List of Subprocessors
To support delivery of our Services, Constructor Technology AG (the “Company”) (or one of its Affiliates), may engage and use data processors with access to certain Customer Data (each, a "Subprocessor"). This page provides important information about the identity, location and role of each Subprocessor.
Subprocessors
The Company currently uses subprocessors to provide infrastructure services, and to help us provide customer support and email notifications. Prior to engaging any subprocessor, the Company performs due diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations. Agreements are executed on terms that offer privacy guarantees no less protective than those at the Company.
Infrastructure Subprocessors
| Entity Name | Purpose of Processing | Location of Subprocessors | Related Service(s) / Products | Appropriate Safeguards for Transfers outside the EU | Additional Details |
| Amazon Web Services | Cloud S3 storage for clients in Brazil | Brazil | Proctor | Not applicable | https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf |
| Microsoft Azure | Cloud hosting | Singapore | Administration | Not applicable | https://learn.microsoft.com/en-gb/compliance/regulatory/gdpr |
| VZ Hybrid Compute Limited | Cloud hosting for clients in the USA | USA | Proctor, Sport, School products | Not applicable | https://www.virtuozzo.com/legal/ |
| VZ Hybrid Compute Limited | Cloud hosting for clients in the Canada | Canada | School products | Not applicable | https://www.virtuozzo.com/legal/ |
| Google Cloud Platform | Cloud hosting for APAC clients | Indonesia | Proctor | Not applicable | https://cloud.google.com/terms/data-processing-addendum |
| Google Cloud Platform | Cloud hosting for EU clients | Frankfurt | Practice | Not applicable | https://cloud.google.com/terms/data-processing-addendum |
| Oracle cloud | Cloud hosting for UAE clients | UAE | Proctor | Not applicable | https://www.oracle.com/ae/legal/privacy/services-privacy-policy/ |
| Oracle cloud | Cloud hosting for KSA clients | KSA | Proctor | Not applicable | https://www.oracle.com/sa/legal/privacy/services-privacy-policy/ |
| OVHCloud | Cloud hosting for US clients | USA | School products | Not applicable | https://www.ovhcloud.com/en/ |
| OVHCloud | Cloud hosting for EU clients | France | Research | Not applicable | https://www.ovhcloud.com/en/ |
| VZ Hybrid Compute Limited | Cloud hosting | Germany | Proctor, Model, Research, Sport, Autonomous mobility, Learn, Practice, Groups, Assess, Avatar, Platform | Not applicable | https://www.virtuozzo.com/legal/ |
| NGN | Cloud hosting for Turkey clients | Turkey | Groups | Not applicable | https://www.ngn.com.tr/en/security-and-confidentiality/ |
| Netcore | Cloud hosting for Turkey clients | Turkey | Schedule, Egitim365 | Not applicable | https://netcore.com.tr/en/privacy-policy/ |
Platform Subprocessors
| Entity Name | Purpose of Processing | Location of Subprocessors | Related Service(s) / Products | Appropriate Safeguards for Transfers outside the EU | Additional Details |
| Segment | Analytics | USA | All services | Standard Contractual Clauses as per European Commission's Decision 2021/914/EU of June 4, 2021, (2) UK Addendum, and (3) additional safeguards with respect to security measures including data encryption, data aggregation, separation of access controls and data minimization principles. | https://segment.com/docs/privacy/complying-with-the-gdpr/#opting-into-the-data-processing-agreement-and-standard-contractual-clauses |
| Microsoft Azure | DevOps support | Netherlands | All services | Not applicable | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA |
| Writereader | Learning | Denmark | School products | Not applicable | https://www.writereader.com/wp-content/uploads/2023/12/Data-Processor-Agreement-DPA-updated-08_02_23.pdf |
| Acapela | Text-to-speech | Belgium | School products | Not applicable | https://www.acapela-group.com/legal-info/ |
| Stripe | Third-Party payment processes | USA | School products | EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework | https://stripe.com/en-gb-hu/legal/privacy-center |
| Saferpay | Third-Party payment processes | Switzerland | School products | GDPR adequacy | https://worldline.com/en-ch/compliancy/privacy.html |
| Edulog | Third-Party Login service | Switzerland | School products | GDPR adequacy | https://www.edulog.ch/de/datenschutzerklaerung |
| Feide | Third-Party Login service | Norway | School products | Not applicable | https://www.feide.no/ |
| Eduapps | Third-Party Login service | Germany | School products | Not applicable | https://www.eduapps.de/datenschutz/ |
| Infomaniak | Routing and transmission of emails | Switzerland | School products | GDPR adequacy | https://manager.infomaniak.com/dpa |
| Mailgun | Routing and transmission of emails | USA | School products | Standard Contractual Clauses as per European Commission's Decision 2021/914/EU of June 4, 2021, (2) UK Addendum, and (3) additional safeguards with respect to security measures including data encryption, data aggregation, separation of access controls and data minimization principles. | |
| Turnitin, LLC | Academic integrity assessment | USA | Assess | EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework | https://guides.turnitin.com/hc/en-us/articles/27377195682317-Turnitin-Services-Privacy-Policy |
Customer support subprocessors
| Entity Name | Purpose of Processing | Location of Subprocessors | Related Service(s) / Products | Appropriate Safeguards for Transfers outside the EU | Additional Details |
| Freshworks | Third-party service provider of customer support tools | United States | All services | EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework | https://www.freshworks.com/data-processing-addendum/ |
| HubSpot | Third-party service provider of customer support tools | Ireland | All services | Not applicable | https://legal.hubspot.com/dpa |
Business Operations subprocessors
| Entity Name | Purpose of Processing | Location of Subprocessors | Related service(s) / products | Appropriate Safeguards for Transfers outside the EU | Additional Details |
| Zoom | External and internal communications | USA | All services | EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework | https://explore.zoom.us/en/gdpr/ |
| Crisp IM SAS | External and internal communications | Netherlands | All services | Not applicable | https://crisp.chat/en/privacy/ |
| Infomaniak | External communications, internal collaboration and data sharing | Switzerland | School products | GDPR adequacy | https://www.infomaniak.com/en/legal/general-data-protection-regulation |
| Microsoft | External communications, internal collaboration and data sharing | Ireland | All services | Not applicable | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA |
Affiliates
Depending on the geographic location of a Customer or their Authorized Users, and the nature of the Services provided, the Company may also engage one or more of its Affiliates as Subprocessors to deliver some or all of the Services provided to a Customer.
Updates
As our business grows and evolves, the subprocessors we engage may also change. We will provide notice of any new subprocessors by posting such updates here. Please check back frequently for updates.
