Data Processing Agreement

Last updated: 28 August 2026

This Data Processing Agreement ("DPA") forms part of the GetClass Terms of Service ("Terms") between GetClass and the Business Customer using the Service ("Customer").

This DPA applies only to the extent GetClass Processes Personal Data on behalf of the Customer in connection with providing the Service.

Capitalized terms not defined in this DPA have the meanings given in the Terms. Controller, Processor, Personal Data, Processing, Data Subject, and Personal Data Breach have the meanings given under applicable data-protection law.

1. Roles and Processing

For Personal Data Processed by GetClass on behalf of the Customer ("Customer Personal Data"), the Customer acts as Controller and GetClass acts as Processor.

GetClass Processes Customer Personal Data only on documented instructions from the Customer, as necessary to provide, operate, secure, and support the Service, or where required by applicable law.

The Terms, this DPA, and the Customer's use and configuration of the Service constitute the Customer's documented instructions.

If GetClass believes that a Customer instruction violates applicable data-protection law, GetClass will inform the Customer.

The Customer is responsible for having a lawful basis and authority to collect, use, and provide Customer Personal Data to GetClass.

This DPA does not apply to Personal Data that GetClass Processes as an independent Controller for its own purposes, as described in the Privacy Policy.

Details of the Processing are set out in Annex A.

2. Confidentiality, Security, and Assistance

GetClass will ensure that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.

GetClass will implement appropriate technical and organizational measures to protect Customer Personal Data, taking into account the nature of the Processing and relevant risks.

The principal security measures are described in Annex B.

GetClass will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Taking into account the nature of the Processing and the information available to GetClass, GetClass will provide reasonable assistance to the Customer with applicable data-protection obligations to the extent required by applicable law.

If GetClass receives a Data Subject request relating to Customer Personal Data, GetClass may direct the request to the Customer or notify the Customer, unless applicable law requires otherwise.

3. Subprocessors and International Transfers

The Customer gives GetClass general written authorization to engage third-party processors ("Subprocessors") for the provision of the Service.

GetClass will impose applicable data-protection obligations on its Subprocessors and remains responsible for their Processing to the extent required by applicable law.

A current list of Subprocessors is available at:

https://getclass.now/subprocessors

Where required by applicable law, GetClass will notify the Customer of intended additions or replacements of Subprocessors and provide an opportunity to raise a reasonable objection.

International transfers of Customer Personal Data will be made using a lawful transfer mechanism where required by applicable law.

4. Deletion, Return, and Compliance

Following termination of the relevant Service, GetClass will, at the Customer's choice, delete or return Customer Personal Data unless applicable law requires continued retention.

Data may remain in backups until removed through normal backup retention cycles, provided that it remains appropriately protected.

GetClass will make available information necessary to demonstrate compliance with its applicable Processor obligations.

Where required by applicable law, GetClass will allow and reasonably contribute to an audit of the relevant Processing, subject to reasonable prior notice and appropriate confidentiality, security, and scope requirements.

To the extent permitted by applicable law, the Customer will bear reasonable costs of an audit that requires material additional resources from GetClass, unless the audit is required because of a material breach of this DPA by GetClass.

5. Liability, Term, and Relationship with the Terms

To the maximum extent permitted by applicable law, liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability contained in the Terms.

This DPA remains effective for as long as GetClass Processes Customer Personal Data on behalf of the Customer.

If there is a conflict, this DPA prevails over the Terms with respect to the Processing of Customer Personal Data. Any mandatory international data-transfer mechanism prevails with respect to the relevant transfer.

The governing-law and dispute provisions of the Terms apply to this DPA unless applicable law requires otherwise.

Annex A — Details of Processing

Subject Matter and Purpose

GetClass Processes Customer Personal Data as necessary to provide, operate, secure, and support the GetClass studio-management and booking Service.

Duration

Processing continues for the duration of the Customer's use of the Service and for any subsequent retention period required under the Terms or applicable law.

Categories of Data Subjects

Customer Personal Data may relate to:

• Studio Clients and prospective Clients;
• individuals making or managing bookings;
• instructors;
• Studio employees and contractors; and
• Authorized Users.

Categories of Personal Data

Depending on the Customer's use of the Service, Customer Personal Data may include:

• name;
• email address;
• telephone number;
• profile and account information;
• photographs, profile images, and other images uploaded through the Service;
• booking, attendance, cancellation, and no-show information;
• membership, package, and class-credit information;
• instructor information;
• payment or transaction status;
• communications and notes entered through the Service; and
• relevant technical and Service usage information.

Nature of Processing

Processing may include collection, recording, organization, storage, retrieval, use, transmission, display, modification, backup, and deletion of data in connection with providing the Service.

Annex B — Security Measures

GetClass implements technical and organizational measures appropriate to the nature of the Service and relevant risks, including, where applicable, access controls, measures designed to protect Personal Data during transmission and storage, and measures designed to maintain the security of systems and infrastructure used to provide the Service.

GetClass may modify such measures as the Service evolves, provided that the overall level of protection of Customer Personal Data is not materially reduced.