Subprocessors
| Subprocessor Name | Service Provided | Data Processed | Hosting / Jurisdiction | Notes |
|---|---|---|---|---|
| Microsoft Corporation (Azure) | Cloud hosting and infrastructure | Application and database storage, logs | EU (e.g., Netherlands/Ireland) | Primary infrastructure provider for the Racapp platform |
| Amazon Web Services (AWS) | Cloud infrastructure and storage services | Stored files, backups, and images that may contain customer identification documents | EU (Frankfurt region) | Used for hosting, storage, and redundancy |
| Cloudflare, Inc. | Network edge security, CDN, storage proxy, and DDoS protection | IP addresses, request metadata, and data transmitted through the platform as technically required | Global (covered under SCCs for GDPR) | Protects platform availability and performance |
| WorkOS, Inc. | Authentication, authorization, identity management, session handling, and SSO/AuthKit services | Organization registration information, user identifiers, email addresses, and authentication/session metadata | US / Global (covered under SCCs for GDPR) | Used for secure login, identity federation, and access control |
| SendGrid (by Twilio, Inc.) | Email delivery and notifications | Email addresses, communication metadata | EU / US (SCCs in place) | Transactional emails between vendors and customers |
| Twilio, Inc. | One-time-password (OTP) and communication delivery services | User and customer email addresses, telephone numbers, message metadata, and verification status | EU / US (SCCs in place) | Used for account and reservation verification flows |
| Mailgun Technologies, Inc. | Email delivery services | Email addresses, message content, and communication metadata | EU / US (SCCs in place) | Transactional and operational email delivery |
| PDFGate | Document rendering, PDF generation, and digital signing services | Rendered documents, agreements, reports, customer names, rental details, and vehicle data | EU (specific region depends on provider) | Used to generate vendor-specific documents securely |
| Sentry | Application monitoring and error tracking | Activity logs, crash logs, technical metadata, and limited user or customer contact data where included in diagnostic events | EU / US (SCCs in place) | Used to detect, diagnose, and resolve platform errors |
| Worldline / Saferpay | Online payment initiation, hosted payment page redirection, authorization/status handling, and payment security services | Transaction identifiers, payment status, payment method metadata, billing details, reservation references, fraud/security metadata, and cardholder data submitted directly to the payment provider. SSC does not collect, store, process, or have access to full credit card numbers, card security codes (CVV/CVC), bank account credentials, or payment account login details | EU / Switzerland / Global (covered under applicable safeguards) | Used for customer-facing reservation payments; Worldline/Saferpay terms, privacy notices, and processing terms may also apply |
Subprocessor Update Procedure
In accordance with Article 28 of the General Data Protection Regulation (GDPR), Split Second Connect Limited (“SSC”) maintains a current list of all subprocessors engaged in connection with the Racapp Platform. SSC ensures that each subprocessor provides sufficient guarantees to implement appropriate technical and organizational measures to protect personal data.
SSC will update this list when new subprocessors are engaged or existing subprocessors are replaced. In such cases:
- SSC will notify affected Vendors via the Racapp Platform dashboard or by email prior to any material change.
- Vendors will be given a reasonable opportunity to object to such change if they believe it would materially affect data protection.
- If an objection cannot be resolved, the Vendor may terminate its use of the affected service in accordance with the Terms of Service.
SSC shall ensure that all subprocessors are bound by written agreements imposing data protection obligations no less protective than those imposed on SSC under the Data Processing Agreement.