Data Processing Agreement

1. Roles of the parties

You are the controller of the personal data you upload or generate about your students and staff and you determine the purposes and means of its processing. Classario is the processor and acts only on your documented instructions, which include your use of the product's features. For our own account, billing, security and website data we act as an independent controller under our Privacy Policy.

2. Subject matter, duration and instructions

The processing covers provision of the Classario platform for as long as your subscription is active, plus the deletion period in section 10. Your instructions are given through the Terms, this DPA and your configuration of the product. We will tell you if, in our opinion, an instruction infringes applicable data-protection law.

3. Nature and purpose of processing

Hosting, storing, transmitting and displaying learning content and class records; running live video lessons; scheduling; generating lesson drafts with AI on your instruction; sending transactional email on your behalf; and providing support.

4. Categories of data subjects and personal data

Data subjects: tutors, school staff, students and, where applicable, guardians.

Personal data: identifiers such as name and email; role and space membership; scheduling and attendance; lesson content, submitted work, feedback and grades; and technical usage data. You must not upload special-category data unless you have a lawful basis and have told us in writing beforehand.

5. Our obligations as processor

• Process personal data only on your documented instructions, unless required otherwise by law, in which case we will inform you unless legally prohibited.
• Ensure personnel authorised to access personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures, including encryption in transit and at rest, row-level access control, encrypted storage of integration tokens, least-privilege staff access and audit logging.
• Assist you, so far as reasonably possible, with data-subject requests, data-protection impact assessments and consultations with supervisory authorities.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information reasonably available to us.
• Make available information reasonably necessary to demonstrate compliance and allow audits as described in section 9.

6. Sub-processors

You give general authorisation for Classario to engage the sub-processors below. Each is bound by written terms no less protective than this DPA, and we remain responsible for their performance. We will give notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service.

7. Artificial intelligence and model training

Classario does not use your personal data, or your students' personal data, to train or improve foundational or generalised AI models, and does not permit its AI providers to do so.

The only data sent to an AI provider is the lesson brief a teacher submits to Cleo AI — interface language, subject, topic, optional focus, level, duration and whether homework is wanted. Student records, submissions, grades, uploaded files and contact details are never included.

Data received from Google Workspace APIs, including Google Calendar, is held in a separate code path and is never transmitted to an AI provider for any purpose, in line with the Limited Use requirements of the Google API Services User Data Policy.

8. International transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, the transfer is made under an adequacy decision or under Standard Contractual Clauses together with appropriate supplementary measures. The Standard Contractual Clauses are incorporated into this DPA by reference where they apply.

9. Audits

On reasonable written notice, and not more than once in any 12-month period unless a supervisory authority requires otherwise or a breach has occurred, we will respond to a reasonable security questionnaire and provide available documentation on our security measures, subject to confidentiality and to not compromising the security of other customers.

10. Return and deletion

You may export your data at any time while the subscription is active. On termination we delete or irreversibly anonymise personal data processed on your behalf within 90 days, except where retention is required by law.

11. Liability and contact

Liability under this DPA is subject to the limitations in the Terms of Service.

Data-protection enquiries: support@classario.com

Lenedo Tech FZ-LLC, Dubai, UAE (Trade Licence No. 105312, Free Zone Limited Liability Company)

HD88C, First Floor, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates