IN BRIEF
This article explains how personal data entered into iClassPro is handled and who acts as the data controller or data processor. For data entered into the iClassPro System, the merchant/business controls the data, and iClassPro processes the data on the merchant/business’s behalf. It also explains the two meanings of Data Processing Addendum (DPA) and Data Processing Agreement, including when each applies.
- Overview
- Understanding Who Controls Data Entered into iClassPro
- What is a DPA, and when is it required?
- Data Processing Agreement handling
- Data storage location
- Troubleshooting & FAQs
- Related Articles
Overview
When a merchant/business enters personal data into iClassPro, that merchant/business determines how and why the data is used. This makes the merchant/business the data controller.
iClassPro provides the software used to process that data on behalf of the merchant/business. This makes iClassPro the data processor.
Understanding these roles can help businesses determine their responsibilities related to privacy, compliance, and data handling.
Data controller and data processor definitions
-
Data controller
- Determines how personal data is processed
- Determines the purpose for processing personal data
- Includes staff members who enter or process personal data to fulfill the role of the data controller
-
Data processor
- Processes personal data on behalf of the data controller
- Usually refers to a third party outside the company, such as:
- Software provider
- Data warehouse
Understanding Who Controls Data Entered into iClassPro
- Identify the personal data entered into the iClassPro System.
- This may include information entered by administrators, staff members, or other users acting on behalf of the merchant/business.
- Determine who decides how and why that data is used.
- For data entered into iClassPro, the merchant/business determines how and for what purposes the personal data is processed.
- Confirm the data controller role.
- The merchant/business is the data controller for personal data entered into the iClassPro System.
- Confirm the data processor role.
- iClassPro is the data processor because it processes personal data on behalf of the merchant/business.
- Review whether a DPA is needed.
- The acronym DPA has two separate meanings:
- Data Processing Addendum
- Data Processing Agreement
- The acronym DPA has two separate meanings:
What is a DPA, and when is it required?
The acronym DPA can refer to two different, distinct documents. However, when a DPA is mentioned, it generally refers to the Data Processing Addendum.
- Data Processing Addendum (DPA). iClassPro maintains a DPA that sets out the terms required under GDPR Article 28 and equivalent privacy laws. It covers ongoing processing of personal data within the iClassPro service. Customers who are required by applicable law to enter into a controller-processor contract, for example, under the UK GDPR, EU GDPR, or Swiss FADP, can request a countersigned copy at any time by contacting iClassPro
- Data Processing Agreement. Separate from the DPA above, iClassPro provides a Data Processing Agreement for customers engaging us for data conversion, imports, or custom database work. It is scoped to that specific engagement and is sent before the work begins.
Data Processing Agreement handling
When iClassPro provides a Data Processing Agreement for data conversion, imports, or custom database work, the agreement is sent before that work begins.
The Data Processing Agreement document is sent through Docusign. Once received, it is stored along with the merchant/business account information in iClassPro’s Customer Relationship Management system (CRM).
Data storage location
As of May 2026, data entered into iClassPro is stored in data centers located in the United States and Australia.
Troubleshooting & FAQs
-
Who controls the data entered into iClassPro?
- The merchant/business controls the data entered into iClassPro because the merchant/business determines how and why the personal data is processed.
-
What role does iClassPro have for data entered into the System?
- iClassPro is the data processor because it processes personal data on behalf of the merchant/business.
-
What does the acronym DPA usually mean?
- When a DPA is mentioned, it usually refers to the Data Processing Addendum. However, DPA can also refer to a Data Processing Agreement, depending on the context.
-
When is a Data Processing Agreement required?
- iClassPro provides a Data Processing Agreement for customers engaging iClassPro for data conversion, imports, or custom database work. It is scoped to that specific engagement and is sent before the work begins.
-
Where is data entered into iClassPro stored?
- As of May 2026, data entered into iClassPro is stored in data centers located in the United States and Australia.