Draft — under legal review

Data Processing Addendum

This addendum applies when ClassesPlatform processes personal data on behalf of a school.

Roles

The school is the controller of its students' data, and ClassesPlatform is its processor.

Processing

We process student data only to deliver the service the school has configured, and only on the school's documented instructions.

Security

Data is encrypted in transit and at rest, each school's data is isolated from every other school's, and access to proctoring images is limited to the school's authorised staff and logged.

Subprocessors

We use the subprocessors listed on our subprocessors page and will give notice before adding new ones.

Deletion

When a school's account ends, we delete its data after the agreed retention period.