Snapshot 23391
Normalized text
Scripts and page chrome removed; this is what change detection compares.
ANNEX III of Leapsome's Data Processing Agreement – LIST OF SUB-PROCESSORs The Controller has authorised the use of the following sub-Processors: Platform Services Nature and purpose of processing Categories of personal data Location of processing Guarantees for third-country transfers Address Contact Details Amazon Web Services EMEA Sàrl Primary infrastructure and data storage provider Customer personal data, created by customer and stored in Leapsome applications and services EEA (Germany) EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency 38 avenue John F. Kennedy, L-1855, Luxemburg [email protected] MongoDB, Inc. Primary data storage provider (DBaaS within AWS) Customer personal data, created by customer and stored in Leapsome applications and services EEA (Germany) EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency, Transfer risk assessment 1633 Broadway, 38th Floor, New York, NY 10019, USA [email protected] Twilio, Inc. Notification of users through selected channels (e.x. E-Mail, SMS), Multi-factor Authentication Customer personal data created by customer, in particular, personal data contained in Leapsome applications and services notifications EEA and US EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment 375 Beale Street, Suite 300, San Francisco, CA 94105, USA [email protected] Appcues, Inc. Product onboarding, guidance and feedback Customer personal data created by customer, in particular and based on interaction, provided feedback as well as basic PII like unique user ID and email US EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment 54 Canal St 6th Floor, Boston, MA 02114, USA [email protected] Optional and only on specific instruction by Controller to provide additional functions within the software Nature and purpose of processing Categories of personal data Location of processing Guarantees for third-country transfers Address Contact Details Merge API, Inc. API integrations connector Customer personal data created by customer, in particular, data defined via customer configured integrations EEA (Sweden) EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency 353 Sacramento St., Floor 21, San Francisco, CA 94111 [email protected] Kombo Technologies GmbH API integrations connector Customer personal data created by customer, in particular, data defined via customer configured integrations EEA (Netherlands) Standard Contractual Clauses, EU Data Residency Rosenthaler Str. 72 A 10119 Berlin [email protected] Dropbox Inc. Digital signature provider Customer personal data created by customer, in particular, documents requiring a digital signature US EU-U.S. Data Privacy Framework 1800 Owens Street, Suite 200, San Francisco, CA 94158, United States [email protected] Nylas, Inc. Email integration connector for the Recruiting module; connection of customer user mailboxes via OAuth, retrieval and sending of candidate-related email, delivery of change notifications and, where enabled by the Controller, open and click tracking Customer personal data created by customer, in particular the connected mailbox address and granted scopes, and the content, attachments, participants, headers and timestamps of candidate-related email messages; where tracking is enabled, open and click events including IP address and user agent EEA (Ireland) EU-U.S. Data Privacy Framework; Standard Contractual Clauses, EU Data Residency, Transfer risk assessment 2100 Geng Rd, 210, Palo Alto, California 94303, USA [email protected] Cronofy B.V. Calendar and scheduling connector for the ATS module; synchronisation of connected user calendars, availability lookup, and creation, amendment and cancellation of interview events and invites Customer personal data created by customer, in particular calendar account details of connected users (name, email address, time zone, calendar names, access credentials) and event data (title, description, start and end time, location, conferencing details) including attendee names, email addresses and attendance status EEA (Germany) EU Data Residency; UK adequacy decision (Commission Implementing Decision of 19 December 2025) for support access by Cronofy Ltd. Mr. Treublaan 7, 1097 DP Amsterdam, Netherlands [email protected] VONQ B.V. Distribution of customer job postings to third-party job boards; receipt and relay of applications submitted via job boards and hosted apply flows (e.g. Direct Apply) into the Leapsome ATS Vacancy and recruiter contact data (name, business email, phone); applicant data as submitted by candidates (name, contact details, address, CV and application documents); technical data (IP addresses of ATS users) EEA (Netherlands) EU Data Residency Beursplein 37, 3011 AA Rotterdam, Netherlands (KvK 24402216) [email protected] AI Services Nature and purpose of processing Categories of personal data Location of processing Guarantees for third-country transfers Address Contact Details OpenAI LP Generative AI services provider for smart features Customer personal data, created by customer and stored in applicable Leapsome applications and services US Standard Contractual Clauses; Transfer risk assessment 3180 18th St, San Francisco, California 94110, USA [email protected] Amazon Web Services EMEA Sàrl (AWS Bedrock, AWS SageMaker AI) Generative AI services & infrastructure provider for smart features Customer personal data, created by customer and stored in applicable Leapsome applications and services Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) EU-U.S. Data Privacy Framework; Standard Contractual Clauses, Transfer risk assessment 38 avenue John F. Kennedy, L-1855, Luxemburg [email protected] Google Cloud EMEA Ltd. (Google Vertex AI) Generative AI services & infrastructure provider for smart features Customer personal data, created by customer and stored in applicable Leapsome applications and services Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) EU-U.S. Data Privacy Framework; Standard Contractual Clauses 70 Sir John Rogerson's Quay, Dublin 2, Ireland [email protected] Cloudflare, Ltd. (Workers AI) Generative AI services & infrastructure provider for smart features, remote model context protocol (MCP) server, content delivery network, security and abuse prevention Customer personal data, created by customer and stored in applicable Leapsome applications and services Global (Processing is performed at the vendor data center that is closest to or best performing for the end user) EU-U.S. Data Privacy Framework; Standard Contractual Clauses 101 Townsend St, San Francisco, CA 94107, USA [email protected] turbopuffer Inc. Vector database for storing embeddings and metadata used in data search and retrieval Customer personal data, created by customer and stored in applicable Leapsome applications and services EEA (Germany) Standard Contractual Clauses, EU Data Residency 135 Laurier Ave, Ottawa, ON K1P 5J2, Canada [email protected] LangChain Inc. (LangSmith) Application monitoring / observability and prompt evaluation Customer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and services EEA (Netherlands) Standard Contractual Clauses; EU Data Residency 2660 3rd St, Apt 629, San Francisco, CA 94107, United States [email protected] DataDog Inc. (AI Observability) Application, security and infrastructure monitoring / observability and logging Customer personal data created by customer, in particular, personal data contained in interactions with smart features in applicable Leapsome applications and services EEA (Germany) EU-U.S. Data Privacy Framework; Standard Contractual Clauses Datadog, Inc., 620 8th Ave, Fl 45, New York, NY 10018, USA [email protected]