Legal · GDPR

Data Processing Agreement

When you use Bobclass, we process your clients’ and staff’s personal data on your behalf. Our Data Processing Agreement (DPA) under Article 28 GDPR sets out how we protect it.

Do I need to sign anything?

No. The DPA is part of the Bobclass EULA and applies automatically to every Bobclass customer. You don’t need to sign or return anything.

1. Download the PDF above. It has already been signed electronically by Court Four Ltd.
2. Optional: if you want a countersigned copy for your records, sign the customer section and keep it with your GDPR documentation.
3. You can also send a scanned copy to support@bobclass.com, and we’ll file it with your account.

Only the unmodified version published on this page is binding. If you need changes to the DPA, contact us before signing.

At a glance

• Data storage
  European Union
  Database and servers in Frankfurt, Germany. Files in Amsterdam, the Netherlands.
• Roles
  You are the controller
  Court Four Ltd (Bobclass) is the processor and acts only on your instructions.
• Deletion
  Within 24 hours
  After you delete your account, your data is removed from live systems within 24 hours and from backups within a further 4 weeks.
• Breach notification
  Within 48 hours
  We notify you without undue delay, and at the latest within 48 hours.
• Sub-processors
  7 providers
  We give 30 days’ notice of any changes. See the list.
• Transfers
  Adequacy, DPF, SCCs
  UK adequacy decision (valid until 2031). The EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses cover US providers.

Related documents

• Sub-processors: the current list, with locations and safeguards
• Privacy Policy
• End User Licence Agreement (EULA)

Version history

Questions?

For questions about data protection, the DPA, or to request a full export of your data, email support@bobclass.com.

Court Four Ltd · Company no. 09119686 · Registered office: Carrwood Park, Selby Road, Leeds, LS15 4LG, United Kingdom