Subprocessor List

Version 26.9 — last updated 30 September 2026

This page lists the third parties Maps United Ltd uses to process Customer Personal Data on behalf of its customers in providing Kompass BMS, as required by clause 10.11 of our Terms and Conditions. It covers providers that process data inside the platform and providers that receive Customer Personal Data when a customer sends it to us during support or onboarding. Each is bound by written data protection obligations materially equivalent to those we owe our customers.

Providers we use only for our own business (CRM, scheduling, accounting, marketing, our website) do not receive Customer Personal Data from Kompass BMS and are listed in our Privacy Policy instead.

Hosting and infrastructure

Subprocessor	Entity	Purpose	Data processed	Location	Transfer safeguard
Google Cloud Platform	Google Cloud EMEA Ltd (Ireland)	Production hosting, database, storage	All Customer Data	Each customer’s primary database and file storage is held in one region, chosen at onboarding: UK, EU (Belgium/Netherlands), USA or Canada. Not replicated to other regions.	UK/EU: adequacy. USA/Canada regions apply only to customers who chose them. Google Cloud Data Processing Addendum with EU SCCs and UK Addendum; Google LLC is certified under the EU–US DPF and UK Extension.
Backblaze	Backblaze, Inc. (USA)	Encrypted off-site backups	Full database and file backups, encrypted by Maps United before transfer. Backblaze does not hold the keys. Retained up to 30 days.	EU (Netherlands)	Backblaze UK GDPR Data Processing Addendum (EU SCCs and UK Addendum), covering any access from Backblaze’s US operations.

Platform services

Subprocessor	Entity	Purpose	Data processed	Location	Transfer safeguard
Mailgun	Sinch Email (Mailgun Technologies, Inc., USA)	Transactional email sent by Kompass BMS (notifications, password resets, client portal invitations)	Recipient email addresses, message content	EU region for UK/EU customers; US region for US/Canada customers	Mailgun DPA with EU SCCs and UK Addendum; Mailgun Technologies, Inc. is certified under the EU–US DPF and UK Extension
ConvertAPI	ConvertAPI UAB (Lithuania)	Document and file conversion (e.g. proposal and invoice PDFs)	Documents submitted for conversion; converted files retained for up to 3 hours, then deleted	Each Kompass region calls the matching ConvertAPI regional endpoint: UK for UK customers, EU (Netherlands/Germany) for EU customers, USA for US and Canada customers. No cross-region routing.	ConvertAPI UAB is established in the EEA (UK adequacy applies to our transfer to it). Its Data Processing Terms (incorporated in its Terms of Service) keep processing within the endpoint’s region and UK data within the UK. US-endpoint processing is carried out by ConvertAPI’s sub-processor IBM Cloud on Maps United’s written instruction, under ConvertAPI’s own transfer arrangements with IBM, for which ConvertAPI is contractually responsible
Rollbar	Rollbar, Inc. (USA)	Application error monitoring	Error logs, which may include user identifiers and request metadata; retained 90 days	USA	Rollbar DPA (EU SCCs and UK Addendum)

Support and onboarding

Subprocessor	Entity	Purpose	Data processed	Location	Transfer safeguard
Help Scout	Help Scout PBC (USA)	Support ticketing	Content of support requests, including any Customer Data the customer includes in ticket text, screenshots or attachments. Tickets deleted 24 months after closure, and all of a customer’s tickets within 30 days of contract end	USA	Help Scout Data Processing Amendment (EU SCCs and UK Addendum)
Microsoft 365	Microsoft Ireland Operations Ltd	Email, documents, Teams messages and calls during support and onboarding	Customer Data shared with us by email, Teams message, file or screen-share. Files deleted within 30 days of the task closing; recordings within 30 days of the recording date; email and Teams content retained for 24 months after the support or onboarding matter closes, and all of a customer’s content deleted within 30 days of contract end	UK (tenant region)	Microsoft Products and Services DPA (EU SCCs and UK Addendum for any support access from outside the UK/EEA)
Anthropic — effective 14 October 2026	Anthropic, PBC (USA)	AI-assisted cleansing and structuring of migration data during customer onboarding, at the customer’s request, in our Claude Team workspace	Migration files supplied by the customer for import into Kompass BMS. Deleted from our workspace within 30 days of the onboarding task closing and in any case within 30 days of contract end; Anthropic then completes deletion within its standard 30-day period, subject to the exceptions in its published retention policy	USA	Anthropic Commercial Terms and Data Processing Addendum: no model training on customer data; EU SCCs with UK Addendum

Services used inside Kompass BMS that are not subprocessors

• Google Maps Platform (Google Ireland Ltd) displays maps and looks up addresses inside Kompass BMS. It loads in the user’s browser, which sends the map request, any address the user looks up and the user’s IP address directly to Google; Maps United’s servers do not handle these requests. Google acts as an independent controller for these requests under the Google Maps Platform terms and its privacy policy.
• Cloudflare provides DNS for kompassbms.com. Application traffic does not pass through Cloudflare and it receives no Customer Data.
• Uptime monitoring probes public endpoints and receives no Customer Data.

Changes to this list

We give customers at least 14 days’ notice by email before adding or replacing a subprocessor, as set out in clause 10.11 of our Terms and Conditions. If you have reasonable grounds to object to a new subprocessor, reply to the notice email before the effective date and we will follow the process in clause 10.11. To make sure notices reach the right person, tell us your data protection contact at privacy@kompassbms.com.

Change log

Version	Date	Change
26.9	30 September 2026	First published version. Adds processing locations, contracting entities, transfer safeguards and, where applicable, retention periods. Adds Anthropic (onboarding data cleansing), effective 14 October 2026 following customer notice. Removes Google Analytics (no longer used). Cloudflare moved to “not a subprocessor” (DNS only). Business-operations tools (HubSpot, Calendly, Canny, Stripe, GoCardless, Xero, Twilio) moved to the Privacy Policy; Zoom removed (no longer used).
—	November 2025	Internal list compiled.