Sub-processor List

1. About this list

1.1 What this document is

This is our maintained public list of sub-processors. It names every third party that processes personal information on our behalf in connection with the Classe365 and Hiree365 platforms, what each one does, and where it is located.

It is published, not sent on request, because an institution should be able to see who will touch its students’ data before it starts a procurement process, not after.

1.2 The distinction this list draws

The list is divided into three sections, and the division is the most important thing in this document.

• Section 3 — sub-processors that receive student or candidate data. These are the ones that matter most to a school, a university or a parent. There are five core sub-processors, plus three AI model providers that apply only to institutions with the optional AI add-on (section 3.7).

• Section 4 — providers that operate on the marketing website only and never receive student or candidate records. Analytics and marketing tools sit here. They run on classe365.com. They are not connected to the platform where student records live.

• Section 5 — optional integrations that the institution enables and contracts for directly. These are not our sub-processors. The institution chooses them and has its own relationship with the provider.

Section 6 covers our group support team in Australia, India, the Philippines, Spain and the United States. Its members are group employees, not third parties, but they do have access to customer data and must therefore be disclosed here.

1.3 Which entity is responsible

Customers located in the United States contract with 365 Software, LLC, a Delaware limited liability company, registered office 131 Continental Dr, Suite 305, Newark, DE 19713, New Castle County, United States.

Customers located anywhere else — including the European Union, the United Kingdom, Australia and the rest of the world — contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, registered office 22 Palm Street, St Ives, NSW 2075, Australia.

Support and engineering are provided 24/7 by Classe365 group staff in Australia, India, the Philippines, Spain and the United States.

Together we are “Classe365”, “we”, “us” and “our”.

1.4 Roles

For student, learner and candidate records, the institution is the controller and we are the processor. The parties in section 3 are our sub-processors: they process personal information on our behalf, on our instructions, in order to help us deliver the platform to the institution. The institution’s authorisation of these sub-processors is dealt with in our Personal Data Processing Agreement.

1.5 Related documents

Read this list together with our Privacy Policy, our Children’s Privacy Policy, our Data Retention Schedule, our Security Statement, our AI Use and Transparency Statement and our Cookie Policy. Where personal data is transferred across borders, the transfer mechanisms set out in our Personal Data Processing Agreement and described on our International Data Transfers page govern, and we do not restate their terms here.

2. What we require of every sub-processor

We engage sub-processors under written terms that include data protection obligations appropriate to the service they provide. Before a sub-processor is engaged, and for as long as it remains engaged, those terms require it, so far as it acts as our processor, to meet the following requirements:

1. A written contract. Its obligations are set out in a written agreement.

2. Purpose limitation. It may process personal information only to perform the service we have engaged it for, and only on our instructions. It may not use it for its own purposes.

3. No training of shared AI models. No sub-processor is permitted to use customer, student or candidate data to train, fine-tune or improve any general-purpose or shared AI model.

4. No sale, no advertising. No sub-processor may sell student, learner or candidate data, use it for advertising, or build advertising profiles from it.

5. Security. It must maintain appropriate technical and organisational security measures.

6. Confidentiality. Its personnel must be bound by confidentiality obligations.

7. Assistance. It must assist us in responding to data subject requests and in meeting our security and breach obligations.

8. Deletion. It must delete or return personal information when we instruct it to, and when our engagement ends.

9. Due diligence. We assess a sub-processor’s security and privacy posture before engagement and periodically afterwards, and this due diligence forms part of our written children’s information security program. Our Security Statement describes it.

Payment providers (Stripe and PayPal) also process payment data as independent controllers, to meet their own legal obligations such as fraud prevention and anti-money-laundering rules. To that extent they process it under their own terms and privacy policies, and they may retain it for the periods the law requires of them.

We keep the number of sub-processors small deliberately. Every addition is another organisation with access to education data, and the list below is short because we treat lengthening it as a cost rather than a convenience.

3. Sub-processors that receive student or candidate data

These core sub-processors may process student, learner or candidate personal data in the course of providing their service to us. The AI model providers in section 3.7 are additional sub-processors only for institutions that have the AI add-on.

3.1 Amazon Web Services — cloud hosting and storage

AWS provides the infrastructure the platform runs on: compute, storage, databases and backups. All customer data held in the platform, including student, learner and candidate records, resides on AWS infrastructure.

Standard customers’ data is hosted on Amazon Web Services in the AWS region allocated to the customer’s account at set-up, which is generally the region nearest to the customer. That region may be outside the customer’s own country. The region that applies to a particular account is confirmed on request. Enterprise customers may opt for a private cloud deployment on AWS, Microsoft Azure or Google Cloud; where an enterprise customer chooses Azure or Google Cloud for such a deployment, that provider hosts that customer’s deployment in place of AWS under the arrangements agreed with that customer.

AWS is infrastructure, not an application that reads records. It stores and serves data at our direction and does not access the content of customer data for its own purposes.

Under the amended COPPA Rule, hosting is an integral disclosure. The platform cannot be delivered without infrastructure to run on. AWS is therefore a disclosure of children’s personal information that is integral to the service itself, and it is covered by the institution’s authorisation of our collection and use of children’s information for its educational purpose.

3.2 Intercom — customer support messaging

Intercom powers the in-platform and email support messaging through which users reach our support team. Personal information reaches Intercom in two ways: the identity and contact details of the person raising the request, and whatever that person includes in the message.

A support message about a student — a query about an enrolment record, a screenshot of a fault on a student’s page — necessarily contains student information. That is why Intercom appears in this section rather than in section 4.

We ask institutions not to include student personal information in support messages where an account reference or a record identifier will do. Support correspondence is retained for 24 months from resolution under our Data Retention Schedule, which is longer than a deleted student record is retained, so keeping student detail out of tickets is genuinely worthwhile.

Under the amended COPPA Rule and the FTC’s guidance on school authorisation, disclosure to Intercom is covered by the institution’s authorisation. Support is part of operating the service for the institution, and the institution authorises this disclosure when it accepts our Terms as part of its authorisation of our collection and use of children’s information for its educational purpose.

3.3 Atlassian — engineering issue tracking and fault diagnosis

Atlassian’s tools are where our engineering team records and tracks faults. When a defect affects specific records — a calculation producing the wrong result on a particular student’s grades, an import that has misplaced a cohort — diagnosing it can require the affected data to be referenced in the issue.

We aim to restrict what is included to what is needed to reproduce and fix the fault, and access to these issues is restricted to engineering and support personnel.

Under the amended COPPA Rule and the FTC’s guidance on school authorisation, disclosure to Atlassian is covered by the institution’s authorisation. Fault diagnosis is part of operating and supporting the service, and the institution authorises this disclosure when it accepts our Terms.

3.4 Stripe — payment processing

Stripe processes payments. This covers subscription payments from institutions, and — where an institution uses the platform to collect fees — payments made by or on behalf of students and families.

Where a fee payment relates to a student, the payment record identifies who the payment is for, which is why Stripe appears in this section. We do not store full payment card numbers. Card data is handled by the payment processor under its own security controls and its obligations as a payment provider.

Under the amended COPPA Rule and the FTC’s guidance on school authorisation, disclosure to Stripe is covered by the institution’s authorisation. Billing and fee collection are part of operating the service, and the institution authorises this disclosure when it accepts our Terms.

3.5 PayPal — payment processing

PayPal processes payments on the same basis as Stripe, for institutions and payers who use it. The same position applies: fee payments can identify the student the payment relates to, we do not store full payment card numbers, and card data is handled by the payment processor under its own controls.

Under the amended COPPA Rule and the FTC’s guidance on school authorisation, disclosure to PayPal is covered by the institution’s authorisation. Billing and fee collection are part of operating the service, and the institution authorises this disclosure when it accepts our Terms.

3.6 Summary of the COPPA position

Under the FTC’s COPPA Final Amendments (90 FR 16918, published 22 April 2025, effective 23 June 2025, compliance date 22 April 2026) and the FTC’s guidance on school authorisation, an education institution may authorise the collection and use of children’s personal information for its educational purpose, in place of the parent. The institution gives that authorisation when it accepts our Terms, and it covers the core sub-processors needed to operate, support and bill the service. Disclosure to the AI model providers is authorised separately by the institution when it activates the AI add-on. We keep a record of each authorisation (user, date and version) under our Data Retention Schedule. Parents exercise their rights — to review their child’s information, to refuse further collection and to have it deleted — through the institution, and our Children’s Privacy Policy explains how.

3.7 AI model providers (AI add-on only)

The following providers are sub-processors only for institutions that have purchased the optional AI add-on module. For an institution without the AI add-on, no data is sent to them.

Where a feature uses one of these models, the data needed for the task is sent to the provider, processed to produce a result, and the result is returned to the platform. We use these providers under business API terms that do not permit the provider to use our customers’ data to train its models, consistent with section 2 and our AI Use and Transparency Statement.

Where another feature of the AI add-on, such as the AI chat assistant or the writing assistant, uses a general-purpose model, it uses a model from one of these providers, on the same terms.

The AI analytics features — grading analysis, attendance analysis, attrition tracking and behaviour analytics — do not use these providers. They use small language models hosted in our own Amazon Web Services environment, and that data does not leave our hosting.

Under the amended COPPA Rule and the FTC’s guidance on school authorisation, disclosure to these providers is authorised by the institution when it activates the AI add-on. Activation includes a separate acknowledgement by the institution authorising disclosure to OpenAI, Anthropic and Google for its educational purpose; without it the add-on is not enabled, and no children’s personal information is sent to these providers. Calls to these providers are gated on that institution-level acknowledgement.

4. Providers that operate on the marketing website only

The following providers never receive student or candidate records. They operate on the classe365.com marketing website only.

4.1 Why this distinction matters

This is an architectural separation, not a labelling exercise.

The public marketing site and the authenticated platform are different environments. Analytics and marketing technologies run on the marketing site — the pages where someone reads about our products, requests a demonstration or starts a free trial. Apart from the Intercom support messenger described in section 3.2, which is a support tool and not an analytics or marketing tool, no analytics or marketing technology runs inside the authenticated platform, where student, learner and candidate records live. We have designed the environments so that there is no route by which a student record reaches an analytics or marketing provider, because those tools are not present in the environment the records are in.

The practical consequence: a student logging in to check their timetable is not being measured by a marketing analytics provider, is not being added to a marketing audience, and is not being profiled for advertising. A candidate in Hiree365 is not being tracked by a marketing tool. Nothing in this section touches a child’s record.

4.2 What these providers do see

They see activity on the public marketing website and interactions with our business-to-business marketing: which marketing pages are visited, how visitors arrive, and whether a business contact opened one of our marketing emails. The people concerned are staff at institutions and organisations who have engaged with us commercially. That data is held under the marketing and CRM category of our Data Retention Schedule — 36 months from last engagement.

4.3 Cookies and consent

Our Cookie Policy explains what each of these providers sets on your device, which category it falls into, and how consent is obtained in jurisdictions that require it. It also confirms that marketing and advertising technologies do not operate inside the authenticated platform.

5. Optional integrations enabled by the institution

The following are not our sub-processors. They are optional integrations that an institution chooses to enable and contracts for directly.

5.1 SMOWL — online quiz proctoring

SMOWL performs proctoring under its own terms. An institution that wants online proctoring chooses to enable SMOWL and contracts with SMOWL directly, under SMOWL’s own terms and privacy policy. SMOWL is not engaged by us and does not process data on our instructions.

This matters for biometrics, so we state our position exactly:

Classe365 and Hiree365 do not themselves collect, store or process biometric identifiers — including fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints — and do not perform facial or voice recognition.

Institutions may choose to enable SMOWL, a third-party proctoring service, which they contract with directly. Any biometric processing by SMOWL occurs under SMOWL’s own terms and privacy policy, not ours.

An institution enabling SMOWL should review SMOWL’s terms and privacy policy, satisfy itself about what SMOWL processes, and meet its own notice and consent obligations to the students concerned. Those obligations sit with the institution, because it is the institution that has chosen the service and entered into the contract.

5.2 Zapier — customer-configured automation

Zapier lets a customer connect the platform to other systems it uses and move data between them automatically. The customer controls what data flows to it. The customer builds the automation, chooses which fields it carries, and decides which destination systems receive them.

Because the customer configures the flow, the customer is responsible for what leaves the platform through it, for its contract with Zapier, and for the onward destinations it has connected. Institutions should treat a Zapier automation carrying student data as a disclosure of student data and govern it accordingly. Where children’s data is involved, an institution should consider whether such a flow is consistent with the educational purpose for which it has authorised the collection and use of that data, and with the notices it has given parents.

5.3 Institution-built integrations generally

The same principle applies to any integration a customer builds itself — through our APIs or otherwise. Where a customer directs data out of the platform to a system of its own choosing, the customer is responsible for that destination. It is not a sub-processor of ours and does not appear on this list, because we did not engage it and do not control it.

6. Group support team

Classe365 provides 24/7 follow-the-sun support. Our support and engineering staff are employees of the Classe365 group, not third-party sub-processors.

Our support and engineering staff may access customer data, including student data, to provide support and engineering. Customer data is hosted on Amazon Web Services and is not stored in any of these locations. Staff access it remotely, and only when needed to resolve a support request or fix a fault.

We state this plainly, in this document and in our Privacy Policy, Security Statement, Data Retention Schedule and AI Use and Transparency Statement, because institutions and parents are entitled to know who can see student records.

That access is subject to:

• access controls — role-based, least-privilege access, granted for the purpose and no wider, with access logged;

• contractual confidentiality obligations binding on each group company and its staff; and

• intra-group data transfer agreements governing the transfer of personal data within the group.

Our support and engineering staff work for companies in the same group as the contracting entities. They are not a third party engaged at arm’s length, which is why they appear in their own section rather than in section 3. Where required, the transfer mechanisms set out in our Personal Data Processing Agreement apply to that remote access, and are described on our International Data Transfers page. Spain is within the European Union.

7. How we notify you of changes to this list

7.1 Notice before a change takes effect

Before we add a new sub-processor that will receive student or candidate data, or replace an existing one, we will give at least 30 days’ notice before the change takes effect. Notice is given by:

• updating this list on classe365.com, with the new “Last updated” and “Effective” dates; and

• emailing institutional account contacts.

Institutions should make sure the contact we hold for them is a monitored address, and can ask us at clientservice@classe365.com to add or change the address that receives these notices.

7.2 Changes that do not require notice

A change of name, a corrected description, or a clarified location entry for a provider already on the list is a correction, not a new sub-processor, and takes effect when published. Removing a sub-processor takes effect when published — fewer parties with access is not a change anyone needs 30 days to prepare for.

7.3 Emergency changes

Very occasionally we may need to engage a sub-processor at short notice — to maintain security, to keep the service running, or to replace a provider that has failed. Where that happens, we will engage it under the requirements in section 2, update this list, and notify institutional account contacts as soon as we reasonably can, explaining what happened and why the ordinary notice period could not be met.

8. How to object to a change

8.1 Your right to object

An institution may object to the addition or replacement of a sub-processor on reasonable grounds relating to data protection.

8.2 How to object

Write to clientservice@classe365.com within the 30-day notice period, identify the sub-processor concerned, and explain the grounds for the objection. An objection from an institution’s authorised contact is enough — there is no form to complete.

8.3 What we do with an objection

We will work with the institution in good faith to address the concern. That may mean explaining the safeguards in place, providing further detail about the sub-processor’s role and security, agreeing a configuration in which the institution’s data is not processed by that sub-processor where that is technically possible, or proposing an alternative approach.

Where we cannot resolve the objection and the change would have a material adverse effect on the institution’s ability to meet its own data protection obligations, the institution may terminate the affected subscription in accordance with its agreement with us and our Personal Data Processing Agreement. That termination is the institution’s sole remedy for the objection, and fees already paid are not refundable except where the agreement or applicable law requires.

8.4 Objections about a sub-processor already on the list

The same address works for a concern about a sub-processor already engaged. Tell us the concern and we will answer it. We will provide the detail an institution reasonably needs to assess a sub-processor, subject to the confidentiality obligations we owe that provider.

8.5 Parents and students

If you are a parent, a student or a candidate, and you have a concern about who processes your or your child’s information, raise it with your institution, which controls the records and holds the relationship with you. You are also welcome to write to us at clientservice@classe365.com, and we will help the institution answer.

9. Changes to this document

We review this list at least annually, and whenever a sub-processor is added, removed or changed. Additions and replacements follow the notice process in section 7.

Each version carries a “Last updated” date and an “Effective” date at the top. The current version was published on 22 September 2026 and takes effect on 22 October 2026.

10. Contact us

Questions about this list, or to object to a change: clientservice@classe365.com Support: clientservice@classe365.com Accessibility line: +61 2 9472 5000

By post — United States customers: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

By post — all other customers: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you are completing a vendor assessment and need more detail about any party named here, write to us. We would rather answer the question than have it answered by assumption.

Classe365 and Hiree365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with 24/7 support and engineering provided by our group team in Australia, India, the Philippines, Spain and the United States.