Studio Data Processing Addendum

This Studio Data Processing Addendum ("DPA") forms part of the agreement between SEFA Software LLC("Processor," "we," "us") and the dance studio entity that registers for Encore Dance("Controller," "Studio," "you"). It applies when you use the Service to process Personal Data about your instructors, parents, guardians, and students.

This DPA is incorporated into and governed by our Terms of Service. If there is a conflict between this DPA and the Terms regarding the processing of Personal Data, this DPA controls. Capitalized terms not defined here have the meanings in the Terms or Privacy Policy.

By creating a studio account or checking to accept this DPA at signup, you enter into this DPA on behalf of your studio.

• "Personal Data" means information relating to an identified or identifiable individual that you or your End Users submit to, or that is generated through, the Service.
• "Student Data" means Personal Data relating to studio students, including limited identity fields (first name, optional last initial, display handle), scheduling, attendance, package balances, and related operational records.
• "End Users" means instructors and parents or guardians you invite to your studio account.
• "Process" or "Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure, encryption, deletion, or retention.
• "Subprocessor" means a third party engaged by Processor to Process Personal Data on Processor's behalf.

You act as the Controller (or equivalent under applicable law) for Personal Data you enter about your studio operations, including Student Data. You determine the purposes and means of Processing that data in your business.

SEFA Software LLC acts as Processor and Processes Personal Data only on your documented instructions as set forth in this DPA, the Terms, your use of Service features, and applicable law. We do not sell Personal Data or Student Data. We do not use Student Data for cross-context behavioral advertising or unrelated profiling.

For our own account, billing, security, and platform operations relating to studio subscriptions, we may act as an independent controller as described in our Privacy Policy.

Because the Service is used to manage information about minors, you agree to the following. These obligations exist to protect children and families and to ensure lawful Processing.

• Obtain all required parental or guardian consents, verifiable where required by law (including COPPA where applicable), before creating student profiles or inviting parents.
• Provide clear notices to parents and guardians about how your studio uses the Service and what data is collected.
• Enter only data you are authorized to collect. Use minimized student identity fields (first name, last initial, display handle), not full names.
• Ensure instructions you give us through the Service (including data you enter, invites you send, and retention settings you use) comply with applicable law.
• Respond to data subject requests from your End Users where you are the Controller, using Account and privacy settings in the Service or by contacting us for reasonable assistance.
• Maintain the confidentiality and security of studio accounts, staff access, and kiosk check in credentials.
• Promptly notify us at privacy@encoredance.app if you become aware of unauthorized access to your studio account or a compliance issue involving Student Data.

You authorize us to engage Subprocessors to support the Service. We require Subprocessors to protect Personal Data through contractual or equivalent obligations. Current categories of Subprocessors include:

• Cloud hosting and infrastructure providers (e.g., application hosting, background jobs).
• Database hosting providers (e.g., managed PostgreSQL).
• Email delivery providers (when email features are enabled).
• Authentication and security infrastructure.

We will provide notice of material new Subprocessors by updating this page or notifying studio account owners. You may object on reasonable grounds relating to data protection by contacting privacy@encoredance.app. If we cannot accommodate a reasonable objection, you may terminate the affected Service as your sole remedy.

Personal Data may be Processed in the United States and other countries where we or our Subprocessors operate. Where required by law, we implement appropriate safeguards for cross-border transfers.

We retain Personal Data while your studio account is active and as needed to provide the Service. Student records support configurable retention and purge after archival (currently up to two years after soft deletion unless extended by activity or law).

Studio owners can export studio data and delete the studio account from Account and privacy settings. Instructors and parents can export their account data and remove their account from a studio through the same settings. When you delete student profiles or terminate your studio account, we will delete or de-identify Personal Data within a reasonable period, except where retention is required by law, for billing disputes, security, legal consent records, or backup cycles with limited retention.

You should download an export before deleting an account if you need a copy for your records. For requests that cannot be completed in the product, contact privacy@encoredance.app.

Upon reasonable written notice and subject to confidentiality, we will provide information necessary to demonstrate compliance with this DPA, such as summaries of security practices or responses to reasonable questionnaires, no more than once per year unless required by law or following a material security incident.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, including caps on direct damages and exclusions for indirect or consequential damages, to the maximum extent permitted by law.

You agree to indemnify SEFA Software LLC for third-party claims arising from your failure to obtain required consents, your unlawful Processing instructions, or your violation of applicable law as Controller, as set forth in the Terms.

This DPA begins when you accept it and continues while you use the Service to Process Personal Data. It terminates when you stop using the Service and deletion obligations in Section 8 are fulfilled, except provisions that by nature should survive.

We may update this DPA to reflect legal, technical, or product changes. Material updates will be posted at https://encoredance.app/dpa with an updated effective date. Continued use after notice constitutes acceptance where permitted by law. We maintain versioned acceptance records when you agree at signup.

Questions about this DPA or data processing requests: