Messangi Corporation engages the third parties listed below (each a “Subprocessor”) to process personal data contained in Customer Data on behalf of its customers, on the documented instructions of the customer as communicated by Messangi, and under a written contract between Messangi and the Subprocessor. Capitalized terms have the meaning given in the Messangi Data Processing Addendum and the Terms of Service.
This list covers only Subprocessors that process customer personal data on Messangi’s behalf. It does not list vendors that support Messangi’s internal operations without processing customer personal data, such as compliance, engineering, finance, customer relationship management, and human resources tooling. It also does not list the telecommunications carriers, mobile network operators, and SMS aggregators that route and deliver messaging traffic, whose status is described under “Status of telecommunications providers” below.
Messangi binds each Subprocessor by written contract to data protection obligations no less protective than those in the Data Processing Addendum, including the obligation to implement appropriate technical and organizational measures, and Messangi remains responsible for each Subprocessor’s performance. Where a Subprocessor engagement involves a cross border transfer of personal data subject to the GDPR, the UK GDPR, or Swiss law, Messangi relies on appropriate safeguards, principally the Standard Contractual Clauses, as set out in the Data Processing Addendum.
Duration of processing. For each Subprocessor below, processing continues for as long as the customer uses the applicable Services and for the retention periods set out in the customer’s agreement with Messangi.
Cloud infrastructure
| Subprocessor | Applicable Services | Nature and purpose of processing | Categories of personal data | Processing location | Security and privacy information |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | All Services | Hosting and infrastructure: compute, storage, database, key management, logging, and monitoring | All categories of customer personal data, as the underlying hosting environment | United States, and any customer designated region where a dedicated environment is provisioned | AWS GDPR Center |
- Applicable Services
- All Services
- Nature and purpose of processing
- Hosting and infrastructure: compute, storage, database, key management, logging, and monitoring
- Categories of personal data
- All categories of customer personal data, as the underlying hosting environment
- Processing location
- United States, and any customer designated region where a dedicated environment is provisioned
- Security and privacy information
- AWS GDPR Center
Message delivery and channel providers
| Subprocessor | Applicable Services | Nature and purpose of processing | Categories of personal data | Processing location | Security and privacy information |
|---|---|---|---|---|---|
| Meta Platforms, Inc. (WhatsApp Business Platform) | WhatsApp messaging | Transmission and receipt of WhatsApp messages | Recipient phone numbers and message content | United States and Meta global infrastructure | WhatsApp data privacy and security |
| Google LLC (RCS Business Messaging) | RCS messaging | Delivery and receipt of RCS messages | Recipient identifiers and message content | United States | Google safety and privacy |
| Amazon Web Services, Inc. (Amazon SES) | Email messaging | Routing and delivery of email | Recipient email addresses and message content | United States | AWS GDPR Center |
- Applicable Services
- WhatsApp messaging
- Nature and purpose of processing
- Transmission and receipt of WhatsApp messages
- Categories of personal data
- Recipient phone numbers and message content
- Processing location
- United States and Meta global infrastructure
- Security and privacy information
- WhatsApp data privacy and security
- Applicable Services
- RCS messaging
- Nature and purpose of processing
- Delivery and receipt of RCS messages
- Categories of personal data
- Recipient identifiers and message content
- Processing location
- United States
- Security and privacy information
- Google safety and privacy
- Applicable Services
- Email messaging
- Nature and purpose of processing
- Routing and delivery of email
- Categories of personal data
- Recipient email addresses and message content
- Processing location
- United States
- Security and privacy information
- AWS GDPR Center
Customer support tooling
| Subprocessor | Applicable Services | Nature and purpose of processing | Categories of personal data | Processing location | Security and privacy information |
|---|---|---|---|---|---|
| Zendesk, Inc. | Customer support (all Services) | Support ticketing and correspondence | Account and contact identifiers, and the content of support communications | United States | Zendesk Trust Center |
- Applicable Services
- Customer support (all Services)
- Nature and purpose of processing
- Support ticketing and correspondence
- Categories of personal data
- Account and contact identifiers, and the content of support communications
- Processing location
- United States
- Security and privacy information
- Zendesk Trust Center
Status of telecommunications providers
The telecommunications carriers, mobile network operators, and SMS aggregators that Messangi uses to route and deliver messaging traffic process recipient identifiers and message content for their own network, regulatory, and policy purposes. Messangi does not treat these providers as its Subprocessors, and they are not listed above. Their processing is governed by their own terms and privacy practices. This position is consistent with Section 6 of the Data Processing Addendum.
Messangi group
Messangi Corporation operates and hosts the platform and holds the agreements with the Subprocessors listed above. Where a customer contracts with a Messangi affiliate outside the United States, Messangi Corporation acts as a Subprocessor to that affiliate for the operation of the Services.
Changes to this list
Messangi may update this list to add or replace a Subprocessor. As provided in the Data Processing Addendum, Messangi will give notice of an intended addition or replacement by updating this list, with sufficient time for the customer to object on reasonable data protection grounds within fifteen days. If the parties cannot resolve the objection, the customer may, as its sole remedy, terminate the affected Services.
Contact
Questions about this list may be directed to privacy@messangi.com.