Compliance
Sub-processors
The third-party vendors Praxxii Global engages to operate its services. We notify clients before adding a new sub-processor that materially changes the data flow under their engagement.
Last updated: April 28, 2026. To request the current list in machine-readable form, email us.
| Vendor | Purpose | Data accessed | Region | Contract basis |
|---|---|---|---|---|
| Vercel Inc. DPA → | Hosting, edge functions, image optimization, blob storage | Site visitor IPs (transient), uploaded assets, lead form submissions, content metadata | United States · global edge | Vercel DPA (Standard Contractual Clauses) |
| Google LLC — Google Analytics 4 DPA → | Website analytics, traffic measurement, conversion attribution | Anonymised IPs, page views, session data, attribution parameters | United States | Google Ads Data Processing Terms + EU SCCs |
| Microsoft Corp. — Clarity DPA → | Session recording, heatmaps, behavioural analytics | Page interactions (clicks, scrolls), masked form input, anonymised session ID | United States | Microsoft Clarity DPA |
| Google LLC — Workspace (Gmail, Drive, Calendar) DPA → | Email correspondence, internal collaboration, transactional email delivery (SMTP) | Inbound and outbound communications with prospects and clients | United States · India | Google Workspace DPA + EU SCCs |
| GitHub Inc. (Microsoft) | Source-code hosting, CI/CD | Repository content; no personal data of customers | United States | GitHub DPA |
| Cloudflare Inc. DPA → | DNS, CDN, DDoS protection (where applicable on partner domains) | Visitor IPs (transient), routing metadata | Global anycast | Cloudflare DPA + EU SCCs |
| Stripe Inc. DPA → | Payment processing for client engagement invoices (where applicable) | Cardholder data — Stripe is the controller; Praxxii Global never sees raw PAN | United States | Stripe DPA + EU SCCs |
| Razorpay Software Pvt. Ltd. | Payment processing for INR-denominated invoices | Cardholder data handled directly by Razorpay; Praxxii Global never sees raw PAN | India | Razorpay merchant agreement |
Advertising partners — independent or joint controllers (per-engagement)
The advertising and measurement platforms below are not Praxxii Global sub-processors in the strict GDPR / UK GDPR sense. When we run paid media for a client, these platforms determine their own purposes and means of processing the resulting event and audience data and are therefore independent or joint data controllers alongside our client. Their processing is governed by their own terms and, for site-side tags (Meta Pixel, LinkedIn Insight Tag, Bing UET), depends on the visitor's explicit cookie consent given via our consent banner — not on our DPA. Engaged only when a client's Engagement Contract authorises paid media on the corresponding platform.
| Vendor | Purpose | Data accessed | Region | Contract basis |
|---|---|---|---|---|
| Google Ads + Google Tag Manager DPA → | Paid-media platforms client-side tagged for advertising audience and conversion measurement | Hashed conversion identifiers, attribution signals (only when client engagement uses Google Ads) | United States | Google Customer Data Processing terms (controller-to-controller) |
| Meta Platforms (Facebook / Instagram) DPA → | Paid-social platforms; Meta Pixel and Conversions API where engaged | Hashed event identifiers per Meta's standard data-handling terms | United States | Meta Business Tools Terms |
| Microsoft Advertising (Bing UET) DPA → | Paid-search platform; UET tag for conversion measurement | Hashed event identifiers per Microsoft Advertising terms | United States | Microsoft Advertising Privacy Policy |
| LinkedIn Marketing Solutions (Insight Tag) | B2B paid-media; Insight Tag for conversion measurement when engaged | Hashed conversion identifiers per LinkedIn's standard data-handling terms | United States | LinkedIn Subscription Agreement DPA |
Notification of material changes
We provide existing clients written notice at least 30 days before adding a new sub-processor that materially changes how their personal data is processed. Clients may object within 14 days; if the change cannot be accommodated, either party may terminate the affected engagement without penalty.
Contact
Questions or DPA requests: info@praxxiiglobal.com