Subprocessors

WBSync Ltd ("WBSync") engages the third-party service providers listed below to help us deliver the WBSync platform. We act as data controller for our own corporate operations (sales, billing, support) and as data processor on behalf of our customers for the operational data they put into the product (labour entries, WBS, clock events, diaries, claims). The subprocessors below process personal data on our behalf to the extent strictly necessary for the listed purpose.

This page is the canonical, current list. It is referenced from our Data Processing Agreement (DPA) under Article 28(2) GDPR.

1. Current subprocessors

#	Subprocessor	Role	Personal data processed	Processing location	Legal basis for transfer	Safeguard
1	Railway Corp. (Railway PaaS)	Cloud hosting — application servers, managed PostgreSQL, managed Redis	All Customer Data submitted to the platform (account, labour entries, WBS, clock events, diary, claims, audit logs, file uploads) and platform telemetry	Frankfurt, Germany (EU) — europe-west4 region	None required — data resides in the EU/EEA	Railway SOC 2 Type II; AES-256 at rest, TLS 1.2+ in transit; Railway DPA executed
2	Stripe Payments Europe, Ltd. (Stripe Billing & Stripe Tax)	Subscription billing, invoicing, payment-card processing, EU VAT calculation, Stripe Customer Portal	Billing contact name, billing email, billing address (incl. VAT number), payment-method token (Stripe never returns full PAN to us), invoice history, charge metadata	Ireland (EU primary) with replication to United States	Stripe relies on EU-US Data Privacy Framework + EU Standard Contractual Clauses (SCCs) (2021/914 Module 2)	PCI-DSS Level 1; Stripe DPA executed; SCCs incorporated by reference
3	Resend (Resend, Inc.)	Transactional email delivery (account verification, password reset, invitations, breach notifications, digest emails, billing receipts). Delivered via Resend HTTPS API (django-anymail backend) because Railway blocks outbound SMTP.	Recipient email address, recipient display name, email subject + body content, delivery metadata (open / bounce / complaint events)	United States (Resend primary). EU sending region available on Pro plan — to be enabled before first paid customer go-live.	EU-US Data Privacy Framework (Resend is DPF-certified) + EU SCCs 2021/914 Module 2 as fallback	SOC 2 Type II; Resend DPA executed; TLS in transit; no plain-text storage of message body beyond retention window

We do not sell, rent or share Customer Data with any other third party. We do not use Customer Data for advertising, model training, or any purpose outside the agreed processing.

---

2. Pending / planned additions

The following providers are not yet live but will be added in advance of go-live. We will give customers 30 days' advance notice before any of these begin processing Customer Data.

#	Provider	Intended role	Expected go-live	Status
P1	Functional Software, Inc. (Sentry error monitoring)	Application error capture (stack traces, request metadata). PII scrubbed via SEND_DEFAULT_PII=False and _sentry_before_send; IP addresses dropped at the SDK.	Phase 2 (~2026-06)	Code wired; SaaS DSN not yet provisioned for production
P2	Microsoft Teams (chat-ops via incoming webhooks)	Approval notifications when a customer opts in by pasting a Teams webhook URL into Settings → Integrations. Webhook URL + entry summary. Customer-controlled.	Live in code, opt-in only	Customer is data controller of their own Teams tenant; WBSync is processor only of the webhook URL

When any of these go live, this page is updated and a notification is emailed to all subscribed billing contacts on the same day; the 30-day notice clock starts then.

---

3. Change-notification policy

1. Material change (a new subprocessor, a change of role, or a change of processing location outside the EEA): 30 calendar days' notice before the change takes effect.
2. Notice channels (used in parallel): - Email to the billing contact of every active customer. - In-app banner in the workspace settings page for 30 days. - Update of this list with a new version number, effective date, and a one-line entry in the changelog at section 5.
3. Objection right: Customers may object in writing to dpo@wb-sync.com within 30 days. If the objection cannot be reasonably resolved, the customer may terminate the affected service under §4 of the DPA and receive a pro-rata refund of pre-paid fees.
4. Emergency replacement: If a subprocessor must be replaced urgently for security or continuity reasons, we may give shorter notice but will notify customers as soon as possible and document the rationale in the next change entry.

---

4. How to subscribe to subprocessor updates

Subscribe by emailing dpo@wb-sync.com with subject subprocessor-updates. Subscribers receive an email within 24 hours of any change to this list. Billing contacts on active subscriptions are subscribed automatically.

A machine-readable feed is also published at https://wb-sync.com/legal/subprocessors.json (planned Phase 4) so that customers' GRC tooling can poll for changes.

---

5. Changelog

Version	Date	Change
1.3	2026-06-08	Published to the website at /legal/subprocessors/. Cross-links updated to on-site routes; header format normalised; DPA clause cross-reference updated (DPA §4). No subprocessor added, removed, or changed.
1.2	2026-06-05	Finalised registered entity details in the §6 contact block on incorporation (WBSync Ltd, CRO no. 817394, Irishtown, Ardee, Co. Louth, Ireland). No subprocessor added, removed, or changed.
1.1	2026-05-11	Added Resend (transactional email, US, DPF + SCCs) — already live in production via django-anymail because Railway blocks SMTP. Removed Postmark/SendGrid and Cal.com from planned list (not in use).
1.0	2026-05-11	Initial publication. Listed: Railway (hosting, DE), Stripe (billing, IE/US under DPF + SCCs).

---

6. Contact

Data Protection Officer / Privacy contact WBSync Ltd (registered in the Republic of Ireland, CRO no. 817394) Email: dpo@wb-sync.com Postal: Irishtown, Ardee, Co. Louth, Ireland

An EU Article 27 representative is not required while WBSync's establishment is in the EU (Ireland). Re-assess if the registered office ever moves outside the EU/EEA.

---

This page is intended to be read alongside the Privacy Policy and the Data Processing Agreement. In the event of conflict, the executed DPA prevails.