Service Providers & Subprocessors
Version 1.0 - 10 September 2026
RUMvision uses selected third parties to provide and operate its services. This page identifies the providers that are relevant to our processing of personal data and explains, at a practical level, what they are used for.
Not every provider has the same role under data-protection law. A provider may act as a subprocessor for Customer RUM Data, as a processor for RUMvision's own business data, or in some cases as an independent controller. The role depends on the actual processing activity.
Our core visitor-level RUM processing infrastructure is located within the European Union. Separate business services and optional functionality may involve processing in other locations, in which case appropriate transfer safeguards are applied where required.
1. Core RUM infrastructure subprocessors
The providers in this section are used for the core infrastructure of the RUMvision Service and may process Customer RUM Data on behalf of RUMvision. They are treated as subprocessors where applicable under our Data Processing Agreement.
| Provider | Purpose | Data involved | Primary processing location | Role | Transfer position |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure used for collection, hosting, storage and processing of RUM Data | Visitor-level RUM Data and related technical service data | Frankfurt, Germany | Subprocessor | Core RUM processing is configured in the EU. Any transfer or onward processing outside the EEA is subject to the applicable provider terms and legally required transfer safeguards. |
| Google Cloud | Additional cloud processing and storage used by the RUMvision Service | Visitor-level RUM Data and related technical service data where the relevant infrastructure is used | Belgium | Subprocessor | Core processing covered by this use is located in the EU. Any transfer or onward processing outside the EEA is subject to applicable transfer safeguards. |
| team.blue | Hosting and supporting infrastructure | Customer RUM Data and related technical service data where processed through the relevant infrastructure | Netherlands | Subprocessor | EU processing for the relevant RUMvision infrastructure. |
Note on Elasticsearch: RUMvision uses Elasticsearch technology for indexing and search. Software components that are operated within infrastructure already listed above are not separately listed as subprocessors unless a separate third-party provider itself processes Customer RUM Data on RUMvision's behalf.
2. Development & technical service providers
The providers in this section support the development, architecture, maintenance and technical operation of RUMvision. They may qualify as subprocessors where their work requires access to personal data processed on behalf of RUMvision customers.
| Provider | Purpose | Data involved | Primary processing location | Role | Transfer position |
|---|---|---|---|---|---|
| Chessweb | Hosting, backend development, architecture and technical support | Customer RUM Data, source code, technical project information and production-related information where access is required for hosting, development, architecture or support | Netherlands | Service provider; subprocessor where access to personal data processed on behalf of RUMvision customers is required | EU processing for the relevant RUMvision infrastructure. Any access to Customer Data is subject to applicable confidentiality, security and data-processing requirements. |
| Gromatics | Frontend development, software development and technical support | Source code, technical project information and, where necessary for development or support, limited Customer Data or production-related information | Netherlands | Service provider; subprocessor where access to personal data processed on behalf of RUMvision customers is required | Any access to Customer Data is subject to applicable confidentiality, security and data-processing requirements. |
3. AI providers
RUMvision may use an external AI provider where a customer enables an AI-supported RUMvision feature.
An AI provider will be added to this register before it is used as a production subprocessor for personal data covered by the RUMvision DPA. The specific AI provider or model may change over time. Where required, customers will be informed of a new or replacement subprocessor in accordance with the DPA.
RUMvision and AI providers acting on our behalf are not permitted to use Customer Data, prompts, inputs or outputs in identifiable or customer-linked form to train or improve general-purpose or cross-customer AI models unless the customer has expressly agreed to that use and the processing is otherwise lawful.
Current production AI subprocessor: none listed at the date of this register.
A third-party AI or LLM service independently selected and connected by a customer, for example through MCP, is not automatically a RUMvision subprocessor and is therefore not listed in this section merely because it can connect to the RUMvision Service.
4. Other business service providers
The following providers support RUMvision's own business operations. They do not automatically process visitor-level RUM Data and should not be understood as RUM subprocessors merely because they appear in this register.
| Provider | Purpose | Typical data involved | Role / relationship | Location / transfer position |
|---|---|---|---|---|
| Stripe | Payment processing and subscription-related payment services | Customer and billing information, payment-related information and transaction data | Stripe may act as a processor and/or independent controller depending on the specific payment activity | Processing may involve locations outside the EEA. Stripe provides contractual and other transfer mechanisms for applicable international transfers. |
| Exact | Accounting and financial administration | Customer, invoice, transaction and financial administration data | Service provider / processor where applicable | Processing locations depend on the services and configuration used by RUMvision. International transfers are subject to applicable safeguards where required. |
| Microsoft 365 | Email, documents and business productivity | Business contact information, communications and internal business information | Service provider / processor where applicable | Processing locations depend on the services and configuration used by RUMvision. International transfers are subject to applicable safeguards where required. |
| SendGrid | Transactional and service email delivery | Email addresses, message delivery information and related communication data | Service provider / processor where applicable | Processing may involve locations outside the EEA. Appropriate transfer safeguards apply where required. |
| Calendly | Scheduling meetings, demos and customer or prospect appointments | Contact details, meeting details, scheduling preferences and information entered when booking an appointment | Service provider / processor where applicable | Processing may take place outside the EEA, including in the United States. Applicable international transfer safeguards are used where required. |
| Supademo | Creating and hosting interactive product demonstrations and product walkthroughs | Business contact information and content included in demos or walkthroughs where applicable | Service provider / processor where applicable | Processing locations depend on the services and subprocessors used by Supademo. International transfers are subject to applicable safeguards where required. |
| GitHub | Source-code hosting, version control and software-development collaboration | Developer account information, source code, technical issues and related development information. Customer RUM Data is not intended to be stored in source-code repositories. | Service provider / processor where applicable | Processing may take place in the United States and other locations. Applicable international transfer safeguards apply where required. |
| Linear | Product development, project management and issue tracking | Employee and contractor information, technical project information and limited customer or support information where included in issues | Service provider / processor where applicable | Processing may take place in the United States, European Union and other locations through Linear and its subprocessors. Applicable international transfer safeguards apply where required. |
| Notion | Internal documentation, knowledge management and business collaboration | Employee and contractor information, internal documentation and limited customer or business information where included in documentation | Service provider / processor where applicable | Processing locations depend on the Notion services and configuration used. International transfers are subject to applicable safeguards where required. |
| Meta / WhatsApp | Customer or business communication where WhatsApp is used | Contact information and message content provided through the service | Third-party communication provider; its role may depend on the relevant processing activity | Processing may involve locations outside the EEA and is also subject to the provider's own privacy terms. |
| Google Tag Manager | Management of website tags on RUMvision's own website | Technical website information depending on the tags configured through the service | Service provider; the privacy role depends on the tags and services actually configured | Processing and transfer position depend on the configuration and underlying tags. |
| Business marketing, advertising or related website functionality where enabled on RUMvision's own website | Website interaction and marketing-related information where the relevant functionality is enabled | May act as an independent or joint controller depending on the functionality used | Processing may involve locations outside the EEA and is subject to the applicable provider terms and transfer safeguards. |
5. Changes to subprocessors
The customer gives RUMvision general authorisation to engage subprocessors in accordance with the RUMvision Data Processing Agreement.
Where required by Article 28(2) GDPR and our DPA, RUMvision will provide reasonable advance notice before adding or replacing a subprocessor that will process personal data covered by the DPA. Customers may object on substantiated data-protection grounds in accordance with the DPA.
Changes to other service providers that do not process personal data on behalf of a customer as a RUMvision subprocessor do not necessarily trigger the DPA subprocessor-change procedure.
6. International transfers
RUMvision's core visitor-level RUM processing infrastructure is located within the European Union.
Some other service providers or optional functionality may involve processing outside the European Economic Area ("EEA"). Where an international transfer of personal data requires a transfer mechanism under Chapter V GDPR, RUMvision uses an applicable safeguard, such as an adequacy decision, Standard Contractual Clauses or another legally recognised mechanism.
The exact transfer mechanism may depend on the provider, destination and service configuration and may change where providers update their infrastructure or contractual arrangements.
7. Keeping this register current
This register is maintained separately from the RUMvision Terms of Service, Privacy Policy and Data Processing Agreement so that provider information can be updated without unnecessarily replacing those documents.
RUMvision reviews this register when a provider is added, removed or materially changes its role in the processing of personal data.
Last reviewed: 10 September 2026.