Sub-processors
DRAFT — not legal advice. Review with qualified counsel (Indian law: IT Act 2000, DPDP Act 2023; plus GDPR/UK GDPR if serving EU/UK customers) before publishing.
Last updated: [Effective date]
These are the third parties that process customer personal data on our behalf to run Mail by vizsu. Each is bound by data protection terms at least as protective as our Data processing agreement.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
| Google Cloud | Hosting: compute, databases, storage | All service data | India (Mumbai) | [Confirm in use] |
| Amazon Web Services: Amazon SES | Sending outbound mail; bounce and complaint events | Outbound messages, sender and recipient addresses, delivery events | India (ap-south-1) | In use |
| Amazon Web Services: Amazon S3 | Mail and backup storage | Stored messages and attachments, backups | India (ap-south-1) | [Planned; storage provider not final] |
| Cloudflare | DNS [and edge network] | DNS queries, IP addresses, [request metadata] | Global | [Confirm] |
| vizsu payment gateway | Subscription payments | Billing contact, payment details | [Location] | When billing is enabled |
| [Support tool] | Customer support | Support messages, contact details | [Location] | [TBD] |
Optional, customer-enabled
These are used only when an admin turns on the matching feature, and act on the customer's instruction:
| Provider | Feature | Data |
|---|---|---|
| Google (Workspace / Gmail APIs) | Import from Google | Mail, contacts and calendars being imported, OAuth tokens |
| Microsoft (Microsoft 365 / Graph) | Import from Microsoft | Mail, contacts and calendars being imported, OAuth tokens |
Affiliates
[List any vizsu group companies that access customer data, for example for support, or state "None".]
Changes
We give at least [30] days' notice before adding or replacing a sub-processor. To get notices, [subscribe at [link] / they are emailed to account owners]. To object, write to [Privacy email] within that period.
---
Placeholders to fill
- [Effective date]
- Confirm which of Google Cloud and AWS host what (both listed today)
- Final mail storage provider (AWS S3, Google Cloud Storage, or Cloudflare R2 are all still options)
- Whether Cloudflare proxies web traffic or only serves DNS
- Payment gateway entity and location
- [Support tool] and any email/analytics tooling
- Affiliates
- Notice period [30] days, notice channel, [Privacy email]