Subprocessors
Version 1.0 · effective · Previous versions
These are the providers we rely on to run Unvamp. Each is bound by a data processing agreement with obligations no weaker than the ones we owe you, and we remain responsible for their performance.
1. Current subprocessors
| Provider | What they do | Data processed | Processing region |
|---|---|---|---|
| Hetzner Online GmbH | Primary hosting, compute, managed database and object storage | All platform data at rest and in transit | Germany / Finland (EU) |
| Stripe | Card payments, payouts, BNPL, tax calculation, billing portal | Payment credentials, transaction and payout records, tax residence | EU / US (SCCs) |
| Paystack | Card and bank payments, transfers and virtual accounts in African markets | Payment credentials, transaction and payout records, bank details | Nigeria / South Africa / Ghana / Kenya |
| Sumsub | Identity verification, liveness, sanctions and PEP screening | Identity documents, selfie, date of birth, screening results | EU (SCCs where applicable) |
| QoreID | Nigerian government registry identity lookups (NIN, BVN, CAC) | Identity numbers and returned verification results | Nigeria |
| Twilio | SMS delivery and phone verification outside African markets | Phone number, message content | US / EU (SCCs) |
| Africa's Talking | SMS delivery within African markets | Phone number, message content | Kenya / Nigeria |
| Google (Firebase Cloud Messaging, Wallet) | Android push notifications and Google Wallet passes | Device push token, ticket pass contents | US / EU (SCCs) |
| Apple (APNs, Wallet) | iOS push notifications and Apple Wallet passes | Device push token, ticket pass contents | US / EU (SCCs) |
| Sentry | Error and performance monitoring | Diagnostic events, IP address, account identifier | US / EU (SCCs) |
2. Notice of changes
Where you are a controller using Unvamp as your processor — organisers, in respect of their attendees’ data — we give at least 30 days’ notice before adding or replacing a subprocessor, so you have a genuine opportunity to object as Article 28(2) requires. To receive that notice, subscribe at privacy@unvamp.com.
If you object on reasonable data-protection grounds we will work with you to find an alternative. Where none exists, you may terminate the affected service without penalty for the unused remainder of any prepaid term.
3. International transfers
Where a provider processes data outside the UK or EEA, the transfer relies on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with a transfer risk assessment and supplementary technical measures — encryption in transit and at rest, and access limited to what the provider needs to perform its function.
4. Related documents
Privacy Policy · Organiser Agreement (which contains our data processing terms) · Cookie Policy