Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") supplements the Terms of Servicebetween you (the "Customer" or "Controller") and Divisocial Tech Solutions Pvt. Ltd. ("Processor"), and governs the processing of Personal Data carried out by us on your behalf when you use The Big Class.

2. Roles

With respect to Personal Data about your students, team members, customers, and other end users that you upload or instruct us to process, you are the Controller and we are the Processor.

3. Categories of data & data subjects

• Data subjects: your team (admins, instructors), your students, and your storefront customers.
• Personal data categories: names, email addresses, WhatsApp / phone numbers, country, course enrolments, attendance records, quiz attempts, assignment submissions, payment metadata (we do not store card numbers).
• Special categories: we do not require sensitive categories. If you choose to upload them you confirm you have a lawful basis to do so.

4. Processor obligations

• Process Personal Data only on your documented instructions, including transfers outside India where you so direct.
• Ensure persons authorised to process Personal Data are bound by confidentiality.
• Implement appropriate technical and organisational measures (see Annex A below).
• Assist you in fulfilling data-subject rights requests and conducting impact assessments.
• Notify you without undue delay (within 72 hours) of any Personal Data breach.
• Make available the information necessary to demonstrate compliance with this DPA.

5. Sub-processors

You authorise us to engage the sub-processors listed in our Privacy Policy. We will notify you of any new or replacement sub-processor at least 30 days before they begin processing, and give you a reasonable opportunity to object on reasonable grounds.

6. International transfers

Personal Data is hosted in India by default. Where data is transferred to recipients outside India, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the UK International Data Transfer Addendum.

7. Return & deletion

On termination of your subscription, we provide a 30-day window to export your data. After that window we delete or anonymise Personal Data processed on your behalf, except where retention is required by law.

8. Liability

Our aggregate liability under this DPA is subject to the liability cap in the Terms of Service.

Annex A — Security measures

• Encryption in transit (TLS 1.2+) for all client/server traffic.
• Encryption at rest for backups and database storage.
• Tenant isolation via per-workspace storage namespacing.
• Role-based access controls within our team; least-privilege production access.
• HMAC-signed stateless tokens for password reset and email verification.
• Audit logging for administrative actions.
• Annual review of sub-processors and security posture.

Annex B — Signing this DPA

For Starter and Growth plans this DPA is accepted automatically when you create a workspace and form part of our Terms of Service. For Scale customers we can co-sign a counter-signed copy on request — email hello@thebigclass.com.