Accept Mission sub-processors

Accept Mission Sub-processors

Accept Mission uses certain sub-processors to assist in providing Accept Mission’s services. A sub-processors is a third party data processor engaged by Accept Mission who agrees to receive personal data from Accept Mission intended for processing activities to be carried out (i) on behalf of Accept Mission Customers; (ii) in accordance with Customer instructions as communicated by Accept Mission; and (iii) in accordance with the terms of a written contract between Accept Mission and the sub-processors.

Accept Mission imposes data protection terms on each sub-processor regarding their security controls and applicable laws for the protection of personal data. Further information relating to sub-processor security measures can be found via the external links below.

Where the engagement of a sub-processor requires the cross-border transfer of personal data, Accept Mission has performed Transfer Impact Assessments for such data transfer.

Accept Mission maintains an up-to-date list of the names and locations of all sub-processors below.

Duration of processing: For each sub-processor below, processing of personal data will be for the duration that the Customer uses and continues to use Accept Mission and for the retention periods as set out in customer’s agreement with Accept Mission.

Data Processing Agreements

We have in place written Data Processing Agreements (“DPA”) with all of our sub-processors. The DPA is a contract between a data controller and a data processor, and covers the items required under Art. 28 of the GDPR. This includes the roles and responsibilities of the parties when personal data is processed.

According to the General Data Protection Regulation (GDPR), contractual clauses ensuring appropriate data protection safeguards can be used as a ground for data transfers from the EU to third countries. This includes model contract clauses – so-called standard contractual clauses (“SCC”) – that have been “pre-approved” by the European Commission. All of our sub-processors outside of EU have SCC in place.

Third-Party Sub-processors

Accept Mission works with other third parties to provide specific functions or features within the Service. These providers will have access to relevant personal information (in both an identifiable and anonymous manner) in order to provide their relevant functions. The use of information is limited to the specific purposes.

Relevant for End-users

The following sub-processors are used to provide the Accept Mission Service and are part of the chain of processing of sensitive, personal and other data of end-users.

Microsoft Azure

Function: Server infrastructure

Personal data: End-user IP, End-user URL, End-user Referrer, End-user Browser, End-user Device, End-user Events, End-user Settings

Sensitive data: Customer Content

Other Data: Customer Subdomain, Customer Company Email, Customer Name, Customer Email, Customer Settings, Events

Vendor measures: Secure InfrastructureEncryption at RestEncryption in TransitCompliance and Certifications, Privacy

Certifications: List of all certifications

Additional measures: Accept Mission exclusively hosts its Service on Azure Cloud Infrastructure. Standard all our servers are hosted in West Europe, where it is encrypted at rest. Backups are also performed on Azure Cloud Infrastructure West EU.

Retention: Accept Mission does not automatically expire data on Accept Mission servers. Customer has the option to delete Content and End-users individual and in bulk as well as delete all data on their Workspace (per GDPR compliance).

Entity: Microsoft

Data location: West EU

Legal basis: DPA (SCC)

SendGrid

Function: Email Infrastructure. Application mails are send via SendGrid.

Personal data: End-user Email Addresses, End-user Names

Sensitive data: None

Other Data: Email Content

Vendor measures: Security MeasuresGDPR

Certifications: SOC2 Type II

Additional measures: Accept Mission enforces full TLS 1.1. end-to-end encryption in transit for all emails.

Retention: SendGrid email providers retain email message activity (such as opens and clicks) for up to 90 days. Aggregated sending stats and suppression lists (bounces, unsubscribes) and spam reports are stored indefinitely.

Entity: Twilio Inc.

Data location: United States

Legal basis: DPA (SCC)‍

Sentry

Function: Real time error tracking, monitoring and logging for service improvement.

Personal data: End-user IP addresses

Sensitive data: None

Other Data: Browser Information, Device Information, URL,

Vendor measures: PII ScrubbingSecurity Measures

Certifications: SOC2 Type II, HIPAA

Additional measures:  Data in Sentry is fully encrypted and scrubbed for personal data.

Retention: Sentry error tracking retains activity logs (such as errors and requests) for up to 90 days. Aggregated performance stats (errors, load times) are stored indefinitely.

Entity: Sentry Inc.

Data location: United States

Legal basis: DPA (SCC)

Google Analytics

FunctionAnonymous visitor analytics for product improvement.

Sensitive data: None

Personal data: None

Other Data: Customer Subdomain, Customer Company Name, Browser Information, Device Information, Anonymized IP, Events, URL, Referrer

Vendor measures: Secure InfrastructureEncryption at RestEncryption in TransitCompliance and CertificationsPrivacy

Certifications: ISO27001/17/18, SOC1/2/3, PCI DSS, HIPAA

Additional measures: While event, device and behavioral information is sent to Google Analytics, this data is not personally identifiable. IP addresses are anonymized by removing the last digits. Google data sharing is disabled and the Controller-Controller Data Protection terms are not applicable; Google does not use the data in other products or for building user profiles. For detailed information on how Accept Mission uses analytics data see the ToS or Privacy Policy.

Retention: Data from inactive contacts is deleted after 14 months.

Entity: Google Inc.

Data location: United States

Legal basis: DPA (SCC)

Relevant for Customers

The following sub-processors are only used in connection with data related directly to the Customer that signed up for an Accept Mission Workspace and not with end-users invited to the platform.

Hupspot

Function: CRM

Sensitive data: Names, Email Addresses

Personal data: Names, Email Addresses, Phone numbers, Job title

Other Data: Customer Company Name, Customer Subdomain, Customer Subscription, Customer Company Name

Vendor measuresSecurity

Certifications: SOC 2, SOC 3, ISO 127001,

Retention: Accept Mission keeps records of CRM for up to 10 years for compliance reasons, this does not include personal data.

Entity: Hubspot Inc.

Data location: United States

Legal basis: DPA (SCC)

Stripe

Function: Payment and credit card processing

Sensitive data: Customer Credit Card Details

Personal data: Customer Contact Email, Customer Contact Name, Customer Contact IP, Customer Address

Other Data: Customer Company Name, Customer Subdomain, Customer Subscription, Customer Company Name

Vendor measuresSecurity Hub 

Certifications: PCI Service Provider Level 1, PCI DSS

Additional measures: Accept Mission uses Stripe for services related to payment processing for our subscription and billing. The use of information is limited to that specific purpose. Stripe is PCI compliant and Accept Mission does not handle or store credit card information.

Retention: Accept Mission keeps records of billing data for up to 10 years for compliance reasons, this does not include personal data. Credit card data can be deleted by the Customer in the Accept Mission interface.

Entity: Stripe Inc.

Data location: United States

Legal basis: DPA (SCC)

Intercom

Function: User onboarding and support

Sensitive data: None

Personal Data: Username, Email

Other data: Customer Subdomain, Customer Company Name, Browser Information, Events

Vendor measures: Security

Certifications: SOC2 Type II, ISO 127001, CSA

Additional measures: Intercom is only loaded for the Workspace Owner and no personal data is sent to Intercom.

Retention: Data from inactive contacts is deleted after 6 months.

Entity: Intercom

Data location: United States

Legal basis: DPA (SCC)‍‍

Changes in Sub-processors

Our business needs may change from time to time. For example, we may deprecate a sub-processor to consolidate and minimize our use of sub-processors. Similarly, we may add a sub-processor if we believe that doing so will enhance our ability to deliver our Services. Before engaging a sub-processors, we perform due diligence, including a security and legal analysis. We do not engage a sub-processor unless our quality, security and the standard of the GDPR are met.

Changes in sub-processors are regulated by the DPA we have in place with you.