NABUNAM · Transparency

Recipients – Vendor categories

Last updated:

For transparency, we list below the categories of recipients that may process personal information on our behalf. This page complements the Privacy Policy.

Request the named list (clients) Subscribe to change notices
Good to know
  • In accordance with applicable laws (EU/UK GDPR, Quebec’s Law 25, Canada’s PIPEDA, California’s CPRA), disclosure may be made by category of recipient.
  • Non-essential services (e.g., analytics/marketing) are only activated with consent.
  • Individuals may exercise their rights (access, correction, deletion, etc.).

Recipient categories

Roles, information concerned and processing arrangements.

Hosting / Infrastructure

Servers, databases, storage, backups, CDN/WAF

Data types
  • Credentials
  • Educational content
  • Technical logs
  • Usage metadata
Main regions
  • Quebec/Canada (priority)
  • Backup/DR: depends on configuration
Transfer mechanisms (if outside CA/QC/EU)
  • Local processing in Canada when available
  • Standard Contractual Clauses (SCC) / IDTA if transferred
  • Enhanced technical safeguards

DNS / Registrar

Domain name management and Anycast DNS

Data types
  • Administrative credentials
  • DNS metadata
Main regions
  • EU + global Anycast
Transfer mechanisms (if outside CA/QC/EU)
  • Contracts + technical safeguards

AI / LLM (inference)

AI-assisted educational features (inference)

Data types
  • Content submitted for inference
  • Pseudonymized technical identifiers
  • Logs
Main regions
  • Canada (priority)
Transfer mechanisms (if outside CA/QC/EU)
  • Contract/DPA
  • No use for advertising purposes
  • No reuse for training without an appropriate legal basis/contract

Transactional email delivery

Transactional emails (welcome, password reset, notices) and newsletter (with consent)

Data types
  • Email address
  • Subject line
  • Delivery status
  • Minimal template content
Main regions
  • EU/US (depending on data center and regional options)
Transfer mechanisms (if outside CA/QC/EU)
  • DPA + SCC/DPF (depending on entity)
  • Limited log retention
  • Tracking disabled by default

Messaging – direct inbound

Receiving emails sent to @nabunam.com (mailboxes)

Data types
  • Message content
  • Attachments
  • Metadata
Main regions
  • EU + global Anycast DNS
Transfer mechanisms (if outside CA/QC/EU)
  • Encryption in transit/at rest
  • DMARC/MTA-STS/TLS-RPT
  • Purge/archiving per policy

Tickets/support/form (app)

Submitting and tracking requests via the site

Data types
  • Submitted content
  • Attachments
  • History
Main regions
  • QC-CA (OVH Beauharnois)
Transfer mechanisms (if outside CA/QC/EU)
  • Local processing in Canada/Quebec
  • Role-based access
  • Purge by status (closed/inactive)

Internal messaging (app)

Exchanges between users within the platform

Data types
  • Messages
  • Attachments
  • Timestamps
Main regions
  • QC-CA (OVH Beauharnois)
Transfer mechanisms (if outside CA/QC/EU)
  • Local processing
  • Minimal email alert (link) without content
  • Purge at end of session + N months

Payment

Payment processing and billing

Data types
  • Credentials
  • Billing metadata
  • Payment tokens (tokenized)
Main regions
  • EU/UK/US (depending on entity and payment methods)
Transfer mechanisms (if outside CA/QC/EU)
  • DPA + SCC/DPF (depending on entity)
  • Retention aligned with legal obligations

Note: exact regions may vary depending on the chosen architecture (Canada/Quebec is prioritized when possible). Cross-border transfers may occur (e.g., redundancy, messaging) and are governed by recognized safeguard mechanisms.

Obtaining the named list

Clients (institutions) may obtain the named list of subprocessors and be notified of any addition or replacement (in accordance with Art. 28(2) GDPR and contractual clauses). Write to info@nabunam.com.

Change history

  • September 4, 2025 — Publication of the minimal version (categories, regions, mechanisms).
← Back to home