Classifi.

Data Processing Agreement

Last updated: March 2026

This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Classifi Terms of Service between Classifi (“Processor”) and the customer (“Controller”). This DPA reflects the parties’ agreement with respect to the processing of personal data.

This DPA is based on the Bonterms Data Processing Agreement (Version 1.0), available at bonterms.com.

1. Definitions

  • “Personal Data” means any information relating to an identified or identifiable natural person processed by Classifi on behalf of the customer in connection with the platform.
  • “Processing” has the meaning given under applicable data protection law, including GDPR where applicable.

2. Scope of Processing

Classifi processes personal data solely to provide the platform services described in the Terms of Service. This includes payment records, worker information, compliance documentation, and related data submitted by the customer.

3. Customer Obligations

The customer is responsible for ensuring it has a lawful basis for submitting personal data to Classifi for processing, and for ensuring data subjects have been informed of such processing where required.

4. Classifi Obligations

Classifi will:

  • Process personal data only on documented instructions from the customer
  • Ensure persons authorized to process personal data are bound by confidentiality
  • Implement appropriate technical and organizational security measures
  • Assist the customer in responding to data subject rights requests
  • Delete or return personal data upon termination of services
  • Provide information necessary to demonstrate compliance with this DPA

5. Subprocessors

Classifi uses the subprocessors listed at classifi.co/subprocessors. Classifi will notify customers at least 14 days before engaging any new subprocessor. Customers may object to a new subprocessor by contacting privacy@classifi.co.

6. Security

Classifi implements technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. For details see classifi.co/security.

7. Data Subject Rights

Classifi will assist the customer in fulfilling data subject rights requests (access, correction, deletion, portability) within a commercially reasonable timeframe.

8. Breach Notification

Classifi will notify the customer without undue delay upon becoming aware of a personal data breach affecting customer data, and no later than 72 hours where feasible.

9. Termination

Upon termination of the customer’s account, Classifi will delete customer personal data within 90 days unless retention is required by law.

10. Governing Law

This DPA is governed by the governing law specified in the Classifi Terms of Service.

Contact

For data privacy inquiries: privacy@classifi.co