Sub-processors list at Ambassify

Each of our Sub-Processors will have an executed DPA to ensure compliance under the EU GDPR requirements. An audited minimum relevant set of data is shared with each vendor. This information is provided in respect of the Data Processing Agreement, which is available for self-execution or consultation in PDF format.

If you like te be notified about sub-processor changes you can subscribe to our sub-processor update mailing list.

Optional * Data you as a Data Controller can choose to allow or not by specifying these in the Data Processing Agreement.
Required Data which is needed for the functionality of the platform.

Company	Products	Data Location	Security Measures	Data Categories
Amazon.com, Inc. 410 Terry Avenue North, Seattle, WA 98109, USA	S3 SQS SES RDS CloudFront Bedrock EC2 EKS Lambda Neo4J	Germany (Frankfurt) Ireland (Dublin) Europe North America	Access control Encryption at rest Encryption in transit Pseudonymisation Recoverability Transfer Impact Assessment	Advocates 23 fields passwords interests unique id name profile picture platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in access token Managers 12 fields passwords unique id name platform activity preferred language email email address IP address browser country opt-in access token
Redis Labs, Inc. 700 E El Camino Real Suite 250, Mountain View, CA 94040	RedisLabs	Ireland (Dublin)	Access control Encryption at rest Encryption in transit Recoverability Transfer Impact Assessment	Advocates 6 fields passwords unique id email text messages notifications access token Managers 4 fields passwords unique id email access token

Company	Products	Data Location	Security Measures	Data Categories
Amazon.com, Inc. 410 Terry Avenue North, Seattle, WA 98109, USA	S3 SQS SES RDS CloudFront Bedrock EC2 EKS Lambda Neo4J	Germany (Frankfurt) Ireland (Dublin) Europe North America	Access control Encryption at rest Encryption in transit Pseudonymisation Recoverability Transfer Impact Assessment	Advocates 23 fields passwords interests unique id name profile picture platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in access token Managers 12 fields passwords unique id name platform activity preferred language email email address IP address browser country opt-in access token
Salesforce.com, Inc. 415 Mission Street, Suite 300, San Francisco, CA 94105, USA	Heroku	Ireland (Dublin)	Access control Encryption in transit Transfer Impact Assessment	Advocates 19 fields interests name platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in Managers 10 fields unique id name platform activity preferred language email email address IP address browser country opt-in

Company	Products	Data Location	Security Measures	Data Categories
Amazon.com, Inc. 410 Terry Avenue North, Seattle, WA 98109, USA	S3 SQS SES RDS CloudFront Bedrock EC2 EKS Lambda Neo4J	Germany (Frankfurt) Ireland (Dublin) Europe North America	Access control Encryption at rest Encryption in transit Pseudonymisation Recoverability Transfer Impact Assessment	Advocates 23 fields passwords interests unique id name profile picture platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in access token Managers 12 fields passwords unique id name platform activity preferred language email email address IP address browser country opt-in access token
CloudFlare, Inc. 101 Townsend St San Francisco, CA 94107	CloudFlare	Global	Access control Encryption in transit Transfer Impact Assessment	Advocates 1 fields IP address Managers 1 fields IP address

Company	Products	Data Location	Security Measures	Data Categories
Amazon.com, Inc. 410 Terry Avenue North, Seattle, WA 98109, USA	S3 SQS SES RDS CloudFront Bedrock EC2 EKS Lambda Neo4J	Germany (Frankfurt) Ireland (Dublin) Europe North America	Access control Encryption at rest Encryption in transit Pseudonymisation Recoverability Transfer Impact Assessment	Advocates 23 fields passwords interests unique id name profile picture platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in access token Managers 12 fields passwords unique id name platform activity preferred language email email address IP address browser country opt-in access token
Twilio Inc. Optional 375 Beale Street, Suite 300 San Francisco, CA 94105	Twilio	Germany (Frankfurt)	Access control Encryption in transit	Advocates 2 fields text messages telephone number

Company	Products	Data Location	Security Measures	Data Categories
Amazon.com, Inc. 410 Terry Avenue North, Seattle, WA 98109, USA	S3 SQS SES RDS CloudFront Bedrock EC2 EKS Lambda Neo4J	Germany (Frankfurt) Ireland (Dublin) Europe North America	Access control Encryption at rest Encryption in transit Pseudonymisation Recoverability Transfer Impact Assessment	Advocates 23 fields passwords interests unique id name profile picture platform activity birth date preferred language email text messages notifications employer job titles social unique id connections email address telephone number physical address IP address browser country opt-in access token Managers 12 fields passwords unique id name platform activity preferred language email email address IP address browser country opt-in access token

Company	Products	Data Location	Security Measures	Data Categories
Intercom, Inc. 55 2nd Street 4th Floor San Francisco, CA 94105	Intercom	Ireland (Dublin)	Access control Encryption at rest Encryption in transit Transfer Impact Assessment	Managers 9 fields unique id name platform activity preferred language chat email email address browser country
Startdeliver Kungsgatan 33, 111 56 Stockholm, Sweden	Startdeliver	Germany (Frankfurt)	Access Controls Encryption at rest Encryption in transit	Managers 3 fields name email email address

Categories of Personal Data Processed

The Ambassify service processes the following personal data:

Advocates

Actual end-users that only have access to the community and landing pages of our platform. Most of the times this will be your employees.

Optional * Data you as a Data Controller can choose to allow or not by specifying these in the Data Processing Agreement.
Required Data which is needed for the functionality of the platform.

Data	Purpose/Description	Lawfulness	Source	Retention Period
passwords *	Identification A hashed version of the password.	Contractual Necessity	User-completed form	1 years
interests *	Segmentation Groups that were assigned to the advocate by one of the managers or that the advocate subscribed to.	Legitimate Interest	User-completed form	2 years
unique id	Identification Universal Unique Identifier (UUID) generated by Ambassify for a specific person. Example: de595e11-8854-4dc2-868d-a69c94501040	Contractual Necessity	API	5 years
name	Identification Example: John Doe	Contractual Necessity	User-completed form	2 years
profile picture *	Identification Link to a profile or avatar picture	Contractual Necessity	Social Network	2 years
platform activity	Measurement We log for reporting purposes the different actions a users does on the platforms. Examples of such activity are: pageviews, campaign participations, errors triggered	Contractual Necessity	API	5 years
birth date *	Segmentation Example: 2021-10-30	Legitimate Interest	User-completed form	2 years
preferred language	Segmentation Example: NL	Legitimate Interest	User-completed form	2 years
email	Contact Copies of the emails that managers send through Ambassify to this advocate.	Contractual Necessity	API	2 years
text messages *	Contact Copies of the text messages that managers send through Ambassify to this advocate.	Contractual Necessity	API	2 years
notifications	Contact Mobile application notifications that were send through the Ambassify platform to this advocate.	Contractual Necessity	API	2 years
employer *	Segmentation Example: Acme Corporation	Legitimate Interest	User-completed form	2 years
job titles *	Segmentation Example: CEO	Legitimate Interest	User-completed form	2 years
social unique id	Identification Once a advocate decides to connect his social media account to Ambassify we will receive a unique identifier for that specific user from the social platform. Example: linkedin\|5-l9LKSrox	Subject Consent	API	2 years
connections	Measurement The number of connections (friends, connections, followers) someone has on the social media channel that gets connected. We use this value to calculatete potential reach for shared content. This is only a numeric value and not a list of names. Example: 15	Subject Consent	Social Network	2 years
email address	Identification The e-mail address that can be used by the advocate to login and we will also use this address as primary contact point. Example: dev@ambassify.com	Contractual Necessity	User-completed form	3 years
telephone number *	Contact Example: +32 12 34 56 78	Subject Consent	User-completed form	2 years
physical address *	Contact Example: Everselstraat 133, 3583 Beringen, Belgium	Subject Consent	User-completed form	2 years
IP address	Identification For debugging purposes we store the advocates IP address. Example: 169.254.12.233	Legitimate Interest	API	120 days
browser	Identification For debugging purposes we store the advocates browser name and version. Example: Google Chrome 81	Legitimate Interest	API	120 days
country *	Segmentation An advocate can choose to set his country on his community profile	Subject Consent	API	2 years
opt-in	Compliance To keep track of the advocates communication preferences: Example: Only emails about new campaigns	Legal Obligation	User-completed form	2 years
access token	Identification Access token to share content on social networks of choice	Contractual Necessity	API	1 years

Managers

Admins that will use Ambassify to publish content on the communities and landing pages for the advocates to read and participate in.

Optional * Data you as a Data Controller can choose to allow or not by specifying these in the Data Processing Agreement.
Required Data which is needed for the functionality of the platform.

Data	Purpose/Description	Lawfulness	Source	Retention Period
passwords *	Identification A hashed version of the password.	Contractual Necessity	User-completed form	1 years
unique id	Identification Universal Unique Identifier (UUID) generated by Ambassify for a specific person. Example: de595e11-8854-4dc2-868d-a69c94501040	Contractual Necessity	User-completed form	5 years
name	Identification Example: John Doe	Contractual Necessity	User-completed form	2 years
platform activity	Measurement We log for reporting purposes the different actions a users does on the platforms. Examples of such activity are: pageviews, campaign participations, errors triggered	Contractual Necessity	User-completed form	5 years
preferred language	Segmentation Example: EN	Legitimate Interest	User-completed form	2 years
chat	Contact Intercom history	Contractual Necessity	User-completed form	5 years
email	Contact E-mails with Ambassify Staff	Contractual Necessity	User-completed form	2 years
email address	Identification The e-mail address that can be used by the advocate to login and we will also use this address as primary contact point. Example: dev@ambassify.com	Contractual Necessity	User-completed form	3 years
IP address	Identification For debugging purposes and audit logs we store the managers IP address. Example: 169.254.12.233	Legitimate Interest	User-completed form	120 days
browser	Identification For debugging purposes we store the managers browser name and version. Example: Google Chrome 81	Legitimate Interest	User-completed form	120 days
country *	Segmentation A manager can choose to set his country on his community profile	Subject Consent	User-completed form	2 years
opt-in	Compliance Example: manager accepted the data processing agreement	Legal Obligation	User-completed form	2 years
access token	Identification Access token to share content on social networks of choice	Contractual Necessity	API	1 years