Compliance
Sub-processors
The third-party vendors Praxxii Global engages to operate its services. We notify clients before adding a new sub-processor that materially changes the data flow under their engagement.
Last updated: April 28, 2026. To request the current list in machine-readable form, email us.
| Vendor | Purpose | Data accessed | Region | Contract basis |
|---|---|---|---|---|
| Vercel Inc. DPA → | Hosting, edge functions, image optimization, blob storage | Site visitor IPs (transient), uploaded assets, lead form submissions, content metadata | United States · global edge | Vercel DPA (Standard Contractual Clauses) |
| Google LLC — Google Analytics 4 DPA → | Website analytics, traffic measurement, conversion attribution | Anonymised IPs, page views, session data, attribution parameters | United States | Google Ads Data Processing Terms + EU SCCs |
| Microsoft Corp. — Clarity DPA → | Session recording, heatmaps, behavioural analytics | Page interactions (clicks, scrolls), masked form input, anonymised session ID | United States | Microsoft Clarity DPA |
| Google LLC — Workspace (Gmail, Drive, Calendar) DPA → | Email correspondence, internal collaboration, transactional email delivery (SMTP) | Inbound and outbound communications with prospects and clients | United States · India | Google Workspace DPA + EU SCCs |
| GitHub Inc. (Microsoft) | Source-code hosting, CI/CD | Repository content; no personal data of customers | United States | GitHub DPA |
| Cloudflare Inc. DPA → | DNS, CDN, DDoS protection (where applicable on partner domains) | Visitor IPs (transient), routing metadata | Global anycast | Cloudflare DPA + EU SCCs |
| Stripe Inc. DPA → | Payment processing for client engagement invoices (where applicable) | Cardholder data — Stripe is the controller; Praxxii Global never sees raw PAN | United States | Stripe DPA + EU SCCs |
| Razorpay Software Pvt. Ltd. | Payment processing for INR-denominated invoices | Cardholder data handled directly by Razorpay; Praxxii Global never sees raw PAN | India | Razorpay merchant agreement |
Advertising-platform partners (per-engagement)
Engaged on behalf of clients only when the client's Engagement Contract authorises paid-media services on the corresponding platform.
| Vendor | Purpose | Data accessed | Region | Contract basis |
|---|---|---|---|---|
| Google Ads + Google Tag Manager DPA → | Paid-media platforms client-side tagged for advertising audience and conversion measurement | Hashed conversion identifiers, attribution signals (only when client engagement uses Google Ads) | United States | Google Customer Data Processing terms (controller-to-controller) |
| Meta Platforms (Facebook / Instagram) DPA → | Paid-social platforms; Meta Pixel and Conversions API where engaged | Hashed event identifiers per Meta's standard data-handling terms | United States | Meta Business Tools Terms |
| Microsoft Advertising (Bing UET) DPA → | Paid-search platform; UET tag for conversion measurement | Hashed event identifiers per Microsoft Advertising terms | United States | Microsoft Advertising Privacy Policy |
| LinkedIn Marketing Solutions (Insight Tag) | B2B paid-media; Insight Tag for conversion measurement when engaged | Hashed conversion identifiers per LinkedIn's standard data-handling terms | United States | LinkedIn Subscription Agreement DPA |
Notification of material changes
We provide existing clients written notice at least 30 days before adding a new sub-processor that materially changes how their personal data is processed. Clients may object within 14 days; if the change cannot be accommodated, either party may terminate the affected engagement without penalty.
Contact
Questions or DPA requests: info@praxxiiglobal.com