information may also be disclosed where lawfully required, to investigate misuse, or to handle a legal claim. Personal information is not offered for sale through the portal.

Hosting and transfers outside Egypt

Providers may process or store information outside Egypt. The institution must confirm the actual hosting regions, subprocessors, transfer conditions, and any permits or other safeguards required under Egyptian law before transferring data. An account checkbox alone does not establish that a cross-border transfer is lawful.

How long records are kept

Academic, training, application, allocation, and administrative records may be retained to administer the program, handle review requests, meet recordkeeping duties, and resolve disputes. Portfolios, evaluation results, logs, backups, and authentication records may have different retention periods.

Email-request rate limits store hashes of request identifiers and network addresses, rather than raw addresses or verification tokens. Entries older than 24 hours are removed when another email request is processed; if requests stop, entries remain until that cleanup next runs. No general automatic deletion schedule has been established for other application records. The institution must set and communicate a category-specific retention schedule and arrange deletion or anonymisation when information is no longer required. Replacing a file or deactivating an account does not necessarily remove previous versions, provider logs, or backups. Contact the team for the applicable period and deletion procedure.

Your information and requests

Subject to applicable law and relevant exceptions, you may request access to your information, correction of inaccuracies, deletion, restriction or objection where available, and withdrawal of consent where processing depends on it. You may also request clarification or human review of disputed qualifications, evaluations, or placements.

Send a request to the contact below, identifying the record and the action requested. Use your university email where possible; the team may need to verify identity without collecting excessive additional information. Do not email your password. The institution should explain its decision and any lawful reason for retaining a record.

You may raise unresolved data-protection concerns with the competent Egyptian authority through its current official procedures. This notice does not limit mandatory legal rights or institutional appeal routes.

Security and confidentiality

The application uses authenticated sessions, permission checks, and temporary storage URLs. The institution remains responsible for database policies, staff access, provider configuration, secure backups, monitoring, and incident response. No system can guarantee absolute security.

Report suspected unauthorised access promptly to the team. Do not share login credentials or signed portfolio links. Legal notices do not replace correcting technical vulnerabilities.

Age and academic eligibility

Access is restricted to institution-recognised students aged 18 or over who have completed their second year. The portal is not offered to children. Staff must verify institutional eligibility before provisioning access; a checkbox is an acknowledgement, not independent age verification. If information about someone under 18 is submitted in error, contact the training team so access and retention can be reviewed.

Cookies and browser storage

Authentication uses essential browser storage and cookies. The current application does not include advertising, behavioural analytics, or social-media tracking. Read the Cookies Policy for storage purposes and controls.

Changes and contact

Material changes to purposes, recipients, or optional processing should be communicated before taking effect, with fresh permission obtained where required. The displayed update date records this notice’s revision, not a declaration that all institutional requirements have been completed.

Contact the training team

Faculty of Fine Arts, Capital University (formerly Helwan University)
Arab Republic of Egypt
training.program.help@gmail.com