Data Processing Addendum

Processing covers data submitted or generated by the organization while using the service. Processing continues while the service is active and during any lawful retention or deletion period afterward.

Processing may include collection, recording, organization, storage, adaptation, retrieval, use, transmission, restriction, backup, and deletion to provide education, administration, communication, security, support, and service recovery functions.

• Data subjects may include students, children, parents or guardians, teachers, staff, administrators, prospective users, and organization contacts.
• Data may include identity, contact, account, organizational relationship, education, attendance, assessment, communication, file, payment, and technical data.
• The organization must not submit sensitive data that is unnecessary for the service or for which it lacks an appropriate lawful basis.

Class Quantum processes organization data only on documented instructions contained in the agreement, tenant configuration, feature use, and legitimate support requests, unless another form of processing is required by law. If an instruction is believed to violate the law, Class Quantum may notify the organization and suspend that instruction to the extent permitted.

• Determine the purposes, lawful bases, necessary data, retention periods, and parties granted access.
• Provide required notices and obtain parental or guardian consent where required.
• Handle individual rights requests and maintain data accuracy.
• Do not instruct Class Quantum to carry out unlawful processing.

Personnel who may access data are bound by confidentiality obligations. Class Quantum implements security measures proportionate to the risk, including access controls, tenant isolation, logging, credential protection, backups, recovery, vulnerability management, and infrastructure safeguards. Controls may evolve without materially reducing the level of protection.

The organization gives Class Quantum general authorization to use subprocessors needed to provide the service. Class Quantum remains responsible for binding subprocessors to appropriate protection obligations. Where required, material subprocessor changes will be notified through the service or an official channel. Reasonable objections will be discussed in good faith.

Class Quantum will use transfer mechanisms recognized by law when data is processed outside its originating jurisdiction, including contractual clauses, protection assessments, or supplementary safeguards where relevant.

Taking into account the nature of processing and the information available, Class Quantum will provide reasonable assistance with individual rights requests, impact assessments, regulatory consultations, and the organization's security obligations. Specialized assistance requiring significant work may be subject to fees agreed in advance.

Class Quantum will notify the organization without undue delay after becoming aware of a personal data incident affecting organization data. The notice will include available information about the nature of the incident, its impact, mitigation measures, and a follow-up contact. A notice does not constitute an admission of fault or liability.

Class Quantum will provide reasonable information to demonstrate compliance. An audit must follow a written request, remain limited to the relevant scope, preserve confidentiality, avoid disrupting the service, and prioritize documents or reports that are already available.

At the end of the service, the organization may request available exports and deletion of data in accordance with product capabilities, retention schedules, legal obligations, and security procedures. Backup copies will be deleted or overwritten during the normal backup cycle and remain protected while retained.

If there is a conflict concerning the processing of personal data, this Addendum prevails over the Terms of Service to the extent of that conflict. Questions about data processing may be sent to [email protected], by telephone at +62 895-3212-12634, or to our business address at Kp. Pamahan RT 1/RW 9, Jatimekar, Jatiasih, Bekasi 17422, Indonesia.