ANNEX III of Leapsome's Data Processing Agreement – LIST OF SUB-PROCESSORs
The Controller has authorised the use of the following sub-Processors:
Platform Services
| Nature and purpose of processing | Categories of personal data | Location of processing | Guarantees for third-country transfers | Address | Contact Details | |
|---|---|---|---|---|---|---|
| Amazon Web Services EMEA Sàrl | Primary infrastructure and data storage provider | Customer personal data, created by customer and stored in Leapsome applications and services | EEA (Germany) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency | 38 avenue John F. Kennedy, L-1855, Luxemburg | aws-EU-privacy@amazon.com |
| MongoDB, Inc. | Primary data storage provider (DBaaS within AWS) | Customer personal data, created by customer and stored in Leapsome applications and services | EEA (Germany) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency, Transfer risk assessment | 1633 Broadway, 38th Floor, New York, NY 10019, USA | privacy@mongodb.com |
| Twilio, Inc. | Notification of users through selected channels (e.x. E-Mail, SMS), Multi-factor Authentication | Customer personal data created by customer, in particular, personal data contained in Leapsome applications and services notifications | EEA and US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment | 375 Beale Street, Suite 300, San Francisco, CA 94105, USA | privacy@twilio.com |
| Appcues, Inc. | Product onboarding, guidance and feedback | Customer personal data created by customer, in particular and based on interaction, provided feedback as well as basic PII like unique user ID and email | US | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment | 54 Canal St 6th Floor, Boston, MA 02114, USA | support@appcues.com |
Optional and only on specific instruction by Controller to provide additional functions within the software
| Nature and purpose of processing | Categories of personal data | Location of processing | Guarantees for third-country transfers | Address | Contact Details | |
|---|---|---|---|---|---|---|
| Merge API, Inc. | API integrations connector | Customer personal data created by customer, in particular, data defined via customer configured integrations | EEA (Sweden) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency | 353 Sacramento St., Floor 21, San Francisco, CA 94111 | legal@merge.dev |
| Kombo Technologies GmbH | API integrations connector | Customer personal data created by customer, in particular, data defined via customer configured integrations | EEA (Netherlands) | Standard Contractual Clauses, EU Data Residency | Rosenthaler Str. 72 A 10119 Berlin | privacy@kombo.dev |
| Dropbox Inc. | Digital signature provider | Customer personal data created by customer, in particular, documents requiring a digital signature | US | EU-U.S. Data Privacy Framework | 1800 Owens Street, Suite 200, San Francisco, CA 94158, United States | privacy@dropbox.com |
| Nylas, Inc. | Email integration connector for the Recruiting module; connection of customer user mailboxes via OAuth, retrieval and sending of candidate-related email, delivery of change notifications and, where enabled by the Controller, open and click tracking | Customer personal data created by customer, in particular the connected mailbox address and granted scopes, and the content, attachments, participants, headers and timestamps of candidate-related email messages; where tracking is enabled, open and click events including IP address and user agent | EEA (Ireland) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency, Transfer risk assessment | 2100 Geng Rd, 210, Palo Alto, California 94303, USA | privacy@nylas.com |
| Cronofy B.V. | Calendar and scheduling connector for the ATS module; synchronisation of connected user calendars, availability lookup, and creation, amendment and cancellation of interview events and invites | Customer personal data created by customer, in particular calendar account details of connected users (name, email address, time zone, calendar names, access credentials) and event data (title, description, start and end time, location, conferencing details) including attendee names, email addresses and attendance status | EEA (Germany) | EU Data Residency; UK adequacy decision (Commission Implementing Decision of 19 December 2025) for support access by Cronofy Ltd. | Mr. Treublaan 7, 1097 DP Amsterdam, Netherlands | privacy@cronofy.com |
| VONQ B.V. | Distribution of customer job postings to third-party job boards; receipt and relay of applications submitted via job boards and hosted apply flows (e.g. Direct Apply) into the Leapsome ATS | Vacancy and recruiter contact data (name, business email, phone); applicant data as submitted by candidates (name, contact details, address, CV and application documents); technical data (IP addresses of ATS users) | EEA (Netherlands) | EU Data Residency | Beursplein 37, 3011 AA Rotterdam, Netherlands (KvK 24402216) | dpo@vonq.com |
AI Services
| Nature and purpose of processing | Categories of personal data | Location of processing | Guarantees for third-country transfers | Address | Contact Details | |
|---|---|---|---|---|---|---|
| OpenAI LP | Generative AI services provider for smart features | Customer personal data, created by customer and stored in applicable Leapsome applications and services | US | Standard Contractual Clauses; Transfer risk assessment | 3180 18th St, San Francisco, California 94110, USA | support@openai.com |
| Amazon Web Services EMEA Sàrl (AWS Bedrock, AWS SageMaker AI) | Generative AI services & infrastructure provider for smart features | Customer personal data, created by customer and stored in applicable Leapsome applications and services | Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment | 38 avenue John F. Kennedy, L-1855, Luxemburg | aws-EU-privacy@amazon.com |
| Google Cloud EMEA Ltd. (Google Vertex AI) | Generative AI services & infrastructure provider for smart features | Customer personal data, created by customer and stored in applicable Leapsome applications and services | Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses | 70 Sir John Rogerson's Quay, Dublin 2, Ireland | support-deutschland@google.com |
| Cloudflare, Ltd. (Workers AI) | Generative AI services & infrastructure provider for smart features, remote model context protocol (MCP) server, content delivery network, security and abuse prevention | Customer personal data, created by customer and stored in applicable Leapsome applications and services | Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses | 101 Townsend St, San Francisco, CA 94107, USA | privacyquestions@cloudflare.com |
| turbopuffer Inc. | Vector database for storing embeddings and metadata used in data search and retrieval | Customer personal data, created by customer and stored in applicable Leapsome applications and services | EEA (Germany) | Standard Contractual Clauses, EU Data Residency | 135 Laurier Ave, Ottawa, ON K1P 5J2, Canada | info@turbopuffer.com |
| LangChain Inc. (LangSmith) | Application monitoring / observability and prompt evaluation | Customer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and services | EEA (Netherlands) | Standard Contractual Clauses; EU Data Residency | 2660 3rd St, Apt 629, San Francisco, CA 94107, United States | privacy@langchain.dev |
| DataDog Inc. (AI Observability) | Application, security and infrastructure monitoring / observability and logging | Customer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and services | EEA (Germany) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses | Datadog, Inc., 620 8th Ave, Fl 45, New York, NY 10018, USA | privacy@datadoghq.com |