Data Processing Agreement

This DPA applies to any Personal Data VanClass processes on the Controller's behalf in connection with the VanClass audio-first HVAC/R certification training platform. VanClass is operated by R7AD (Yahia Riad Hanniz), sole proprietor, Markham, Ontario, Canada.

1. Roles & allocation of responsibility

The Controller is responsible for the lawfulness of its processing, the accuracy of the data it provides, and satisfying its own regulatory obligations. VanClass is the Processor and processes data only on the Controller's documented instructions. VanClass does not determine whether the Controller is compliant; providing the service is not a representation of compliance.

2. Permitted processing

Only to: provide and secure the service, track learner progress and deliver course content, comply with law, and improve the product with aggregate non-identifying data. VanClass shall not use Learner Data for unrelated purposes.

3. Sub-processors

VanClass uses the sub-processors Supabase (database & authentication), Stripe (payments) and Netlify (hosting & CDN), maintains a current list of them, and informs the Controller of material changes.

4. Security

Appropriate technical and organisational measures (encryption in transit, access controls, least-privilege). VanClass does not claim a specific certification (e.g. SOC 2, ISO 27001) unless separately obtained.

5. Data subject rights

VanClass will assist the Controller in responding to data subject requests (access, correction, deletion, portability) and complying with applicable data protection law.

6. Retention & deletion

On termination, VanClass will delete or return the data as directed, except where retention is required by law. Data is processed only as long as needed for the service or as required by law.

7. International transfers

Where data is transferred outside the EEA/UK, VanClass will use appropriate safeguards (e.g. Standard Contractual Clauses) to the extent required by law.

8. Liability

Nothing in this DPA alters the liability allocation in the VanClass Terms of Service.