Recipients – Vendor categories

Last updated: September 4, 2025

For transparency, we list below the categories of recipients that may process personal information on our behalf. This page complements the Privacy Policy.

Subscribe to change noticesRequest the named list (clients)
Good to know
  • In accordance with applicable laws (EU/UK GDPR, Quebec’s Law 25, Canada’s PIPEDA, California’s CPRA), disclosure may be made by category of recipient.
  • Non-essential services (e.g., analytics/marketing) are only activated with consent.
  • Individuals may exercise their rights (access, correction, deletion, etc.).
CategoryPurposeData typesMain regionsTransfer mechanisms (if outside CA/QC/EU)
Hosting / InfrastructureServers, databases, storage, backups, CDN/WAF
  • Credentials
  • Educational content
  • Technical logs
  • Usage metadata
  • Quebec/Canada (priority)
  • Backup/DR: depends on configuration
  • Local processing in Canada when available
  • Standard Contractual Clauses (SCC) / IDTA if transferred
  • Enhanced technical safeguards
DNS / RegistrarDomain name management and Anycast DNS
  • Administrative credentials
  • DNS metadata
  • EU + global Anycast
  • Contracts + technical safeguards
AI / LLM (inference)AI-assisted educational features (inference)
  • Content submitted for inference
  • Pseudonymized technical identifiers
  • Logs
  • Canada (priority)
  • Contract/DPA
  • No use for advertising purposes
  • No reuse for training without an appropriate legal basis/contract
Messaging – outbound (SMTP/API)Transactional emails (welcome, password reset, notices) and newsletter (with consent)
  • Email address
  • Subject line
  • Delivery status
  • Minimal template content
  • EU/US (depending on data center and regional options)
  • DPA + SCC/DPF (depending on entity)
  • Limited log retention
  • Tracking disabled by default
Messaging – direct inboundReceiving emails sent to @nabunam.com (mailboxes)
  • Message content
  • Attachments
  • Metadata
  • EU (Gandi hosting) + Anycast DNS
  • Encryption in transit/at rest
  • DMARC/MTA-STS/TLS-RPT
  • Purge/archiving per policy
Tickets/support/form (app)Submitting and tracking requests via the site
  • Submitted content
  • Attachments
  • History
  • QC-CA (OVH Beauharnois)
  • Local processing in Canada/Quebec
  • Role-based access
  • Purge by status (closed/inactive)
Internal messaging (app)Exchanges between users within the platform
  • Messages
  • Attachments
  • Timestamps
  • QC-CA (OVH Beauharnois)
  • Local processing
  • Minimal email alert (link) without content
  • Purge at end of session + N months
PaymentPayment processing and billing
  • Credentials
  • Billing metadata
  • Payment tokens (tokenized)
  • EU/UK/US (depending on entity and payment methods)
  • DPA + SCC/DPF (depending on entity)
  • Retention aligned with legal obligations

Note: exact regions may vary depending on the chosen architecture (Canada/Quebec is prioritized when possible). Cross-border transfers may occur (e.g., redundancy, messaging) and are governed by recognized safeguard mechanisms.

Obtaining the named list

Clients (institutions) may obtain the named list of subprocessors and be notified of any addition or replacement (in accordance with Art. 28(2) GDPR and contractual clauses). Write to info@nabunam.com.

Change history

  • September 4, 2025 — Publication of the minimal version (categories, regions, mechanisms).
← Back to home