health-check domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /www/syndigocom_325/public/wp-includes/functions.php on line 6170acf domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /www/syndigocom_325/public/wp-includes/functions.php on line 6170Syndigo conversion framework helps brands and retailers unlock growth on every shelf
Read Announcement
Effective from April 13, 2026
Core services supporting all products
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Rapid7 LLC | USA (120 Causeway Street, Suite 400, Boston, MA 02114) | privacy@rapid7.com | The subject matter of the Processing pertains to the provision of cybersecurity monitoring, analysis, and consulting services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is determined by the services agreement with the Sub-Processor. The nature of the Processing involves: monitoring, analysis, and consultation in the process of reviewing cybersecurity alerts or incidents. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Critical Insight, Inc. (Formerly DBA Cl Security) | USA (245 4th St Ste 405 Bremerton, WA 98337) | privacy@criticalinsight.com | The subject matter of the Processing pertains to the provision of cybersecurity consulting services and analysis pursuant to the services agreement with the Sub-Processor. The duration of the Processing is limited to the duration of investigations by the Sub-Processor on cybersecurity incidents. The nature of the Processing involves: consultation in the process of reviewing cybersecurity alerts or incidents. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Databricks, Inc. | USA (160 Spear Street, 13th Floor San Francisco, CA 94105) | privacy@databricks.com | The subject matter of the Processing pertains to the provision of data management platform and analytics services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Flexential Corp. | USA (600 Forest Point Circle, Suite 100, Charlotte, NC 28273) | privacy@flexential.com | The subject matter of the Processing pertains to the provision of co-location data services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval or otherwise making available, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Iron Mountain Inc. | USA (1 Federal Street, Boston, MA 02110, U.S.A) | global.privacy@ironmountain.com | The subject matter of the Processing pertains to the provision of record management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: destruction of shredded paperwork. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Microsoft Corporation. | USA (One Microsoft Way, Redmond, WA 98052) | https://www.microsoft.com/en-us/concern/privacy | The subject matter of the Processing pertains to the provision of Azure Infrastructure services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Navisite, LLC. | USA (400 Minuteman Road, Andover, MA 01810) | privacy@navisite.com | The subject matter of the Processing pertains to the provision of emergency Database Administration (DBA) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: organization, disclosure, erasure. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Okta, Inc. | USA (100 First Street, San Francisco, California 94105) | privacy@okta.com | The subject matter of the Processing pertains to the provision of identity and access management cloud services pursuant to the services agreement with the sub-Processor. The duration of the Processing is generally determined by the services agreement with the sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Pendo.io, Inc. | USA (150 Fayetteville Street, Suite 1400, Raleigh, North Carolina 27601) | gdpr@pendo.io | The subject matter of the Processing pertains to the provision of product analytics to optimize user experience pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Salesforce.com, Inc. | USA (Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105) | privacy@salesforce.com | The subject matter of the Processing pertains to the provision of notifications to CXH users in case of outages pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Twilio, Inc. | USA (375 Beale Street Suite 300 San Francisco, CA 94105) | privacy@twilio.com | The subject matter of the Processing pertains to the provision of an automated emailing system for Syndigo’s customer notification pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Syndigo LLC (for customers entering into the Syndigo Europe DPA) | USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604) | privacy@syndigo.com | The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Syndigo LLC (for customers entering into the Syndigo Europe DPA) | USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604) | privacy@syndigo.com | The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Riversand Technologies Europe AG | Switzerland (Gubelstrasse 11 6300 Zug) | |||
| Riversand Technologies India Private Limited | India (IBC Knowledge Park, Tower D, 8th Floor, Bannerghatta Main Road, Bangalore, Karnataka 560029) | |||
| Microsoft Ireland Operations, Ltd. | Ireland (South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521) | https://www.microsoft.com/en-us/concern/privacy | The subject matter of the Processing pertains to the provision of Azure Cloud services (European MS Azure Cloud) pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage. | N/A |
| Auth0, LLC - wholly owned by Okta | USA (10800 NE 8th Street, Suite 700, Bellevue, WA 98004) | privacy@auth0.com | The subject matter of the Processing pertains to the provision of identity and access management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. | USA (410 Terry Avenue North, Seattle, WA, 98109) 0 Chicago, IL 60604) | https://aws.amazon.com/privacy/ | The subject matter of the Processing pertains to the provision of databases, storage and compute services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage and computational services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Red Hat, Inc. | USA (100 East Davie Street, Raleigh, NC 27601) | privacy@redhat.com | The subject matter of the Processing pertains to the provision of Application Programming Interface Infrastructure (3scale) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, , organization, storage, retrieval for the purposes of delivering the API Infrastructure. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| CloudFlare, Inc. | USA (101 Townsend St. San Francisco CA 94107) | dpo@cloudflare.com | The subject matter of the Processing pertains to the provision of application security and Domain Name System (DNS) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: security analysis of network and application traffic, DNS services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Corporate Name | Country where it is established or from which it may access the Personal data | Subcontracted Services |
|---|---|---|
| Sumologic | United States of America | Application and platform log retention |
| Upwork | United States of America, Colombia, Philippines, Mauritius, Brazil, France, Morocco, Suriname, Dominican Republic | Content Moderation services |
| Amazon Web Services (AWS) | United States of America | Hosting of PowerReviews Platform |
| iOvation | United States of America | Anti-fraud services (based on device information) |
| Wyng | United States of America | Collation of rich media |
| Cloudinary | United States of America and Israel | Image hosting and content delivery |
| Datadog | United States of America | Application and platform log retention |
| United States of America | Display reviews for Google Seller Ratings and/or Google Shopping | |
| Snowflake | United States of America | Hosting provider |
| Sendgrid | United States of America | Consumer facing emails |
| OneTrust | United States of America | DSAR Request facilitation |
| Amazon Cloudfront | United States of America CDN with servers located globally | Content delivery network |
Sub- Processor Name | Address/ Processing Locations | Contact Details | Description of Processing | Data Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services (AWS) | United States of America, Ireland and United Kingdom. | https://aws.amazon.com/privacy/ | The subject matter of the Processing pertains to the provision of cloud infrastructure and hosting services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage and computational services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Auth0, LLC - wholly owned by Okta | USA (10800 NE 8th Street, Suite 700, Bellevue, WA 98004) | privacy@auth0.com | The subject matter of the Processing pertains to the provision of identity and access management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: identity and access management and related services. | The Standard Contractual Clauses under Article 46 of the GDPR. |
| Anthropic PBC | USA (548 Market St, PMB 90375, San Francisco, CA 94104) Or European Union | privacy@anthropic.com | The subject matter of the Processing pertains to the provision of artificial intelligence and large language model services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: analysis and processing of data to generate AI-assisted outputs. | The Standard Contractual Clauses under Article 46 of the GDPR. |
Please fill out the form below to receive updates on this list.
