This page provides information about the sub-processors engaged by Woba in accordance with Woba's Data Processing Agreement to support the delivery of Woba's services and the processing of customers' personal data on behalf of customers.
At the commencement of the Data Processing Agreement, the data controller has approved Woba's use of the sub-processors listed on this page.
Woba will update this page at least 30 days before engaging a new sub-processor or making material changes to the use of an existing sub-processor. Customers who subscribe to updates will be notified by email of changes to this page.
Woba primarily uses sub-processors located in the European Union or European Economic Area. Where Woba uses sub-processors outside the EU/EEA, Woba ensures that an appropriate transfer mechanism is in place, such as an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another valid transfer mechanism under applicable data protection law.
Information about the EU-U.S. Data Privacy Framework is available at dataprivacyframework.gov.
Minimum sub-processors
The following sub-processors are used as part of Woba’s core service delivery.
Aiven Oy
Effective from: 01.03.2018
Address: Antinkatu 1, 6th floor, 00100 Helsinki, Finland
Transfer mechanism: EU/EØS
Purpose
Aiven is used for hosting and operation of Woba’s production database, including managed database infrastructure, backup and restore functionality where applicable.
Location and hosting
Aiven Oy is a Finnish Database-as-a-Service provider. Woba’s database hosted by Aiven runs on infrastructure provided by UpCloud, also a Finnish company, with the relevant hosting location in Frankfurt, Germany.
Compliance and security
Aiven’s services are ISO 27000-series, GDPR, CCPA, HIPAA and PCI-DSS compliant. Aiven also provides ISAE 3000 / SOC 2 Type II reports.
Technical and security features include:
ISAE 3000
ISO 27K
GDPR
CCPA
HIPAA
PCI DSS
Automated security updates
Annual security testing
More information: Aiven Security
Heroku, a Salesforce company
Effective from: 01.06.2018
Address: Heroku, Inc., 415 Mission Street, 3rd Floor, c/o Salesforce, San Francisco, CA 94105, USA
Transfer mechanism: EU-U.S. DPF and EU SCC
Purpose
Heroku is used for hosting of the platform, not customer data.
Location and hosting
Heroku is a US company. Woba uses Heroku’s “Region: EU”, located in Frankfurt, Germany. Amazon Web Services hosts Heroku in the eu-central-1 region.
Compliance and security
Heroku’s compliance framework includes:
ISO 27001
SOC 1 and SOC 2 / SSAE 16 / ISAE 3402
PCI Level 1
FISMA Moderate
Sarbanes-Oxley Act compliance
More information: Heroku Security
ActiveCampaign LLC, owner of Postmark
Effective from: 01.06.2018
Address: 1 N Dearborn St, FL 5, Chicago, Illinois 60602-4349, USA
Location: USA
Transfer mechanism: EU-U.S. DPF and EU SCC
Purpose
Postmark is used as an email service provider for sending transactional emails related to Woba’s platform.
This includes:
Invitations
Sign-up emails
Login-related emails
Other system-generated notifications
Compliance and security
ActiveCampaign / Postmark supports GDPR, SOC 2 and HIPAA compliance.
More information:
https://www.dataprivacyframework.gov/list
Scalingo SAS
Effective from: 01.11.2024
Address: 13 rue Jacques Peirotes, 67000 Strasbourg, France
Company registration: SIRET 80866548300018
Transfer mechanism: EU/EØS
Purpose
Scalingo is used for hosting of the platform, not customer data.
Location and hosting
Scalingo is a French company. Scalingo hosts data in France with its partner Outscale, which belongs to Dassault Systèmes.
Woba is moving from Heroku to Scalingo, a 100% European company.
Compliance and security
Scalingo’s compliance and security framework includes:
ISO 27001
HDS Certification
More information: Scalingo Security
Modular sub-processors
The customer may use certain sub-processors as part of the Woba Services.
OpenAI in Woba is activated unless the customer requests to have it deactivated.
OpenAI Ireland Ltd.
Effective from: 01.02.2024
Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Location: Ireland
Transfer mechanism: EU/EØS
Purpose
OpenAI is used as an AI service provider through an approved API integration.
Woba anonymises survey questions and answers before data is submitted to OpenAI.
Where the data submitted to OpenAI is fully anonymised and cannot reasonably be linked to an identifiable person, the data does not constitute personal data under GDPR. In such cases, OpenAI does not act as a sub-processor for that specific processing activity.