1. Parties, scope and duration
This agreement governs processing on behalf of the studio under GDPR Article 28. The Customer identified in registration details is the Controller; the Provider identified above is the Processor. Processing covers only data needed to provide Mesana on the Controller’s instructions, during the contract and subsequent return, deletion or required retention. Annex I describes its scope, operations and categories.
Processing for contracts, billing, platform security and defence of rights performed by the Provider as an independent controller is described in the privacy notice and remains distinct from student data.
2. Documented instructions
Instructions include this DPA, settings and operations selected by the Controller in the platform, and further written instructions compatible with the service. The Processor processes data only on these instructions unless legally required, informing the Controller where permitted. If it considers an instruction contrary to data-protection law, it informs the Controller and may suspend the affected operation pending clarification.
3. Legal basis and permitted data
The Controller determines the legal basis, provides notices and keeps necessary authorisations. Health data, other special-category data under GDPR Article 9 and conviction or offence data under Article 10 must not be entered, including in notes, descriptions or attachments. The service is not designed for such processing. Assessing the need for a data protection impact assessment remains the Controller’s responsibility.
4. Confidentiality and access
The Processor limits access to authorised people who need it to deliver, maintain and protect the service and binds them to confidentiality. Access to studio data for support or technical work must be limited to the necessary purpose. Administrative access to the studio is recorded. Logical isolation controls between organisations are maintained.
5. Security
The Processor adopts the technical and organisational measures in Annex II, taking account of the processing and risk. It assists the Controller with GDPR Articles 32–36 to the extent of available information. Changes must not reduce the overall protection level; substantial reductions are notified thirty days in advance with an option for the Controller to terminate without charge.
6. Student communications
The Controller decides which communications to send through available functions, ensures their legal basis and observes electronic-communications rules. It does not enter purchased or unlawfully collected contacts and handles objections and withdrawals. The Processor supplies the technical channel; it may limit volumes or recipients or suspend sending where there are signs of abuse, informing the Controller. The studio’s identity in messages depends on details configured by the Controller.
7. Data-subject rights and audits
The Processor provides management and export functions and assists the Controller with access, rectification, erasure, restriction and portability. If it receives a request directly concerning student data, it forwards it to the Controller without independently deciding matters between studio and data subject. The additional care required for minors’ data continues to apply.
On request, the Processor provides information to verify compliance with this agreement. If that is insufficient, the Controller may request audits with thirty days’ notice, normally no more than annually, protecting confidentiality and other customers’ data and bearing audit costs. For an established breach attributable to the Processor, those frequency, notice and cost limits do not apply.
8. Subprocessors
The Controller generally authorises the services in Annex III within the functions used. Engaging subprocessors requires data-protection obligations consistent with this agreement; the Processor remains responsible to the Controller for performance of those obligations. The list describes services and purposes; information on applicable agreements can be requested through the formal contact.
Additions or replacements are notified thirty days in advance. The Controller may object within fifteen days on reasonable, documented data-protection grounds. The parties seek an alternative; if none is possible, the Controller may terminate without charge with a proportional refund for the unused paid period. Urgent replacements for security or a provider’s cessation may occur without advance notice, with prompt notification and a subsequent right to object.
9. International transfers
The database and application server are configured in Frankfurt. European location does not rule out remote access from other countries or global networks and optional functions using non-EEA providers. Transfers, where they occur, require the applicable safeguards under GDPR Articles 45 or 46. On request the Processor provides available information about safeguards applied and notifies foreign-authority requests where legally permitted.
10. Return, deletion and retention
The Controller may export data in a structured format without extraction charges, including during read-only or suspended access. On termination it may request return or deletion through the formal contact. Deletion follows the Controller’s instructions, except for legally required retention, with outcome information on request. Trial expiry or suspension does not mean automatic deletion.
Backups follow the retention cycle of the infrastructure service used; information on the applicable period can be requested through the formal contact. Residual backup data must remain limited to retention and security restoration and must not be reused for other purposes. Legal retention requirements are communicated to the Controller and processing is limited to the required purpose.
11. Personal data breaches
The Processor notifies the Controller without undue delay after becoming aware of a breach affecting entrusted data, using the studio owner’s contact. It provides available information on the incident, affected data and subjects, likely consequences, measures taken or proposed, and a contact for clarification, supplementing information in later updates.
The Controller remains responsible for notifying the supervisory authority and data subjects where required. The Processor assists and does not contact the studio’s data subjects about the incident except on the Controller’s instructions or as legally required.
12. Minors
Where the studio runs courses for minors, the Controller ensures a legal basis, understandable notices and parental or guardian authorisations where necessary. It records the responsible adult’s contact details rather than the minor’s direct contacts. Communications and student access follow the studio’s configured contacts and authorisations. Mesana does not independently determine age from a customer record. The studio reports these needs through the formal contact.
13. Purposes and optional functions
The Processor does not sell student data or use it for its own marketing. The processing mandate does not authorise using data to train, optimise or evaluate its own or third-party AI models. Aggregated statistics must reasonably prevent identification of data subjects or individual studios. Data is shared with providers only as necessary for delivery and functions instructed by the Controller.
AI-assisted import is optional: when used, file content may be sent to Anthropic after the studio is informed and explicitly confirms. Its output must be reviewed before being applied. A Shopify integration concerns only the studio that connects it and necessary order data. These functions are not activated merely by visiting the site.
14. Responsibilities of the parties
Each party is responsible for processing under GDPR Article 82. The Controller is responsible for the legal basis, notices, data and contacts entered, communications and unlawful instructions maintained despite a warning. The Processor is responsible for processing contrary to instructions and its own obligations. The Controller indemnifies the Processor against consequences of the above violations attributable to it; the Processor indemnifies the Controller against consequences of processing contrary to instructions or this agreement. No provision prejudices data subjects’ rights or excludes legally mandatory liability.
15. Changes and final provisions
DPA changes for legal or service developments are notified thirty days in advance, with an option to terminate without charge under the Terms. The law specified in the Terms and mandatory rules apply. An ineffective clause does not affect the rest. The Controller may request a copy of the agreement with its identity details and acceptance date.
Annex I — Description of processing
Scope and purpose: studio management of customer records, enrolments and packages, calendar, bookings, attendance, sales and payments, communications and financial summaries. Operations: collection, recording, organisation, storage, consultation, use, transmission, restriction, export and deletion. Duration: the service relationship and subsequent data handling described in Article 10.
Data subjects: adult students and minors where enrolled, responsible adults, people making bookings, teachers and studio collaborators. Data: identity and contact details, enrolments and credits, bookings and attendance, dates, amounts and payment status, technical access data and lawful notes. No special-category or criminal-offence data is authorised. Minors’ data is governed by Article 12.
Annex II — Technical and organisational measures
Credentials and access: owner and staff passwords stored as bcrypt hashes; sessions using HttpOnly cookies; role authorisation and organisation-membership checks on data operations. Studio customers have access separate from staff access. Public traffic uses HTTPS.
Isolation and traceability: organisation-scoped data access; checks on references between entities of the same studio; transactions for sensitive financial operations; administrative studio access recorded in the audit log. Export lets the owner obtain their own studio’s data. Deletion requires a controlled process and is not the same as subscription expiry.
Development and continuity: changes undergo automated checks and review; isolation and atomicity tests use synthetic PostgreSQL databases for relevant functions. Database and application are configured in Frankfurt. Information on the applicable retention and recovery scope can be requested through the formal contact.
Annex III — Technical services and optional functions
Neon: PostgreSQL application database, configured in Frankfurt. Render: application and periodic jobs, configured in Frankfurt. Vercel: website and interface delivery over a global network; processes browser requests. Brevo: transactional email delivery when enabled; receives necessary message and recipient data.
Anthropic: only for AI-assisted imports requested and explicitly confirmed by the studio; may receive file contents, including personal data present. The service may involve processing in the United States. Shopify: only for an integration connected by the studio, with data necessary for orders and their management. The studio can operate without these optional functions.
Stripe is separate: for subscription fees it processes necessary payment and billing data under its terms; for studio collections the payment relationship is between the studio and Stripe. The Controller may request applicable documentation on agreements and transfer safeguards through the formal contact before enabling a function involving additional transfers.