Data Processing Addendum (DPA)
Institute Customer Schedule • Version 1.0 • Platform: ClassPilot by Expolio Group
1. Scope and Roles
This Data Processing Addendum (“DPA”) applies where Expolio processes personal data on documented instructions from a customer institute to provide the ClassPilot platform. The institute acts as the Data Fiduciary/Controller responsible for establishing lawful collection grounds. Expolio acts as Data Processor processing data strictly in accordance with institute instructions and the principal Terms of Service.
2. Processing Instructions & Confidentiality
Expolio will process student, batch, and fee records solely to maintain, secure, and operate the platform as contracted. All technical and support personnel authorized to access customer databases are bound by strict statutory and contractual confidentiality obligations.
3. Technical Safeguards
Expolio maintains reasonable technical and organizational safeguards including multi-tenant database partitioning, strict role-based permission verification, encrypted transmission protocols (HTTPS/TLS), automated disaster-recovery backups, and administrative audit logging.
4. Incident Notification & Deletion
In the event of a verified security incident compromising institute personal data, Expolio will notify the affected institute administrator without undue delay and provide reasonable remediation cooperation. Upon contract termination, the institute will be provided export tools followed by scheduled database de-provisioning.