Subprocessors

#01What this list is

This page is Academyship's canonical, public register of Subprocessors — the third parties that ACADEMYSHIP PTY LTD (ACN 698 283 448, ABN 89 698 283 448) engages to process Customer Data on its behalf when providing the Services. It is informational, but it is directly connected to the contractual rights in our Data Processing Addendum (DPA).

A Subprocessor is a provider Academyship appoints that processes Customer Data under Academyship's instructions. This is different from:

• Customer-selected Integrations — providers an Institution chooses to connect to its own tenant (see Section 5). Academyship does not control these data flows;
• Independent controllers / service providers — a party that determines its own purposes for certain data rather than acting on Academyship's instructions, such as Stripe for some payment functions (see Section 4);
• Telecommunications carriers — networks that carry SMS or other messages to their destination;
• Browser, operating-system and device providers — which supply the speech recognition used by Razi voice typing (see Section 4); and
• Calendar providers — which receive event or booking details only when a User chooses a calendar link (see Section 4).

Under section 18 of the DPA, Academyship gives Customers written notice at least 30 days before a new or replacement Subprocessor begins processing Customer Data, except in a limited emergency, and Customers may object. Customers receive these notices without needing to request them. See Sections 7 and 8 for notice and objection.

This register is versioned. The change log in Section 9 and the version history in Section 11 record what changed and when, so the list of Subprocessors that applied on any date can be identified.

#02How to read the register

The register in Section 3 lists each active Subprocessor with the following information:

• Provider legal entity — the contracting company, not just a brand name;
• Service name — the trading or service name used;
• Website — the provider's public site;
• Role / classification — Subprocessor, and the nature of the processing;
• Service and purpose — what Academyship uses the provider for;
• Data categories — the types of Customer Data involved;
• Data subjects — the people the data is about;
• Processing / storage location — where the data is processed or stored;
• Transfer safeguards — where relevant to any cross-border processing;
• Public assurance information — where publicly available;
• Effective date, status and last reviewed; and
• Change history — recorded in the change log in Section 9.

We list specific legal entities rather than generic descriptions.

Status. "Active" means the provider is approved and processes Customer Data in production. A provider that Academyship is evaluating, or whose support exists in Academyship's software but which Academyship has not approved, is not listed as Active and must not receive Customer Data.

Support access. Academyship's own support and engineering access to Customer Data, including any remote access from outside Australia, is governed by section 14 of the DPA. Access by a Subprocessor's personnel is governed by Academyship's agreement with that Subprocessor.

#03Active production subprocessors

The following are Academyship-appointed Subprocessors that currently process Customer Data in production. This table is Academyship's canonical current register.

Academyship hosts its core production platform and Customer Data in Sydney, Australia (ap-southeast-2). Limited processing outside Australia may occur through disclosed telecommunications delivery, Stripe-hosted payment services, Customer-selected Integrations or authorised access, subject to applicable privacy, contractual and security safeguards.

For Academyship's Australian AWS account, the AWS Customer Agreement identifies Amazon Web Services Australia Pty Ltd (ABN 63 605 345 891) as the AWS contracting party. The public AI feature inventory, role controls and human-review requirements are in the Responsible AI Statement. SMS messages are handed to telecommunications carriers for delivery and may be routed through carrier networks in the recipient's country.

Amazon Bedrock is Academyship's approved AI provider for Customer Data, and Academyship configures it in the AWS Asia Pacific (Sydney) Region. Academyship's software also contains support for other model providers, including a fallback path that can operate where configured. No other AI provider is approved to process Customer Data unless it is listed in this register and any notice required by the DPA has been given (see Section 4).

Academyship uses AWS End User Messaging SMS for SMS delivery. AWS may process recipient mobile numbers, message content and delivery metadata, while telecommunications carriers participate in delivery and may route messages through recipient-country networks. Institutions control message content, recipients, timing and any authorised sender identity, and are responsible for consent, other lawful authority, notices, opt-outs and communications-law compliance. Academyship does not guarantee carrier delivery or exact sender-ID display. An Institution’s sender identity does not change the parties’ privacy or data-processing roles, and is not an Academyship Subprocessor.

#04Other third-party service providers that are not subprocessors

Some third parties are not Academyship-appointed Subprocessors because they provide services under their own contractual and regulatory arrangements. Customer-selected Integrations are not listed here — they are addressed in Section 5.

Stripe payment services

Stripe’s published data-processing terms describe different roles for different functions, so Academyship classifies each Stripe function separately rather than applying one label to all of them. None of the functions below is an Academyship Subprocessor function.

Academyship uses Stripe for subscription payments. For Academyship’s subscription checkout, payment-card details are entered on Stripe’s hosted checkout rather than on Academyship’s website.

If Academyship engages Stripe to process Customer Data on Academyship’s behalf for any other function, Academyship will assess whether Stripe is a Subprocessor for that function and, if it is, list it in Section 3 and give any notice required by the DPA before that processing begins.

AI providers that are not approved

Amazon Bedrock, listed in Section 3, is Academyship’s approved AI provider for Customer Data. Academyship’s software also contains support for other model providers, including a fallback path that can operate where configured. Those providers are not approved to process Customer Data, are not listed as Active, and must not receive Customer Data unless they are added to Section 3 and any notice required by the DPA has been given. Where model software runs on infrastructure operated by a third party, the register lists the legal entity that operates that infrastructure, not the name of the software.

Speech recognition for Razi voice typing

Razi voice typing uses the speech-recognition service supplied by the User’s browser, operating system or device. Recognition cannot be assumed to take place on the device: depending on the browser or device, speech may be sent to that provider’s servers, which may be outside Australia. The provider processes speech under its own terms and configuration. It is not appointed by Academyship and is not an Academyship Subprocessor. Academyship does not receive or store raw audio through Razi; it receives only the text a User inserts into an Academyship field. An Institution can control whether Razi is available to its Users where the relevant configuration exists.

Calendar links chosen by Users

Booking and event features can offer links that add an appointment or event to Google Calendar, Outlook or Office 365, or Yahoo Calendar, and a downloadable calendar file (ICS). When a User chooses one, the selected details, such as the title, time, location or meeting link and description, go to the provider the User chose, under that User’s own arrangement with the provider. These links are not an OAuth connection or an Academyship integration, and the calendar provider is not an Academyship Subprocessor. Copies in an external calendar are outside Academyship’s control and are not removed when the record is deleted in Academyship.

Payroll reporting providers

Payroll features can prepare information used for Single Touch Payroll reporting. No provider that lodges Single Touch Payroll reports with the Australian Taxation Office is listed in this register, because lodgement through the platform is not yet available. Academyship has engaged Single Touch Pty Ltd, which stores report data in Australia, to provide that lodgement when it becomes available. Before Single Touch Pty Ltd or any other provider receives Customer Data for that purpose, Academyship will list it in Section 3 and give the notice required by the DPA.

#05Customer-selected integrations

Institutions can choose to connect their own third-party providers ("Integrations") to their tenant. Those providers are selected and controlled by the Institution, not appointed by Academyship, and the resulting data flows are the Institution's responsibility under its own arrangements with those providers. They are not Academyship Subprocessors and are not listed in Section 3. For how these are handled, see the DPA and Privacy Policy.

#06Provider assessment and contracting

Before appointing a Subprocessor that will process Customer Data, Academyship carries out due diligence proportionate to the risk, and puts in place data-processing terms consistent with the DPA. Our assessment considers matters such as security and privacy practices, data minimisation, processing location and region, confidentiality, incident-notification obligations, and exit or transition arrangements. We do not publish the internal checklist or scoring we use for this assessment.

Before listing a provider that Academyship is evaluating, or whose support exists in Academyship's software, as Active, Academyship will complete an internal activation record covering the contract, the provider's role, the data it would receive, its processing and support locations, its onward recipients, retention and production readiness. The provider is listed here only once that record is complete and any notice required by the DPA has been given.

#07New and replacement providers

When Academyship appoints a new or replacement Subprocessor that will process Customer Data, it gives Customers written notice at least 30 days before the Subprocessor begins processing Customer Data, as set out in section 18 of the DPA. The notice identifies the provider's legal entity, the service, the purpose, the categories of data and data subjects, the processing locations and the proposed effective date. A Customer may object in writing on reasonable data-protection grounds within 30 days after the notice, and the DPA sets out how objections are resolved.

Where an urgent replacement is necessary (for example, to maintain security or continuity of the Services, or for legal reasons), Academyship may appoint a replacement limited to the affected service and provide notice as soon as reasonably practicable. The objection period then runs from that notice. New entries are added to the register with their effective date, and each change is recorded in the change log in Section 9.

#08How to receive change notices

Customers. Customers do not need to subscribe. Academyship sends the notices due under the DPA by email to each Customer's account contacts, or to a privacy or security contact the Customer nominates. To nominate a contact, email legal@academyship.com.au.

Others. Anyone else, such as a prospective customer or an additional contact at a Customer, can ask to be told of register updates by contacting legal@academyship.com.au. Academyship manages these notifications manually on request. To provide notifications, Academyship retains the requester's contact details and notification preferences and uses them only for that purpose, consistent with the Privacy Policy. These updates are in addition to, and do not replace, the notices due to Customers under the DPA.

This register is also updated when a change takes effect, so it can be checked at any time.

#09Change log

#10Questions and related documents

For questions about this register or subprocessor changes, contact legal@academyship.com.au.

Data Processing Addendum Privacy Policy Terms of Service Responsible AI Cookie Policy

#11Document governance

This register is the operational source of truth for Academyship's active Subprocessors. Academyship will update it whenever a provider or material data flow changes, check it for currency each quarter, and review it formally with legal each year in June. The DPA Annex III snapshot and the Privacy Policy summary are updated through Academyship's controlled document-update process. Annex III of DPA version 3.0 lists the same Active Subprocessors as this version of the register.

Academyship keeps each version of this register. Earlier versions are available on request from legal@academyship.com.au.