1. The list
This is the list of sub-processors under clause 7 of our Data Processing Addendum. Your content is
stored with Amazon Web Services in Auckland, New Zealand. The other providers handle only what their row says, to
do the job in the first column.
Lernoa Business sub-processors | Provider and what it does | Where it runs, what it handles, and the transfer safeguard for UK, EU and Swiss data |
| Amazon Web Services Documents, training and records | - Where it runs
- Auckland, New Zealand
- What it handles
- All workspace content: documents, pictures and videos, training, records and the details of your people, and the backup copies of the database.
- Safeguard
- The data stays in New Zealand, so there is no onward transfer. Transfers of UK, EU and Swiss personal data to us in New Zealand rely on New Zealand's adequacy status.
|
| Amazon Bedrock, running models from Anthropic, Amazon and OpenAI AI course drafting and Ask | - Where it runs
- AWS regions worldwide: a request can be processed in any AWS commercial region, including the United States
- What it handles
- The document or training text each task needs, the question a person types into Ask, and the text of the pages of your public website if you give us its address. For personal focus, no person's name or results are sent. Amazon Bedrock does not use it to train models.
- Safeguard
- AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and, for processing in the United States, the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
| Amazon Polly Audio narration | - Where it runs
- United States (AWS)
- What it handles
- The chapter text to be read aloud, only when an administrator turns narration on. We have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.
- Safeguard
- AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
| Amazon SES Email | - Where it runs
- Sydney, Australia (AWS)
- What it handles
- The names and work email addresses of recipients, and the text of invitations, assignments, reminders and notices.
- Safeguard
- AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum. Those clauses are the safeguard for this transfer.
|
| Zoho Mail Support email | - Where it runs
- Australia: mail is held in the Australian data centre of Zoho Corporation Pty Ltd
- What it handles
- The emails people send to our support address, such as enquiries and support requests, and the notices the app sends to that address. They can carry a person's name and email address.
- Safeguard
- Zoho's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum. Those clauses are the safeguard for this transfer.
|
| Twilio Sign-in codes by text message | - Where it runs
- United States: only for a person who chooses to get two-step sign-in codes by text message
- What it handles
- The mobile number of a person who chooses text-message sign-in codes, and the codes sent to it. Nothing else about the person or the workspace.
- Safeguard
- The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
| Stripe Billing and invoices | - Where it runs
- Global
- What it handles
- The invoice contact, plan, number of people and payment status of the person who buys. Card details go to Stripe directly and never reach us.
- Safeguard
- The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
| Cloudflare Web traffic and bot protection on forms | - Where it runs
- Global edge network
- What it handles
- Technical request data, such as an IP address, when you visit this website or complete a form that carries a bot check.
- Safeguard
- The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
| Google, Microsoft Sign-in with Google or Microsoft | - Where it runs
- Global, only when you choose them
- What it handles
- The name and email address of a person who chooses to sign in with their Google or Microsoft account.
- Safeguard
- The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
|
The same providers appear on our Security page and in the
Privacy Policy. Stripe, Google and Microsoft also run their own services for their own
purposes under their own terms: for example, a person who signs in with Google has a Google account with Google.
We list them because workspace-related information can reach them.
2. How we tell you about a change
At least 30 days before we add a sub-processor or replace one, we update this page and email
the Owner of every workspace. The email says who the provider is, what it will do and where it will run. The date
at the top of this page changes whenever the list does.
3. How to object
If you have reasonable data protection grounds to object to a new or replacement sub-processor, write to
[email protected] within those 30 days and say why. We will
work with you to resolve it. If we cannot, you may end the licence for the affected workspace, and we will refund the
fees you paid in advance for the period after it ends, pro rata, as clause 7.3 of the DPA says.
4. Transfers outside the UK and EU
New Zealand has an adequacy decision from the European Commission (Decision 2013/65/EU) and is recognised by the
United Kingdom and Switzerland, so transfers of UK, EU and Swiss personal data to us in New Zealand rely on that.
Our onward transfers rely on the safeguard in the last column: the EU-US Data Privacy Framework (and its UK Extension
and the Swiss-US framework) where the provider is certified, and the provider's data processing terms, which
incorporate the EU Standard Contractual Clauses and the UK Addendum. If the adequacy position for New Zealand ever
changes, clause 8 of the DPA applies the Standard Contractual Clauses between you and us. The
UK and EU page has the short version.
