Sub-processors
The third parties TiJUBU engages to help deliver the Services. We give customers at least 30 days' advance notice of any change to sub-processors that handle customer platform data, with a right to object on reasonable data-protection grounds.
1. Customer platform data (TiJUBU as processor)
These sub-processors Process the workforce personal data that customers submit to the Services, for which the customer is the controller and TiJUBU is the processor under the DPA.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Cloud infrastructure and hosting; managed PostgreSQL (Amazon RDS / Aurora); LLM inference via Amazon Bedrock | Ireland, EEA | Intra-EEA, none required. AWS EU SCCs apply to any support access from outside the EEA |
| ActiveCampaign, LLC (Postmark) | Delivery of transactional and service email (recipient name, email address and message content) | United States | EU SCCs with transfer impact assessment and supplementary measures |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | EU region (Frankfurt), EEA | Intra-EEA, none required. EU SCCs cover any incidental US access |
| PostHog, Inc. (PostHog EU Cloud) | Product-usage analytics | EEA (Frankfurt, EU Cloud) | Intra-EEA, none required. EU SCCs cover any incidental US access |
AI inference is performed through Amazon Web Services (Amazon Bedrock), within AWS's isolated model-deployment environment; prompts and outputs are not disclosed to the underlying model providers and are not used to train their models, so those providers are not Sub-processors. AWS is the only Sub-processor in the AI-processing chain. One sub-processor above (ActiveCampaign, LLC / Postmark) Processes data in the United States, under the EU Standard Contractual Clauses with a transfer impact assessment and supplementary measures; the others Process entirely within the EEA. Any future AI model vendor or other sub-processor will be added here, with its location and transfer mechanism, before it begins processing, and with advance notice to customers.
2. Website and marketing data (TiJUBU as controller)
Separately from the platform, TiJUBU uses the following tools on its public website and for marketing, where TiJUBU acts as controller. These do not process customer platform data. Non-essential tools run only with your consent via the cookie banner.
| Provider | Purpose | Transfer mechanism |
|---|---|---|
| Google Analytics 4 (Google Ireland Ltd.) | Aggregate website usage analytics, IP-anonymized (consent-based) | EU-US Data Privacy Framework / EU SCCs |
| LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) | Measurement of LinkedIn campaign performance (consent-based) | EU-US Data Privacy Framework / EU SCCs |
3. Changes and notification
TiJUBU will inform affected customers at least 30 days before adding or replacing a sub-processor that handles customer platform data. Customers may object on reasonable data-protection grounds; if the Parties cannot resolve the objection, the customer may terminate the affected Services without penalty as its sole remedy, as set out in Clause 6.2 of the DPA. For questions, contact dataprotection@tijubu.com.