Data Processing Schedule for Corporate Program

ClassPass Corporate Program Data Processing Schedule

Last updated: December 21, 2022

This Schedule forms part of the relevant EU and UK Controller to Processor Standard Contractual Clauses as applicable.

Data Exporter and Data Importer

You transfer, and ClassPass receives, Personal Data in relation to the supply of the Program as set out in the relevant agreement.

Description of Transfer

The personal data transferred concern the following categories of data subjects:

  • Program Offerees designated by you.

ClassPass will process personal data provided by Partner in an eligibility file, which shall contain only the following categories:

  • Name
  • The email address used for employment purposes;
  • Non-specific location data (such as city or country of employment); and
  • Status of employment (in some cases, it may be inferred that the data subject is Partner’s employee).

The personal data transferred concern the following special categories of data (please specify):

  • None. The personal data transferred will be subject to the following basic processing activities (please specify):
  • Processing operations are limited to the extent necessary to provide the Program as specified under the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

  • So long as services are being provided, and for a commercially reasonable period prior to return or deletion thereafter.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:

  • As above.

Technical and Organizational Measures

ClassPass has taken technical and organizational measures to ensure the security of the data. These measures include:

  • Measures of pseudonymization and encryption of personal data
    Partners are able to specify if they want to encrypt the eligibility file itself before transferring it over via SFTP.

  • Measures for the protection of data during transmission
    Offeree information is transferred to ClassPass by the Partner via SFTP using a set of credentials specific to that Partner.

  • Measures for ensuring events logging
    All application logs are stored via Papertrail. Network and system logs are stored in AWS Cloudtrail and are retained for a minimum of 1 year.

  • Measures for internal IT and IT security governance and management
    Access to production systems for ClassPass employees requires Multi-Factor Authentication (MFA). Access to where credentials used for uploading files is provided to ClassPass employees on an as needed basis.

  • Measures for ensuring data quality A job is run daily to process the latest information submitted by the Partner.

  • Measures for ensuring limited data retention Partners are able to specify if they want the eligibility file to be deleted after it has been processed by ClassPass. Furthermore eligibility files are deleted after Partner has terminated its contract with ClassPass.