1. Current subprocessors and key processors
This list describes organisations that process personal data to help us run SydGiG. It may change; material additions will be reflected here. Last updated 1 September 2026.
| Organisation | Role | Typical location / processing |
|---|---|---|
| Supabase, Inc. and affiliates | Authentication, PostgreSQL database, object storage, realtime messaging | Configured cloud region (often US) with global access by authorised SydGiG staff |
| Cloudflare, Inc. and affiliates | DNS, CDN, DDoS, Cloudflare Workers hosting, R2 object storage, Workers AI inference | Global anycast edge; customer-configured storage locations |
| Payaza Africa (when payments are enabled) | Checkout, collections, payouts, and transfers as configured | Africa and supported payout corridors |
| Email and transactional-message providers (when enabled) | Account and security email | Provider region as contracted |
We also use professional advisers (legal, accounting) as independent controllers or processors depending on the engagement. Staff and contractors of Spatial Regal access data under confidentiality and least-privilege rules.
2. Transfer mechanisms
- EEA/UK/Switzerland exports: EU Standard Contractual Clauses, UK International Data Transfer Addendum or IDTA, Swiss addendum, plus supplementary security measures. Adequacy decisions (for example, UK, Switzerland, or others as adopted) are used where they exist.
- Brazil LGPD: contractual clauses and compliance with ANPD transfer regulations as they enter force.
- China PIPL: separate consent, export-security assessment or standard contract, or certification, as required for the specific export — or we limit the feature.
- Others: contractual, security, and transparency measures described in the Privacy Policy.
3. Data-processing agreement
If you are a Seller or Buyer acting as a controller and need an Art. 28 GDPR (or LGPD/POPIA equivalent) DPA covering workspace client data, email dpo@sydgig.com. Our product implements your instructions to store, display, and delete that data, subject to the AUP and law.
4. Updates
Enterprise customers who need prior notice of subprocessor changes may request it at dpo@sydgig.com. Others should review this page periodically.