ANNEX III of Leapsome's Data Processing Agreement – LIST OF SUB-PROCESSORs

The Controller has authorised the use of the following sub-Processors:

‍

Platform Services

Nature and purpose of processingCategories of personal dataLocation of processingGuarantees for third-country transfersAddressContact Details
Amazon Web Services EMEA SàrlPrimary infrastructure and data storage providerCustomer personal data, created by customer and stored in Leapsome applications and servicesEEA (Germany)EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency,38 avenue John F. Kennedy, L-1855, Luxemburgaws-EU-privacy@amazon.com
MongoDB, Inc.Primary data storage provider (DBaaS within AWS)Customer personal data, created by customer and stored in Leapsome applications and servicesEEA (Germany)EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency, Transfer risk assessment1633 Broadway, 38th Floor, New York, NY 10019, USAprivacy@mongodb.com
Twilio, Inc.Notification of users through selected channels (e.x. E-Mail, SMS), Multi-factor AuthenticationCustomer personal data created by customer, in particular, personal data contained in Leapsome applications and services notificationsEEA and USEU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment375 Beale Street, Suite 300, San Francisco, CA 94105, USAprivacy@twilio.com
Appcues, Inc.Product onboarding, guidance and feedbackCustomer personal data created by customer, in particular and based on interaction, provided feedback as well as basic PII like unique user ID and emailUS EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment54 Canal St 6th Floor, Boston, MA 02114, USAsupport@appcues.com

‍

Optional and only on specific instruction by Controller to provide additional functions within the software

Nature and purpose of processingCategories of personal dataLocation of processingGuarantees for third-country transfersAddressContact Details
Merge API, Inc.API integrations connectorCustomer personal data created by customer, in particular, data defined via customer configured integrationsEEA (Sweden)EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency353 Sacramento St., Floor 21, San Francisco, CA 94111legal@merge.dev
Kombo Technologies GmbHAPI integrations connectorCustomer personal data created by customer, in particular, data defined via customer configured integrationsEEA (Netherlands)Standard Contractual Clauses, EU Data ResidencyRosenthaler Str. 72 A
10119 Berlin		privacy@kombo.dev
Dropbox Inc.Digital signature providerCustomer personal data created by customer, in particular, documents requiring a digital signatureUSEU-U.S. Data Privacy Framework1800 Owens Street, Suite 200, San Francisco, CA 94158, United Statesprivacy@dropbox.com

‍

AI Services

Nature and purpose of processingCategories of personal dataLocation of processingGuarantees for third-country transfersAddressContact Details
OpenAI LPGenerative AI services provider for smart featuresCustomer personal data, created by customer and stored in applicable Leapsome applications and servicesUSStandard Contractual Clauses; Transfer risk assessment3180 18th St, San Francisco, California 94110, USAsupport@openai.com
Amazon Web Services EMEA Sàrl

(AWS Bedrock, AWS SageMaker AI)		Generative AI services & infrastructure provider for smart featuresCustomer personal data, created by customer and stored in applicable Leapsome applications and servicesGlobal (Processing is performed at the vendor data center ⁠that is closest to or best performing for the end user)EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment38 avenue John F. Kennedy, L-1855, Luxemburgaws-EU-privacy@amazon.com
Google Cloud EMEA Ltd.

(Google Vertex AI)		Generative AI services & infrastructure provider for smart featuresCustomer personal data, created by customer and stored in applicable Leapsome applications and servicesGlobal (Processing is performed at the vendor data center ⁠that is closest to or best performing for the end user)EU-U.S. Data Privacy Framework; Standard Contractual Clauses70 Sir John Rogerson's Quay, Dublin 2, Irelandsupport-deutschland@google.com
Cloudflare, Ltd.

(Workers AI)		Generative AI services & infrastructure provider for smart features, remote model context protocol (MCP) server, content delivery network, security and abuse preventionCustomer personal data, created by customer and stored in applicable Leapsome applications and servicesGlobal (Processing is performed at the vendor data center ⁠that is closest to or best performing for the end user)EU-U.S. Data Privacy Framework; Standard Contractual Clauses101 Townsend St, San Francisco, CA 94107, USAprivacyquestions@cloudflare.com
turbopuffer Inc.Vector database for storing embeddings and metadata used in data search and retrievalCustomer personal data, created by customer and stored in applicable Leapsome applications and servicesEEA (Germany)Standard Contractual Clauses, EU Data Residency135 Laurier Ave, Ottawa, ON K1P 5J2, Canadainfo@turbopuffer.com
LangChain Inc.

(LangSmith)		Application monitoring / observability and prompt evaluationCustomer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and servicesEEA (Netherlands)Standard Contractual Clauses; EU Data Residency2660 3rd St, Apt 629, San Francisco, CA 94107, United Statesprivacy@langchain.dev
DataDog Inc.

(AI Observability)		Application, security and infrastructure monitoring / observability and loggingCustomer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and servicesEEA (Germany)EU-U.S. Data Privacy Framework; Standard Contractual Clauses,Datadog, Inc., 620 8th Ave, Fl 45, New York, NY 10018, USAprivacy@datadoghq.com