Sub-Processor Register

Purpose

Hosting of the Mark My Words platform and storage of platform data.

Data types disclosed

All data processed by our platform, including teacher profile data, student writing samples, assessment data, and usage data — stored and processed on Azure infrastructure.

Location of processing

Australia (Australia East and/or Australia Southeast regions). Platform data is stored and processed in Australian Azure regions. Microsoft personnel located outside Australia may access data on a limited basis for support and service operations, subject to contractual safeguards.

All platform data is stored and processed in Azure's Australian data centres. Data is not stored outside Australia through this sub-processor.

Purpose

Business email, document storage and internal collaboration.

Data types disclosed

Staff email communications, internal documents, and any school or teacher information included in business correspondence (for example, names, email addresses and school details shared in support or sales communications).

Location of processing

Australia (Sydney and/or Melbourne). Our Microsoft 365 tenant is provisioned in Australia. Under Microsoft’s Privacy and Security Product Terms, Exchange Online mailbox content, SharePoint site content, OneDrive files and Microsoft Teams chat messages are stored at rest only within Australia. Microsoft personnel located outside Australia may access data on a limited basis for support and service operations, subject to contractual safeguards. See their privacy statement.

Staff email and documents are stored at rest in Microsoft’s Australian data centres. Data is not stored outside Australia through this sub-processor.

Purpose

Internal team communication and collaboration.

Data types disclosed

Staff messages and files shared internally. School, teacher and partner information may be included where it is discussed in internal business communications (for example, names, email addresses and school details raised in support, sales or account discussions). Student writing and assessment data are not shared in Slack.

Location of processing

United States. Slack Technologies (a Salesforce company) stores customer data in the United States. See their privacy statement.

Slack is used for internal team communication only. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Slack.

Purpose

Delivery of transactional and notification email from the platform.

Data types disclosed

Recipient email addresses and the content of transactional email we send to teachers and school staff, such as account, login and processing notification emails. Student writing and assessment content are not sent through Mailgun.

Location of processing

European Union. Our Mailgun account sends from Mailgun’s EU region, so the email we send, recipient addresses, delivery logs and suppression lists are stored and processed in the EU. Mailgun (a Sinch company) replicates only limited account information, such as our staff user accounts, billing details and sending domain names, globally. See their privacy statement.

Mailgun handles outbound platform email only. Message data stays in Mailgun’s EU region. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Mailgun.

Purpose

In-product onboarding, user guidance and feature announcements.

Data types disclosed

Teacher and school staff user identifiers and in-app usage data, such as which onboarding tours and guides a user has seen and which features they have used. Product Fruits does not receive student writing or assessment data.

Location of processing

European Union (Ireland). Product Fruits is a Czech provider and hosts data in the EU region by default. See their privacy statement.

Product Fruits supports in-app onboarding and guidance for teachers and school staff. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Product Fruits.

Purpose

Customer relationship management, sales and communications with schools.

Data types disclosed

School and organisation names, teacher names and email addresses, deal values and subscription information, and sales and communication history with school contacts.

Location of processing

Australia (Sydney). Our HubSpot data is hosted in HubSpot's Australian data centre located in Sydney.

HubSpot data is hosted in Australia (Sydney). Data is not stored outside Australia through this sub-processor. HubSpot is a US-domiciled company and its personnel may access data from outside Australia for support purposes, subject to contractual safeguards.

Purpose

Customer support ticketing and help desk.

Data types disclosed

Teacher and school contact details, the content of support tickets, and any information a user includes when raising a support request. Where a ticket relates to a school that came to us through a partner, a copy of the ticket may be shared with that partner.

Location of processing

Australia (Sydney). Our Zendesk data is hosted in Zendesk’s Australian data centre located in Sydney. See their privacy statement.

Zendesk data is hosted in Australia (Sydney). Data is not stored outside Australia through this sub-processor. Zendesk is a US-domiciled company and its personnel may access data from outside Australia for support purposes, subject to contractual safeguards.

Purpose

Payment processing for subscriptions and invoices.

Data types disclosed

Billing contact name, school name, email address, and payment card details. Stripe does not receive student data or platform usage data.

Location of processing

United States and other Stripe data centre locations. Stripe is PCI-DSS Level 1 certified. See their privacy statement.

Stripe processes payment data in the United States and other locations. Stripe is certified to PCI-DSS Level 1, the highest level of payment security certification.

Purpose

Enabling the opt-in integration between Mark My Words and the Seven Steps portal.

Data types disclosed

Teacher name, school name, and school information. This data sharing occurs only where the user opts in when signing up for the Seven Steps portal. Student data is not shared.

Location of processing

Australia. Seven Steps to Writing Success is an Australian company and data is handled within Australia.

Seven Steps to Writing Success is an Australian educational partner. Data shared under this arrangement remains in Australia.

Purpose

Accounting, invoicing and financial record keeping.

Data types disclosed

School billing details including school name, contact name, email address, and invoice and payment information. Xero does not receive student data, platform data, or teacher data beyond what is included in billing records.

Location of processing

United States. Xero stores customer data in data centres located in the United States. See their privacy statement.

Xero holds billing and accounting records only. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Xero.

Purpose

Bookkeeping, invoicing and accounts administration.

Data types disclosed

School billing details including school name, contact name, email address, and invoice and payment information. Hatch does not receive student data, platform data, or teacher data beyond what is included in billing records.

Location of processing

Australia. Hatch Accounting is an Australian firm and financial data is handled within Australia.

Hatch Accounting is an Australian company. All financial data handled by Hatch remains in Australia.