The following subprocessors have been vetted and are categorized across two domains: subscriber services and corporate subprocessors.

SUBSCRIBER SERVICE SUBPROCESSORS: Tools and services empowering subscriber services.

Subprocessors Processing Location and Activity Data Processed Circumstances under which this subprocessor may apply

Voxbone

Belgium.

Primary PSTN integration.

Caller’s PSTN number and audio stream.

StarLeaf customers can choose to use a PSTN dial-in number from a provider based in the location of their choice.

Plivo and Twilio

United States.

Backup PSTN integration. Twilio processing may occur in Ashburn, Virginia; San Jose, California; and Umatilla, Oregon. Plivo processing may occur in Austin, TX; Chicago, IL; New York, NY; Seattle, WA; San Francisco, VA; Los Angeles, CA.

Caller’s PSTN number and audio stream.

StarLeaf customers can choose to use a PSTN dial-in number from a provider based in the location of their choice.

Media Network Services

Norway.

Conference recording.

Recorded meeting media and metadata.

This subprocessor only applies to customers who have purchased the optional enterprise conference recording services.

SendGrid

United States.

Portal-initiated meeting invites and service notifications. Processing may occur in Denver, CO; Irvine, CA; and Redwood City, CA.

Business email address to initiate service, IP address and host name of system being registered.

Meeting invitations in the case where the StarLeaf portal is used to schedule meetings.

This subprocessor is used for the sending of invites where a customer is using the StarLeaf Portal for the scheduling of meetings. This subprocessor is not used where customers are scheduling meetings using StarLeaf scheduling add-ins.

This subprocessor is used for sending service notifications such as release updates and provisioning emails.

This subprocessor is also used for sending users’ authentication codes. As this activity is limited to a user’s email address, StarLeaf does not consider this to be a meaningful data disclosure.

Amazon S3

Location is tied to jurisdictional choice. Encrypted attachments.

Encrypted attachments.

For files shared via StarLeaf chat, if enabled.

Poly Gateway/ BlueJeans Gateway by Verizon

Teams gateway service. Processing may occur in US South in Texas; US West 2 in Washington; West Europe in Netherlands; in Victoria in Australia.

SIP URI, media streams

This subprocessor only applies to customers who have purchased the optional MS Teams gateway services which are for connecting room systems to Microsoft Teams meetings.

CORPORATE SUBPROCESSORS: Corporate commerce.

Subprocessors Processing Activity Processing Location Circumstances under which this subprocessor may apply

Microsoft O365

Corporate commerce

EU

For direct communications between StarLeaf staff and customers; for example, an email exchange.

Allendevaux & Company

Data protection

St. Kitts/Nevis

Provides independent Data Protection Officer (DPO) services for international data protection and complex compliance.

Google Analytics

Website analytics

United States.

Processing may occur in South Carolina; Oregon; Nevada; North Carolina; Oklahoma; Tennessee; Nebraska; Iowa; Georgia; Alabama; Virginia; Texas; Ohio; Nevada; Ireland; Denmark; Netherlands; Taiwan; Singapore; Belgium; Finland; Chile.

For monitoring and reporting on web traffic to StarLeaf websites.

Salesforce

Marketing and support activities

United Kingdom

For marketing, CRM, helpdesk and ticketing.

Zuora

Billing Management

United States.

Processing occurs in Redwood City, California.

Records of billing transactions are kept within Zuora.

Stripe

Credit card processing

United States.

Processing occurs in San Francisco, California.

This subprocessor only applies to direct customers who pay by credit card. Stripe provides PCI compliance.