Sub-processors
Effective starting: 2 September, 2026
Account owner and manager specific sub-processors
Sub-processor services we use to engage and support account owners, program managers, chapter managers (collectively, “Managers”), billing and security contacts in your organisation.
Entrants/applicants, nominators and judges/reviewers do not make use of these services.
| Sub-processor | Business location | Data processing location(s) | Description of services provided |
|---|---|---|---|
| Chargebee https://www.chargebee.com |
United States | European Union | Subscription management and billing. Processes personal data of account owners and billing contacts. Uses Standard Contractual Clauses. Technical security measures: https://www.chargebee.com/security |
| Databricks https://www.databricks.com |
San Francisco, US | United States | Data pipeline management. May process personal data of Managers. Uses Standard Contractual Clauses. Technical security measures: https://www.databricks.com/trust |
| Elevio https://elev.io |
Melbourne, Australia | United States | In-app help panel. Processes email addresses of Managers. Uses Standard Contractual Clauses. |
| Hubspot https://www.hubspot.com |
Ireland | United States | CRM for sales and marketing. Processes personal data of Managers. Uses Standard Contractual Clauses. Technical security measures: https://www.hubspot.com/security |
| Intercom https://www.intercom.com |
San Francisco, US | United States | Messaging and support management. Processes personal data of Managers. Uses Standard Contractual Clauses. Technical security measures: https://www.intercom.com/security |
| Zendesk https://www.zendesk.com |
San Francisco, US | Australia | Client support ticketing. Processes personal data of Managers. Uses Standard Contractual Clauses. Technical security measures: https://www.zendesk.com/product/zendesk-security |
| Zonka https://www.zonkafeedback.com |
Gurugram, India | European Union | NPS surveys. Processes personal data of Managers. Uses Standard Contractual Clauses. Technical security measures are described in an annex to our DPA executed with Zonka. |
All user sub-processors
Sub-processor services we use to engage and support your organisation, your program and your participants. All roles including account owners, program managers, chapter managers, entrants, applicants, nominators, judges and reviewers make use of these services.
| Subprocessor | Business location | Data processing location(s) | Description of services provided |
|---|---|---|---|
| Amazon Web Services https://aws.amazon.com |
Seattle, US | Choice of: Australia Canada European Union Hong Kong Singapore United States |
Cloud hosting infrastructure for whole application stack. Processes personal data of end-users. Uses Standard Contractual Clauses. Technical security measures: https://aws.amazon.com/blogs/security/aws-and-eu-data-transfers-strengthened-commitments-to-protect-customer-data https://aws.amazon.com/security |
| Datadog https://www.datadoghq.com |
New York, US | European Union | Application monitoring. May process personal data of end-users. Uses Standard Contractual Clauses. Technical security measures: https://www.datadoghq.com/security/ |
| Embeddable https://embeddable.com |
London, United Kingdom | Depending on hosting choice: European Union (default) United States |
Dashboard caching. May process personal data of end-users. Uses Standard Contractual Clauses. Technical security measures: https://embeddable.com/policies/dpa (see Exhibit B of DPA) |
| Google Cloud https://cloud.google.com |
Dublin, Ireland | Depending on hosting choice: Australia Canada European Union Hong Kong Singapore United States |
Cloud infrastructure for collaboration. May process personal data of end-users. Uses Standard Contractual Clauses. Technical security measures: https://cloud.google.com/security |
| Heap https://www.heap.io |
San Francisco, US | European Union | Application insights. May process personal data of end-users. Uses Standard Contractual Clauses. Technical security measures: https://www.heap.io/legal (see Schedule 2 of DPA) |
| Imgix https://www.imgix.com |
San Francisco, US | United States (rendering) Various edge nodes (caching) |
Image processing service. May process personal data of end-users, captured in uploaded images and PDFs. Uses Standard Contractual Clauses. Can be deactivated by request. |
| Invopop https://www.invopop.com |
Madrid, Spain | European Union | e-invoicing service. Processes personal data of end-users receiving e-invoices sent from your account. Uses Standard Contractual Clauses. Technical security measures: https://trust.invopop.com/ |
| Mailgun / Sinch https://www.mailgun.com |
San Francisco, US | European Union | Email sending service. Processes personal data used in the delivery and communication of email messages to end-users. Uses Standard Contractual Clauses. Technical security measures: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/ (see Annex 2 of DPA) |
| Prismatic https://prismatic.io |
Sioux Falls, US |
European Union | Optional integration service. May process personal data of end-users when marketplace integrations are activated. Uses Standard Contractual Clauses. Technical security measures: https://prismatic.io/legal/security/ |
| Twilio https://www.twilio.com |
San Francisco, US | United States | Optional SMS sending service. May process personal data of end-users if included in SMS messages. Uses Standard Contractual Clauses. Technical security measures: https://www.twilio.com/en-us/legal/data-protection-addendum |