Data Processing Agreement

Last updated: 21 October 2026

1. Parties and Scope

This Data Processing Agreement ("DPA") is between your educational institution ("Institution", "Controller") and ClassBuddy ("Processor", "we", "us"), and applies wherever ClassBuddy processes personal data on the Institution's behalf as part of the ClassBuddy platform and mobile app. It forms part of, and is incorporated into, the Institution's agreement to use ClassBuddy.

2. Subject Matter and Duration

ClassBuddy processes personal data for the duration of the Institution's subscription, for the purpose of providing student, class, billing and communication management services described in the main service agreement.

3. Categories of Data Subjects and Personal Data

Data subjects: students, parents/guardians, teachers and staff of the Institution.

Categories of personal data: name, email address, phone number, date of birth, academic records (attendance, homework, grades, assessments), billing and payment status, device identifiers for push notifications, and any other data the Institution enters into the platform.

4. Processor Obligations

ClassBuddy agrees to:

• Process personal data only on the Institution's documented instructions, including with regard to international transfers, unless required to do otherwise by EU or Cyprus law.
• Ensure that anyone authorised to process personal data (including staff and contractors) is bound by an obligation of confidentiality.
• Implement appropriate technical and organisational security measures as required by Article 32 GDPR (see Section 6).
• Not engage another processor (sub-processor) without the Institution's prior general authorisation (see Section 5), and impose the same data protection obligations on any sub-processor via written contract.
• Assist the Institution, as reasonably requested, in responding to requests from data subjects exercising their rights under GDPR (Section 7).
• Assist the Institution in ensuring compliance with its security, breach notification, and data protection impact assessment obligations, taking into account the nature of processing and information available to ClassBuddy.
• At the Institution's choice, delete or return all personal data at the end of the subscription, and delete existing copies, unless retention is required by law.
• Make available to the Institution the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits, including inspections, conducted by the Institution or an auditor mandated by the Institution, subject to reasonable notice.

5. Sub-processors

The Institution gives ClassBuddy general authorisation to engage the following sub-processors, each bound by their own data protection terms:

• Stripe — payment processing (card/bank details, transaction data).
• Expo — push notification delivery (device token, notification content).
• SMS.to — SMS delivery to parents/guardians, only for institutions that use SMS (phone number, message content).
• Our infrastructure/hosting provider — database and application hosting.
• Sentry — crash and error reports from the mobile app, stored in the EU (device and app details, the user ID of the signed-in account).

We will notify the Institution of any intended change involving the addition or replacement of sub-processors, giving the Institution the opportunity to object on reasonable data protection grounds. Contact us to be added to this notification list.

6. Security Measures

ClassBuddy applies technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS/TLS) between users and the platform; hashed, non-reversible password storage; tenant-level data isolation, so one institution's data is not accessible to another; access to production systems restricted to authorised personnel; and regular backups.

7. Assistance with Data Subject Rights

Where a student, parent, or staff member contacts ClassBuddy directly to exercise a GDPR right (access, rectification, erasure, restriction, portability, or objection), we will either action it directly where we are able, or forward the request to the Institution promptly for it to respond, given the Institution is best placed to verify the requester's identity and relationship to the Institution.

8. Personal Data Breach Notification

ClassBuddy will notify the Institution without undue delay after becoming aware of a personal data breach affecting the Institution's data, providing the information reasonably available to us to help the Institution meet its own notification obligations under Articles 33 and 34 GDPR.

9. International Transfers

Where a sub-processor listed in Section 5 processes data outside the European Economic Area, that transfer is made subject to appropriate safeguards under GDPR (such as the European Commission's Standard Contractual Clauses), as implemented by that sub-processor.

10. Term and Data Return / Deletion

This DPA remains in effect for as long as ClassBuddy processes personal data on the Institution's behalf. On termination of the Institution's subscription, the Institution may request export of its data within a reasonable period, after which ClassBuddy will delete the Institution's personal data from its active systems, subject to any legal retention requirements and standard backup rotation.

11. Contact

Questions about this DPA, or to request a signed copy referencing your institution's agreement:

ClassBuddy
Email: [email protected]
Website: classbuddycy.com

See also our Privacy Policy and Terms of Service.