Data processing agreement (DPA)

This is a translation provided for convenience. If there is any difference, the Portuguese version prevails.

1. Parties and acceptance

This agreement is part of the Terms of use and is made between the teacher who subscribes to ClassMe (individual or company), who is the controller of the personal data of their students, guardians and partner teachers, and ClassMe, a service provided from Spain by the owner identified in the Legal notice, which is the processor (Spanish: encargado del tratamiento; LGPD: operador). Contact: contato@classme.win.

The teacher accepts this agreement when signing up the school, together with the terms; we keep the version and date of acceptance. If it conflicts with the terms on personal data, this agreement prevails. It meets Article 28 of the GDPR (Regulation (EU) 2016/679) and the UK GDPR and Articles 37 to 40 of the Brazilian LGPD, together with Spain’s LOPDGDD (Organic Law 3/2018).

2. Subject matter, duration and purpose

ClassMe processes school data only to provide the school’s software and infrastructure (website, schedule, credits and declared payments, classroom with whiteboard, messages, homework, reports, guardian area), for as long as the subscription lasts and, afterwards, for the period in section 11. Processing is automated: hosting, storage, encryption, backup, sending emails and notifications, real-time transmission and deletion.

ClassMe does not use school data for its own purposes, advertising, profiling, sale or training artificial intelligence. The teacher’s own customer data and Google connection data are processed by ClassMe as controller under the privacy policy and are outside this agreement.

3. Data subjects and data

• Data subjects: students, including children and teenagers; legal guardians of minors; partner teachers and invited administrators; people who ask for a trial lesson or join the waiting list; the teacher as administrator.
• Data: name, email, phone (optional), language and time zone; for minors, only month and year of birth; account and security data (password as hash only, two-step verification, sessions, a code derived from the IP); teaching data (level, goals, lessons, summaries, homework, reports, teacher’s notes); messages, attachments and whiteboard; audio and video (for minors, only with authorisation); declared payments; pseudonymised proof of authorisations; optional notification subscription.
• We do not ask for special category data. Voice and image are not used for biometrics and are not passed to artificial intelligence.

4. The teacher’s instructions

ClassMe processes the data only on the teacher’s documented instructions: this agreement and the terms, the settings in the school dashboard and written requests to contato@classme.win. The retention periods, access rules and guardian authorisation flow described in each school’s privacy policy are adopted by the teacher as instructions; if they want a different rule, they ask in writing. If an instruction breaks the law, we say so at once. If the law requires other processing, we tell the teacher first, unless the law forbids it.

5. Confidentiality

Only those who need access to provide the service (today, only ClassMe’s owner) can access the data, under a duty of confidentiality that continues after the agreement. Technical access is exceptional (support requested by the teacher, incident, abuse or legal obligation), limited and logged.

6. Security

We apply the measures in section 15, appropriate to the risk and to the fact that the school may have students who are minors (GDPR Article 32; LGPD Article 46). We may update them without lowering protection. The teacher looks after what is in their hands: password, two-step verification, devices and whom they invite to the school.

7. Sub-processors

The teacher gives general authorisation for the sub-processors in section 16. Before adding or replacing one, we notify by email at least 30 days in advance and update this page. The teacher may object on data protection grounds; if there is no solution, they may terminate without penalty before the change, with a pro-rata refund of the paid and unused period. Each sub-processor takes on, by contract, obligations equivalent to this agreement, and ClassMe remains liable for them.

8. International transfers

ClassMe is in Spain. The database is in the United Kingdom (EU adequacy decision); files and backups in Western Europe; traffic may pass through Cloudflare’s global network, including the United States (EU-US Data Privacy Framework and UK-US Data Bridge for certified companies, or the European Commission’s standard contractual clauses and the UK Addendum). For data from Brazil, the ANPD standard contractual clauses apply (LGPD Article 33, II; CD/ANPD Resolution 19/2024), incorporated into this agreement. As a supplementary measure, personal fields are encrypted in the application, with keys the providers do not hold.

9. Data subject rights and assistance

The platform already lets people export, correct and delete data, withdraw consent and use the guardian portal. Data subject requests that reach ClassMe are forwarded to the teacher without delay. We help the teacher with what the tools do not cover, within legal deadlines, and with security, impact assessments (DPIA) and prior consultation of the authority (GDPR Articles 32 to 36; LGPD Article 38).

10. Data breaches

We notify the teacher without undue delay and within 48 hours at most of becoming aware of a breach affecting school data, with the nature of the incident, the data subjects and records affected, the likely consequences, the measures taken and a contact. The teacher, as controller, decides on notifying the authority (AEPD or another EU authority, ICO or ANPD) and data subjects; we help with the information and the wording. We record every breach.

11. End of the agreement

Before switching the school off, we give the teacher a copy of the data (students, lessons, credits and payments) in a structured format. The data stays available for 30 days after the service ends and is then deleted, except what the law requires us to keep. Encrypted backups expire automatically within 35 days, and deleted data is never restored. On request, we confirm deletion in writing.

12. Information and audits

We give the teacher the information needed to show compliance with this agreement, including the sub-processors’ available certifications. The teacher, or an auditor bound by confidentiality, may audit with 30 days’ notice, once a year (or after a breach, or when ordered by an authority), first through documents, without exposing other schools’ data.

13. Minors

The teacher obtains and keeps the guardian authorisations required by law (GDPR Article 8; LOPDGDD Article 7, age 14 in Spain; LGPD Article 14), using the platform’s flows. ClassMe keeps those flows working and uses minors’ data for nothing but the service.

14. Liability, changes and governing law

Each party is liable for damage it causes by breaching this agreement or the law (GDPR Article 82; LGPD Articles 42 to 45); the limits in the terms do not reduce liability towards data subjects and authorities. Changes are notified by email 30 days in advance, with the right to terminate without penalty. This agreement is governed by Spanish law, without prejudice to each country’s mandatory data protection rules (LGPD in Brazil, UK GDPR in the United Kingdom).

15. Security measures

• HTTPS/TLS on every connection, HSTS and an encrypted connection to the database.
• Personal fields encrypted in the application with AES-256-GCM (enc:v2 format, bound to field and row), rotatable keys; files also encrypted before storage.
• Daily backup encrypted with a separate key, in private storage, deleted within 35 days.
• Each school in its own database schema, isolated from the others.
• bcrypt password hashing and breached-password checks without sending the password; two-step verification (TOTP) with recovery codes; extra confirmation for sensitive actions.
• Attempt limits with progressive lockout on sign-in and codes.
• Essential cookies only, with the __Host- prefix, HttpOnly and SameSite.
• Role-based access; administrative actions and security events in a chained audit trail kept for 12 months.
• Minimisation by default, automatic deletion of expired data, CSP and framing protection.

16. Sub-processors

• Cloudflare (Cloudflare, Inc., United States): hosting and execution (Workers and Hyperdrive), live classroom (Durable Objects), files and backups (R2, Western Europe), video (Stream) and email sending. Global network, including the United States. DPA with standard contractual clauses and UK Addendum; certified under the EU-US Data Privacy Framework.
• Neon (United States): PostgreSQL database, London region, United Kingdom; personal fields already encrypted in the application. UK adequacy decision and the standard contractual clauses in Neon’s DPA.

Not ClassMe sub-processors: Google (Calendar and Meet), when the teacher connects their Google account, which processes the lesson event as an independent controller through the teacher’s account; and browser push services, chosen by the browser of whoever turns notifications on, which only receive end-to-end encrypted messages.