Sub-processors
The third parties that process personal data on our behalf, and the safeguards that cover each one.
This page lists the third parties that process personal data on behalf of PWNED LABS CYBERSECURITY TRAINING SERVICES FZCO in connection with the Pwned Labs platform and services, as described in our Privacy Policy. We review this list regularly and update it when a provider is added or removed.
Last updated: October 16, 2026
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| HubSpot, Inc. | CRM, website, email and payments | EU; support access from the US | EU-US Data Privacy Framework, EU SCCs, UK Addendum |
| Stripe, Inc. | Payment processing | US and global | EU-US Data Privacy Framework, EU SCCs, UK IDTA |
| PayPal | Payment processing | US and global | PayPal's binding corporate rules and SCCs |
| DigitalOcean, LLC | Cloud hosting | US and global | EU-US Data Privacy Framework and UK Extension; EU SCCs and UK Addendum |
| Amazon Web Services, Inc. | Cloud hosting and lab environments | Global | EU SCCs, UK Addendum |
| Google Cloud | Cloud hosting and lab environments | United States | EU SCCs, EU-US Data Privacy Framework |
| Microsoft | Cloud hosting and lab environments | Global | EU SCCs, EU-US Data Privacy Framework |
| Oracle Cloud | Cloud hosting | United Arab Emirates | EU SCCs, UK Addendum |
| Cloudflare, Inc. | Content delivery and security | Global network | EU SCCs, UK Addendum, EU-US Data Privacy Framework |
| Railway Corp. | Cloud hosting | US and global | EU SCCs, UK Addendum, EU-US Data Privacy Framework |
| Google Workspace | Business email and productivity | US and global | EU SCCs, EU-US Data Privacy Framework |
| Slack Technologies | Internal communication | US | EU-US Data Privacy Framework, EU SCCs, UK Addendum |
| Zapier, Inc. | Workflow automation | US | EU-US Data Privacy Framework; EU SCCs and UK Addendum |
| Credly (Pearson) | Certification badges | US | EU SCCs, UK Addendum |
| EmailOctopus | Marketing email | EU (Ireland); some US sub-processors | UK IDTA and UK Addendum; EU SCCs |
| Google Analytics and Tag Manager | Website analytics (consent based) | Global; EU and UK traffic collected in region | EU SCCs, EU-US Data Privacy Framework, UK Extension |
| Anthropic, PBC | AI assistance | US | EU SCCs, UK Addendum |
| DocuSign, Inc. | Contract signature | US and EU | Processor binding corporate rules, EU SCCs, UK IDTA |
| Shopify Inc. | Merchandise store | Canada, US and global | Binding corporate rules, SCCs, UK IDTA |
| Printful, Inc. | Merchandise fulfillment | US and EU | EU SCCs, UK SCCs |
| Apollo.io | Business contact data | US | EU-US Data Privacy Framework; EU SCCs and UK Addendum |
| Advertising audience matching | US, Ireland and global | EU SCCs |
Independent controllers. Discord (community server), Credly (badge holder profiles), and Google, LinkedIn and Reddit for data collected through their own advertising tags and cookies, are not sub-processors. Their own privacy policies apply.