DPA Annex 3 — Subprocessors
Annex 3 — Subprocessors
Document ID: HM-LEGAL-003C
Title: DPA Annex 3 — Subprocessors
Version: 1.0-draft
Last updated: 2026-06-14
Publisher: Headshot Marketing Private Limited (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/headshotmarketing/HM-LEGAL-003C
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the HeadshotMarketing subgroup at https://burdenoff.com/contracts/headshotmarketing/. Every referenced contract is identified by its Document ID (HM-LEGAL-### / HM-PRICING-###) and incorporated by reference.
This list was reconciled on 2026-10-24 against the vendor inventory of the running Service (AWS-only infrastructure since 2026-08-15; Microsoft Azure was decommissioned and no longer processes any Customer Data) and matches the public list at https://headshotmarketing.com/subprocessors. Rows marked conditional apply only when Customer enables the relevant feature; the row marked to be confirmed names a processing role whose vendor has not yet been selected and will be notified under DPA §6 before it processes any Customer Data.
| Subprocessor | Service / role | Processing location(s) | Personal Data categories |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure — primary backend and frontend (compute, PostgreSQL, graph database, cache, secrets management, object storage, CDN) | ap-south-1 (Mumbai, India) | All categories under Customer Data hosted on the Service |
| Cloudflare, Inc. | CDN, WAF, DNS, Zero Trust | Global edge | Connection metadata, IPs, request headers; cached static assets |
| Amazon Simple Email Service (SES) | Transactional email | ap-south-1 (Mumbai) | Email address, message content of transactional emails |
| Stripe, Inc. | Payment processing — international (invoiced by Algoshred Technologies Corp, Delaware); marketplace payouts/escrow where enabled | US / EU | Billing identifiers, tokenised card data, marketplace payout details (Stripe acts as PCI-DSS processor) |
| Razorpay Software Pvt. Ltd. | Payment processing — India and other regional (invoiced by Headshot Marketing Private Limited); marketplace payouts/escrow where enabled | India | Billing identifiers, tokenised UPI/card data, marketplace payout details |
| Conditional: ad / social / email / SMS delivery providers (only where Customer enables a delivery integration) | Campaign, audience, post and message delivery to the platforms Customer connects | Per provider — disclosed at enablement | Campaign content, audience definitions and delivery results Customer commissions |
| Rybbit (self-hosted by HeadshotMarketing) | Privacy-respecting product and website analytics (open-source, operated by us) | India | Pseudonymous usage and event metadata |
| Apache Answer (self-hosted by HeadshotMarketing) | Support community at community.headshotmarketing.com (open-source, operated by us) | India | Community profile and post content |
| HeadshotMarketing-operated support tooling | In-house ticketing and customer success — no third-party SaaS support desk | India | Support content |
| GitHub, Inc. | Source-code hosting (HeadshotMarketing internal); also referenced by Customer integrations | US | Issue/ticket metadata where Customer engages support via GitHub |
| Linear (Linear Orbit, Inc.) | Internal project tracking | US | Support ticket metadata if Customer escalates |
| Google Workspace (Google LLC) | Internal team collaboration only — email, calendar, docs used by Burdenoff Group personnel for internal operations. Customer Data is not stored in Google Workspace as part of the Service. | US / EU (Google managed) | Internal operational data only |
| Burdenoff Consultancy Services Private Limited | Manpower house — provides engineering, support, security and operations personnel that deliver the Service on HeadshotMarketing's behalf (see DPA §1.4) | India | All categories, on HeadshotMarketing's instructions |
| Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680) | International payment processing entity invoicing via Stripe | USA | Billing identifiers for international invoicing |
| To be confirmed: AI model provider | AI inference for content generation, optimisation and the marketing agent — vendor not yet selected; notified under DPA §6 before any Customer Data is processed | To be disclosed on selection | Prompts and content submitted for generation; generated content |
| Other Burdenoff Group entities (as listed at https://burdenoff.com/companies) | Group operations under common ownership | India / future regions | Same as HeadshotMarketing, under intra-group data-protection arrangements |
Notes
- Customer-contracted integrations (the Customer's own CRM, ad networks, social platforms, email/SMS gateway, accounting system, identity provider, or an analytics provider the Customer engages directly) are not HeadshotMarketing Subprocessors; Customer is responsible for those relationships and their data-processing terms.
- For Enterprise / dedicated tenant deployments, the Subprocessor list may be narrowed in the Order Form (e.g., India regions only, no delivery provider).
- The authoritative live list is maintained at https://headshotmarketing.com/subprocessors; changes are notified per DPA §6.
Last reviewed: 2026-10-24 (reconciled against the live vendor inventory)
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (HM-LEGAL-### or HM-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.