Subprocessors Purpose of Processing Activity Registered Business Address Location of Processing Link to Privacy / Security Policy Transfer Mechanism as applicable

G-Suite

Corporate platform for file storage and communication.

Googleplex

Mountain View, California

United States

https://policies.google.com/privacy C2P SCCs

Google Analytics

Only used for StarLeaf’s public websites according to the privacy notice purposes at this link .

Googleplex

Mountain View, California

United States

https://policies.google.com/privacy C2P SCCs

MailChimp

Used for service announcements.

Ponce City Market

Atlanta, Georgia

United States

https://mailchimp.com/legal/privacy/

C2P SCCs

Salesforce

Used by the marketing and sales entity within StarLeaf for sales management.

Heron Tower

110 Bishopsgate

London EC2N 4AY

United Kingdom,

Germany

https://www.salesforce.com/uk/company/privacy/ Determination of adequacy

Pardot

Used by the marketing and sales entity within StarLeaf for sales management.

The Landmark at One Market

Suite 300

San Francisco, CA

United States

https://www.salesforce.com/company/privacy/ >BCR & C2P SCCs

Plivo

Used for PSTN connectivity when audio participants join meetings.

201 Mission Street

Suite 230

San Francisco, CA

United States

https://www.plivo.com/privacy/

C2P SCCs

Twilio

Used for PSTN connectivity when audio participants join meetings.

375 Beale Street

San Francisco, CA

United States

https://www.twilio.com/legal/privacy

C2P SCCs

Sendgrid

This service is used to facilitate automated meeting invites and other email notifications.

889 Winslow St.

Redwood City, CA

United States

https://sendgrid.com/policies/privacy/

C2P SCCs

Microsoft

Corporate platform for file storage and communication.

Registration number 01624297, Microsoft Campus, Thames Valley Park, Reading, Berkshire, RG6 1WG

London, Cardiff, Durham within the UK; also data may reside in EU compliant data centres of Western Europe.

https://privacy.microsoft.com/en-us/privacystatement

Determination of adequacy

Allendevaux & Company

Data protection implementation, audit, risk governance, and cybersecurity services

35 Rockridge Road, Englewood, Ohio 45322, United States

United States

https://www.allendevaux.com/privacy-notice

C2P SCCs

Media Network Services

Recording services for audio, video and content sharing.

Karenslyst Allé 8a, 0278 Oslo, Norway

(1) Frankfurt, DE Equinix FR4,  Kleyerstrasse

(2) Frankfurt, DE, Equinix FR5, Larchenstrasse

https://www.mns.vc/privacy/

Determination of adequacy

Amazon S3

Amazon Simple Storage Services for storing encrypted attachments associated with chat messages.

AMAZON WEB SERVICES UK LIMITED

1 Principal Place, Worship Street, London, EC2A 2FA

Registration 08650665

Of the 16 AWS regions worldwide (42 zones), data follows the organisation’s PBX node. For instance, if in London, it would be 1 of 3 AWS zones in London.

https://aws.amazon.com/privacy/

Determination of adequacy

BlueJeans Gateway by Verizon

Registered gateway for Microsoft Teams traffic.

BlueJeans Network

3098 Olsen Dr., 2nd floor

San Jose, CA 95128

United States

https://www.bluejeans.com/trust-center

https://www.bluejeans.com/privacy-policy

C2P SCCs

VOXBONE, S.A.

Metadata of PSTN call (origin, destination) via SS7 or IP networking, which can include SIP calling data.

Avenue Louise 489, 1050 Brussels, Belgium, and holder of the VAT number VAT BE 0478.928.788.

Belgium (primary). Others: Los Angeles, New York, Frankfurt, Hong Kong, Sydney.

https://www.voxbone.com/privacy-policy/

C2P SCCs

Intercom

Live web chat, on our websites

Intercom R&D Unlimited Company, a company registered in Ireland with a registered address at 2nd Floor, Stephen Court, 18-21 Saint Stephen’s Green, Dublin 2; Intercom, Inc. a Delaware corporation with offices at 55 2nd Street, 4th Fl., San Francisco, CA 94105, USA;

Ireland,

United States

https://www.intercom.com/legal/privacy

https://www.intercom.com/help/en/articles/1722980-how-intercom-tracks-and-stores-data

C2P SCCs