Appendix 2

Sub Processors

The identity of the Sub-Processor (including full legal name, company registration number and address):The type of service provided by the Sub-Processor:The location where the Sub-Processor will process the Personal Data on behalf of the Data Controller, including applicable safeguards if personal data is processed outside of EU/EEA:
AWS Europe (Amazon Web Services EMEA SARL), B 186284, 38 Avenue John F. Kennedy, Luxembourg 1855, Luxembourg.Hosts the core application logic, plus file storage & certain databases.Germany, Sweden
MongoDB Atlas (MongoDB Limited), 499992, Building Two, Number One Ballsbridge DUBLIN, D04 Y3X9, Ireland.Hosts certain application databases.Germany, Sweden
Auth0 (Auth0®, Inc.), 603374146, 10800 NE 8th Street, Suite 600 Bellevue, WA, 98004, USA on behalf of Okta Inc, 100 1st Street, San Francisco, California, 94105, USA.User authentication.Germany
Google (Google Cloud EMEA Limited), 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.Platform data hosting.Ireland, Netherlands
Cloudflare (Cloudflare, Inc.) 4710875, 101 Townsend St, San Francisco, CA 94107, USA.Application networking services, including DNS.USA (SCCs)
Sendgrid (Twilio Ireland Limited), 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland.Sending emails to platform users (e.g. invites).USA (SCCs)
Onboard (Onboard Software Inc), 875 Vinewood Ave, Birmingham, Michigan, 48009, USA.Customer onboarding checklist and implementation aidUSA (SCCs)
Normative UK (Normative Ltd), Metal Box Factory, 30 Great Guilford St, London, SE1 0HS London, UK.Delivery of the Normative serviceUK (Adequacy)
Normative Germany (Normative DE Services GmbH), c/o Reitbauer GmbH, Parkstr.60, 63067 Offenbach, Germany.Delivery of the Normative serviceGermany