Legal
Subprocessor register
Last updated: [date]
Draft for review. This policy has not yet been reviewed by legal counsel and is not in force. Passages in [square brackets] still need to be completed.
This template is a public register of the subprocessors used to deliver Friends of School. Replace every bracketed field with the current vendor, purpose, location, and contract details before relying on it as a notice under a school’s data processing agreement.
How to read this register
A subprocessor is a third party that processes personal data on our behalf while we provide the service to a school. Each provider should be bound by written confidentiality, security, and data-protection obligations. Schools should receive notice before a material change and have the objection rights set out in their data processing agreement.
Hosting and application infrastructure
[Hosting provider] — application hosting and compute — [processing location] — [security and transfer details].
[Database and storage provider] — database, backups, and file storage — [processing location] — [security and transfer details].
Communications and support
[Transactional email provider] — enquiry replies, receipts, and service email — [processing location].
[Push notification provider] — mobile notification delivery — [processing location].
[Customer support provider] — support tickets and service assistance — [processing location].
Payments
[Blink Payments, Razorpay, and Botim Pay contracting entities] — regional card and open-banking payment processing — the provider’s published processing locations and terms apply. Friends of School does not receive full card numbers, PINs, one-time passcodes, or online-banking passwords.
Changes and contact
Questions or objections about a listed subprocessor: legal@aqualeo.co. The school’s data processing agreement controls if it gives a more specific notice or objection process.
This policy is published in English, Arabic, and Hindi. If the versions differ, the English version applies.