Legal · GDPR
Sub-processors
These are the providers that process personal data on our behalf under the Bobclass Data Processing Agreement (version 1.1).
Last updated 4 November 2026.
| Provider | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| MongoDB, Inc. and its affiliates (MongoDB Atlas) USA |
Database hosting | All customer personal data in the app database | Frankfurt, Germany (Google Cloud infrastructure) | Data stored in the EU. Possible remote access by the US parent or support staff is covered by the EU-U.S. Data Privacy Framework and the SCCs in MongoDB's DPA. |
| Backblaze, Inc. USA |
File storage (images, attachments, invoice PDFs) | Files uploaded to or generated in the Services | Amsterdam, Netherlands (EU Central) | Data stored in the EU. Possible access by the US entity is covered by the EU-U.S. Data Privacy Framework and SCCs (Backblaze DPA). |
| DigitalOcean, LLC USA |
Compute for API/back-end servers (no persistent storage of customer personal data) | All customer personal data while it is processed in memory or in transit | Frankfurt, Germany (FRA1) | Data processed in the EU. Possible access by the US entity is covered by the EU-U.S. Data Privacy Framework, with SCCs as a fallback (DigitalOcean DPA). |
| BunnyWay d.o.o. (bunny.net) Slovenia (EU) |
Content delivery network (CDN) | Data in transit between the Services and users; temporary cache copies of files (e.g. images); connection data (IP address, user agent) | Global edge network; company based in the EU | EU company. Transit and caching at edge locations outside the EU are covered by SCCs (bunny.net DPA). No persistent storage of customer personal data. |
| Twilio Inc. (SendGrid) USA |
Transactional email (booking confirmations, reminders, invoices) | Name, email address, email content and attachments, delivery metadata | USA | Twilio Binding Corporate Rules; EU-U.S. Data Privacy Framework; SCCs (Twilio DPA) |
| Twilio Inc. USA |
Two-factor authentication (verification codes) | Phone number and/or email of users signing in; verification events | USA / global (telecom carriers) | Twilio Binding Corporate Rules; EU-U.S. Data Privacy Framework; SCCs (Twilio DPA) |
| Google LLC (Firebase Cloud Messaging) USA |
Push notifications to Android and iOS devices (relayed via Apple Push Notification service on iOS) | Device push token, app instance ID, notification content (e.g. class name, time, studio name) | USA / global | EU-U.S. Data Privacy Framework; SCCs (Google Firebase Data Processing and Security Terms) |
Not sub-processors
These services are involved in running Bobclass but are not sub-processors of your studio’s data:
- Stripe: payments between studios and their clients run under each studio's own Stripe account and agreement. Bobclass's own non-EU subscription card payments also go through Stripe, but that billing data belongs to Bobclass as controller, so Stripe is not a sub-processor for studio data.
- Apple and Google crash and performance reports (App Store Connect / Xcode, Google Play Console): collected by the device platform under each end user's own diagnostics settings.
Changes to this list
We give at least 30 days’ notice of new or replaced sub-processors, by email to account owners and on this page. You may object on reasonable data protection grounds: support@bobclass.com.
Related
Court Four Ltd · Company no. 09119686 · Registered office: Carrwood Park, Selby Road, Leeds, LS15 4LG, United Kingdom