iHasco uses a number of sub-processors to carry out certain activities relating to the data it holds — all are subject to agreements with iHasco. These sub-processors process data on our behalf but do not have access to it. Below is a list of all sub-processors, how iHasco uses their services, and whether they are GDPR compliant.
Core application
Amazon Web Services
Cloud infrastructure provider — where the application code and database reside. We also use Amazon S3 to store daily, weekly, and monthly backups of the database.
Location of Processing (Country): UK (to the extent you use the Course Creator feature, data may be processed in the EU).
Cross-border Documentation in place: N/A
Compliance: https://aws.amazon.com/compliance/gdpr-center
Microsoft Corporation
Azure B2C identity and access management – We also use Microsoft user login credentials for our Atlas LMS. This is managed by our parent company Citation Holdings and data sharing between iHasco and Citation Holdings takes place to facilitate provision of LMS services.
Location of Processing (Country): UK
Cross-border Documentation in place: N/A.
Postmark (owned and operated by AC PM LLC)
Email processing service used to deliver transactional emails from the application to the Data Controller and end users on behalf of the Data Controller.
Location of Processing (Country): USA
Cross-border Documentation in place: Data Privacy Framework (DPF) & UK-US Data Bridge.
Compliance: Subject to Standard Contractual Clauses (see https://postmarkapp.com/eu-privacy#gdpr)
Pusher
Provides real-time event broadcasting. This allows us to indicate when background jobs have completed in the LMS.
Location of Processing (Country): UK & USA
Cross-border Documentation in place: Adequacy & certified to Data Privacy Framework (DPF) & extensions for UK-US Data Bridge.
Compliance: Subject to Standard Contractual Clauses (see https://pusher.com/legal/data-protection)
Supporting services
Stripe
Payment processor for purchases made through our website and over the phone.
Location of Processing (Country): UK & USA
Cross-border Documentation in place: Adequacy & certified to Data Privacy Framework (DPF) & extensions for UK-US Data Bridge.
Compliance: Subject to Standard Contractual Clauses (see https://support.stripe.com/questions/stripe-and-european-data-transfers)
HelpScout
Provides in-app training feedback for learners.
Location of Processing (Country): USA
Cross-border Documentation in place: EU Standard Contractual Clauses and UK Addendum.
Compliance: Subject to Standard Contractual Clauses (see https://www.helpscout.com/company/legal/gdpr)
Salesforce Inc.
Customer relationship management and messaging CRM infrastructure.
Location of Processing (Country): UK & USA
Cross-border Documentation in place: Adequacy & certified to Data Privacy Framework (DPF) & extensions for UK-US Data Bridge
Compliance: Categories | Salesforce Compliance