Data Processing Agreement
How Classable processes personal data on behalf of schools and organizations, in line with the GDPR.
Last updated: 15 July 2026
This Data Processing Agreement applies to business and school customers and supplements the Classable Terms of Service. It sets out how Classable, as your data processor, handles the personal data you control.
1. Parties and role
This Data Processing Agreement (the “DPA”) is entered into between Jibble Ltd, Devonshire House, 582 Honeypot Lane, Stanmore, Middlesex, HA7 1JS, United Kingdom, which operates the Classable platform (“Classable”, “Processor”, “we”), and the school, university or organization that subscribes to the Service (the “Customer”, “Controller”, “you”).
For the personal data you process through the Service — including data about students, staff and parents — you act as the data controller and Classable acts as a data processor, processing that data only on your documented instructions. This DPA applies to the extent Classable processes personal data on your behalf in the course of providing the Service.
2. Subject matter and duration
The subject matter of the processing is the provision of the Classable school attendance and management platform. Processing continues for the duration of your subscription and until the data is returned or deleted in accordance with section 12, unless a longer period is required by law.
3. Nature and purpose of processing
Classable processes personal data to provide, operate, secure and support the Service. This includes hosting and storing Customer Data, capturing and reporting attendance, managing timetables and academic records, enabling communication between the organization, staff and parents, authenticating users, and providing diagnostics and support.
Classable does not process the personal data for any purpose other than providing the Service and does not sell it or use it for advertising.
4. Categories of data subjects and personal data
The personal data processed under this DPA may include:
- Students (who may be minors) — name, class/group, attendance records, excuses, grades and related academic records entered by the organization.
- Staff and teachers — name, email address, hashed credentials, role and activity within the organization.
- Parents and guardians — name, contact details and messages exchanged through the parent portal.
- Administrators and other account holders — account and authentication data and technical/log data used to secure the Service.
5. Controller instructions
Classable processes personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by law — in which case we will inform you of that legal requirement before processing, unless the law prohibits it. Your use of the Service, together with these Terms and this DPA, constitutes your documented instructions. Classable will inform you if, in its opinion, an instruction infringes applicable data protection law.
6. Confidentiality
Classable ensures that persons authorized to process the personal data are bound by appropriate obligations of confidentiality and process the data only as needed to provide the Service. Access is granted on a least-privilege, need-to-know basis.
7. Security measures
Classable implements appropriate technical and organizational measures to protect personal data, taking into account the state of the art, the costs of implementation and the risks involved. These measures include:
- Encryption of personal data in transit (TLS).
- Strict multi-tenant isolation so each organization can access only its own data.
- Hashing of passwords and secure handling of credentials.
- Role-based access controls and least-privilege access for personnel.
- Audit logging, monitoring and abuse prevention.
- Regular review of the measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems.
8. Sub-processors
You provide general authorization for Classable to engage sub-processors to help deliver the Service. Classable imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for their performance.
A current list of sub-processors is published at classable.io/subprocessors. We will give notice of any intended changes concerning the addition or replacement of sub-processors — you can subscribe to change notifications through the privacy contact below — giving you the opportunity to object on reasonable data protection grounds.
9. Assistance with data-subject requests
Taking into account the nature of the processing, Classable assists you by appropriate technical and organizational measures, insofar as possible, to fulfil your obligation to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability and objection). Where a data subject contacts Classable directly, we will refer them to you, the controller, unless you have instructed us otherwise.
10. Personal data breach notification
Classable notifies you without undue delay after becoming aware of a personal data breach affecting your data, and provides information reasonably available to us to help you meet your own notification obligations to supervisory authorities and affected data subjects. We also assist you in ensuring compliance with your obligations relating to the security of processing and data protection impact assessments.
11. Audits
Classable makes available to you information reasonably necessary to demonstrate compliance with this DPA and the obligations in Article 28 of the GDPR, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate. Audits are conducted on reasonable prior notice, during business hours, no more than once per year unless required following a breach or by a supervisory authority, and subject to confidentiality, so as not to disrupt the Service or other customers.
12. Return and deletion of data
On termination or expiry of your subscription, and at your choice, Classable returns the personal data to you or deletes it, and deletes existing copies, unless retention is required by law. For a reasonable period after termination you may export your Customer Data; after that period the data is deleted or anonymized in line with our retention practices.
13. International transfers
The Service is hosted on Amazon Web Services in the European Union (Ireland, eu-west-1). Where any transfer of personal data outside the EEA or the UK takes place, Classable relies on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with any additional safeguards required.
14. Relationship to the Terms
This DPA supplements and forms part of the Terms of Service between you and Classable. In the event of a conflict between this DPA and the Terms with respect to the processing of personal data, this DPA prevails. All other terms, including the limitations of liability in the Terms, continue to apply.
15. Contact
For any question about this DPA, or to request a signed copy for your records, reach us through the contact page at classable.io/contact, or by email at paulmiu@jibble.io.