A sub-processor is a third party that processes personal data on ChromaChecker's behalf, for the service ChromaChecker provides to its customers. This list forms part of our Data Processing Agreement (Annex III). We give 30 days' notice before engaging a new sub-processor, by updating this page and notifying each account's administrative contact. Customers may object on reasonable data protection grounds; if an objection cannot be resolved, the affected part of the service may be terminated without penalty (DPA §7).
Sub-processors
| Party | Role | Data reached | Location | Transfer basis |
|---|---|---|---|---|
| OVH | Hosting of the entire platform | All data the service holds | Canada — Beauharnois, Quebec | Commission adequacy decision 2002/2/EC (organisations subject to PIPEDA); UK adequacy regulations |
| SocketLabs, Inc. | Outbound mail relay: two-factor sign-in codes, bug reports, system email | Recipient address and message content: the one-time sign-in code and the account it belongs to; application logs, system information and whatever the operator writes in a bug report | United States | Standard Contractual Clauses incorporated in DPA §11 |
What is not on this list
- Your own accounts. Dropbox, Google Drive and Amazon S3 (Cloud Storage plugin), an MQTT broker (IoT Bridge plugin) and Heidelberg Prinect (Prinect Bridge plugin) are reached only if you enable the plugin, with your own credentials, under your own agreement with that provider. ChromaChecker does not hold that data.
- ChromaChecker's own infrastructure. Our servers are hosted by OVH. They are where the processing happens, not a further party.
- ChromaChecker's own processing. Systems we use as a controller for licence administration, invoicing and our own correspondence are described in our Privacy Policy.
- Certificate and browser-safety traffic. Certificate status and Safe Browsing requests made by the embedded browser engine carry no customer data.
- Vimeo, which plays tutorial videos in the Video plugin, acts as its own controller. It is described in our Cookie Policy.
Changes since the previous version: none — first publication.
