Snapshot 39948
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Subprocessors Declaration Table of Contents Infrastructure & Hosting Product Features Internal Tools and Support Updates This document presents the up-to-date list of sub-processors authorized to process personal data on behalf of Boond as part of its SaaS services. It forms an integral part of our Data Processing Agreement (DPA) and is enforceable under the conditions provided in the DPA. Boond conducts regular compliance reviews of all its sub-processors. When the use of a sub-processor involves a data transfer outside the European Union, Boond implements appropriate transfer mechanisms and, where necessary, conducts transfer impact assessments in accordance with applicable regulations. Each sub-processor is contractually required to implement appropriate technical and organizational measures to ensure that the processing of personal data complies with GDPR requirements as well as the level of protection provided by our Data Processing Agreement (DPA) and our Security Policy. Boond remains fully liable to the client if the sub-processor fails to fulfill its obligations. Infrastructure & Hosting Sub-processor Role / Purpose Place of Processing Comments OVH Server hosting and Cloud storage Europe (France & Germany) Primary infrastructure provider. Data hosted exclusively in the EU. Scaleway Off-site backups France Daily backups in secure environments. Cloudflare Network security: DNS, anti-DDoS, web application firewall Europe Improving service availability and protection. Product Features Sub-processor Role / Purpose Place of Processing Comments HRFlow Automatic CV analysis and transcription Europe Used for extraction and analysis of data from CVs, within the framework of GDPR-compliant features. SignaturIt Electronic signature and document certification (contracts, expense reports, HR documents). Europe (Spain) European electronic signature provider. DPA and security documentation available. Processing complies with GDPR. Mindee OCR and automated data extraction from documents (document analysis). Expense report processing Europe (France) French provider specialized in data extraction via OCR. Privacy policy available. Processing carried out in the EU. B2BRouter Issuance, reception, and processing of electronic invoices (regulatory B2B invoicing). Europe (Spain) European provider compliant with electronic invoicing obligations. ISO 27001 certified. Userflow User journey analysis / interactive onboarding United States (with safeguards) Governed by standard contractual clauses (SCC) and additional compliance measures. Mentioned in the DPA as a compliant third-party sub-processor. Internal Tools and Support Sub-processor Role / Purpose Place of Processing Comments Google Workspace Internal messaging, office tools, internal EDM Europe Used for internal exchanges. Client data is only shared in case of support or express need. Intercom Customer support tool Europe EU hosting enabled – Ireland Planhat Customer relationship management (Customer Success, account tracking, and product usage). Europe European provider. DPA and privacy policy available. Data hosted in the EU HubSpot Commercial relationship management and marketing tool Europe, with occasional governed transfers outside the EU Governed by standard contractual clauses (SCC). Webflow Commercial website Europe, with governed US transfers Processing is governed by a specific DPA signed with Boond. Transfers outside the EU are covered by standard contractual clauses (SCC) and equivalent mechanisms in accordance with the GDPR. PandaDoc Creation, management, and electronic signature of commercial and contractual documents. United States, with transfer safeguards. Provider subject to the Data Privacy Framework. DPA available. Transfers outside the EU governed by legal mechanisms compliant with the GDPR. Signitic Centralized management of professional email signatures France (hosting and data processing) A DPA compliant with Article 28 of the GDPR is available. No transit outside the EU without contractual justification and strict legal framework. Mailjet (Sinch) Sending and management of transactional and operational emails Europe, with governed processing and transfers outside the EU Processing and transfers outside the EU may occur incidentally and are strictly governed by standard contractual clauses (SCC) and additional security measures. A DPA (version 10/29/2025) is in place. Welcome to the Jungle Job posting and candidate management. Europe Recruitment platform. DPA and Privacy Policy available. Processing of candidate data within a GDPR-compliant framework. Updates As part of Boond's continuous development and reinforcement, our list of sub-processors may change. Any changes will be incorporated into this document. Clients will be informed of updates by email, sent to the DPO contact address provided upon signing the contract. If no dedicated address is provided, the notification will be sent to the contract signatory. It is the client's responsibility to communicate any updates to this contact point. For any further information, you may contact: [email protected]