DPA Annex 3 — Subprocessors
Annex 3 — Subprocessors
Document ID: TC-LEGAL-003C
Title: DPA Annex 3 — Subprocessors
Version: 1.1
Last updated: 2026-10-24
Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/timecampus/TC-LEGAL-003C
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the TimeCampus subgroup at https://burdenoff.com/contracts/timecampus/. Every referenced contract is identified by its Document ID (TC-LEGAL-### / TC-PRICING-###) and incorporated by reference.
This list was reconciled on 2026-10-24 against the production vendor inventory: hosting and data stores (AWS ap-south-1 only — Microsoft Azure was decommissioned on 2026-08-15 and processes no Customer Data), edge (Cloudflare), email (SES), subscription payments (global billing service: Razorpay and Stripe), website analytics (Rybbit Cloud, loaded only with consent) and AI model providers (platform AI features). The live, authoritative list with its change log is published at https://timecampus.com/subprocessors.
| Subprocessor | Service / role | Processing location(s) | Personal Data categories |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure — sole hosting platform: compute (EKS), relational databases (RDS PostgreSQL), graph database (Neptune), cache and event streams (ElastiCache Valkey), object storage (S3), secrets and key management (Secrets Manager, KMS), frontend delivery (CloudFront) | ap-south-1 (Mumbai, India) | All categories under Customer Data hosted on the Service |
| Cloudflare, Inc. | CDN, WAF, DNS, Zero Trust | Global edge | Connection metadata, IPs, request headers; cached static assets |
| Amazon Simple Email Service (SES) | Transactional email | ap-south-1 (Mumbai) | Email address, message content of transactional emails |
| Stripe, Inc. | Subscription payment processing — international (invoiced by Algoshred Technologies Corp, Delaware) | US / EU | Billing identifiers, tokenised card data (Stripe acts as PCI-DSS processor) |
| Razorpay Software Pvt. Ltd. | Subscription payment processing — customers in India (invoiced by Timecampus Technologies Pvt. Ltd.) | India | Billing identifiers, tokenised UPI/card data |
| Rybbit Cloud (Rybbit) | Cookieless website analytics on timecampus.com, loaded only with the visitor's consent; IP addresses are used transiently for country lookup and not stored | Provider-hosted | Page URLs, referrers, device type, country / region |
| Anthropic, PBC; OpenAI, L.L.C.; Google LLC (AI model providers) | Large-language-model inference for AI-assisted features, limited to the content submitted to that feature; providers do not train on it | US / EU (per provider) | Content Customer or its users submit to AI features |
| Payroll/accounting export & integration providers (only where Customer enables a verification integration) | Time-and-attendance and expense export commissioned by Customer | Per provider — disclosed at enablement | Billable-time and expense records, export confirmations Customer commissions |
| Timecampus-operated support tooling | In-house ticketing and customer success — no third-party SaaS support desk | India | Support content |
| GitHub, Inc. | Source-code hosting (Timecampus internal); also referenced by Customer integrations | US | Issue/ticket metadata where Customer engages support via GitHub |
| Linear (Linear Orbit, Inc.) | Internal project tracking | US | Support ticket metadata if Customer escalates |
| Google Workspace (Google LLC) | Internal team collaboration only — email, calendar, docs used by Burdenoff Group personnel for internal operations. Customer Data is not stored in Google Workspace as part of the Service. | US / EU (Google managed) | Internal operational data only |
| Burdenoff Consultancy Services Pvt. Ltd. | Manpower house — provides engineering, support, security and operations personnel that deliver the Service on Timecampus's behalf (see DPA §1.4) | India | All categories, on Timecampus's instructions |
| Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680) | International payment processing entity invoicing via Stripe | USA | Billing identifiers for international invoicing |
| Other Burdenoff Group entities (as listed at https://burdenoff.com/about) | Group operations under common ownership | India | Same as Timecampus, under intra-group data-protection arrangements |
Notes
- Customer-contracted integrations (the Customer's own calendar, accounting or payroll system, project-tracking tool, expense system, identity provider, or a integration provider the Customer engages directly) are not Timecampus Subprocessors; Customer is responsible for those relationships and their data-processing terms.
- For Enterprise / dedicated tenant deployments, the Subprocessor list may be narrowed in the Order Form (e.g., India regions only, no integration provider).
- The authoritative live list is maintained at https://timecampus.com/subprocessors, with a dated change log, and changes are notified per DPA §6.
Last reviewed: 2026-10-24 (reconciled with the production vendor inventory)
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (TC-LEGAL-### or TC-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.