Data Processing Agreement

This Data Processing Agreement ("DPA") is made under Article 28 of the EU General Data Protection Regulation (GDPR). It applies when a studio or class-based business ("controller", "you") uses the clssrm service and personal data is processed by Oasome Services Ltd (16 Leocharous, 3086 Limassol, Cyprus, company no. HE 431352) ("clssrm", "processor", "we") on the controller's behalf. Where clssrm acts as controller — for website visitors and clssrm account holders — see the Privacy Policy instead.

1. Subject matter and duration

• Subject matter: operation of the clssrm service — recurring class schedules, student and instructor management, class rosters, bookings, attendance, and simple payment records — as described in the Terms of Service.
• Duration: for the duration of the controller's clssrm subscription or workspace account, until processing is completed.

2. Nature and purpose

The processor processes personal data only to provide the clssrm service to the controller, in accordance with the controller's documented instructions (the Terms of Service, workspace settings, and actions taken through the clssrm interface).

3. Categories of personal data and data subjects

• Data categories: identification and contact details of students (including, where classes are attended by children, data concerning minors), guardians and emergency contacts, instructors and studio staff contacts, class schedules, bookings, attendance records, and manual payment records (amount, date, cash/card method, note). Payment card details are not processed by clssrm; they are handled by Stripe.
• Data subjects: students, guardians and parents, instructors, and studio staff or contacts.

4. Processor obligations

• Process personal data only on the controller's documented instructions, and inform the controller if an instruction infringes the GDPR.
• Ensure that persons authorised to process the data are under a duty of confidentiality (whether contractual or statutory).
• Implement appropriate technical and organisational security measures consistent with GDPR Article 32 (encryption in transit via TLS, access controls, and regular testing of the measures), taking into account the state of the art and the risks of the processing.
• Sub-processors: the controller gives prior general authorisation for the subprocessors listed in the clssrm Privacy Policy ("Sub-processors"). The processor will notify the controller of any intended changes at least 30 days in advance, and the controller may object to a new subprocessor and terminate the affected service in accordance with the Terms of Service. The processor remains liable to the controller for subprocessor obligations.
• Assist the controller with data subject rights requests (access, rectification, erasure, restriction, portability, objection) and with data protection impact assessments and prior consultations, taking into account the nature of the processing.
• Notify the controller of a personal data breach without undue delay after becoming aware of it.
• At the end of the provision of services, delete or return all personal data to the controller and delete existing copies, unless EU or member state law requires storage.
• Make available all information necessary to demonstrate compliance with this DPA, and allow audits by the controller or its auditor, at most once a year with 30 days' notice, or more often if a supervisory authority requires it.

5. International transfers

Where subprocessors are located outside the European Economic Area, transfers are based on the European Commission's Standard Contractual Clauses (SCCs), or on an adequacy decision where one applies, including the EU-US Data Privacy Framework. The full subprocessor list with data locations is in the clssrm Privacy Policy: clssrm.app/privacy#sub-processors.

6. Controller obligations

• Ensure that the processing (including any data about minors, where applicable) is lawful and that you have obtained any required consents from students, guardians, or other data subjects.
• Provide accurate, complete, and up-to-date instructions and data, and keep them current through the clssrm workspace.

7. Signatures

Agreed by acceptance of the Terms of Service and use of the clssrm service.