Data processing addendum
Last updated June 1, 2026
This Data Processing Addendum (“DPA”) applies where ClassFactor processes personal data on behalf of a customer — for example, a school or program — and forms part of our agreement with that customer.
Roles of the parties
For personal data processed on behalf of a customer (such as student data provided by an institution), the customer is the “controller” and ClassFactor is the “processor.”
ClassFactor processes such data only on the customer’s documented instructions and to provide the Services.
Scope of processing
Subject matter: provision of the ClassFactor study platform.
Duration: for the term of the agreement.
Nature and purpose: hosting, generating study content, and enabling learning and analytics.
Categories of data: account identifiers, study content, and usage data of the customer’s authorized users.
Sub-processors
ClassFactor uses vetted sub-processors (such as cloud hosting and payment providers) under contracts imposing data-protection obligations no less protective than this DPA.
We maintain a current list of sub-processors and will notify customers of material changes so they may object.
Security measures
ClassFactor implements appropriate technical and organizational measures — encryption in transit and at rest, access controls, logging, and regular testing — consistent with SOC 2 Type II.
International transfers
Where personal data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses, as required by applicable law.
Data-subject requests & assistance
ClassFactor will assist the customer, taking into account the nature of processing, in responding to data-subject requests and in meeting the customer’s obligations regarding security, breach notification, and impact assessments.
Return & deletion
On termination, ClassFactor will delete or return personal data processed on the customer’s behalf, except where retention is required by law.
How to execute this DPA
Institutional customers who require a signed DPA can request one by contacting legal@classfactor.com. We’re glad to work with your data-protection team.