Sub-processors

Last updated: June 9, 2026

To deliver Time Champ, we engage carefully selected third-party providers (“sub-processors”) who may process Customer Data on our behalf. This page lists those sub-processors and the purposes for which we use them, in line with our commitments under the EU/UK GDPR (Article 28) and the India DPDP Act 2023.

All sub-processors are bound by data protection terms that meet or exceed our own obligations to you. We require each sub-processor to implement appropriate technical and organisational measures to protect Customer Data.

Current Sub-processors

Cloud Infrastructure & Hosting

Amazon Web Services (AWS) — Cloud hosting, compute, storage, and managed services. Primary regions: AP-South-1 (Mumbai), EU-West-1 (Ireland), US-East-1 (N. Virginia). Location: USA — Privacy
Microsoft Azure — Secondary cloud infrastructure for select enterprise deployments. Location: USA — Privacy
Cloudflare — Content delivery network, DDoS protection, and edge security. Location: USA — Privacy

Database & Storage

Amazon RDS / DynamoDB — Managed database services for primary and analytical workloads (via AWS).
Amazon S3 — Object storage for screenshots, file uploads, and exports (via AWS).

Email, Communication & Notifications

Amazon SES — Transactional email delivery (account notifications, password resets, reports). Location: USA
SendGrid (Twilio) — Backup transactional and marketing email delivery. Location: USA — Privacy
Twilio — SMS notifications for select accounts. Location: USA — Privacy

Payment Processing

Stripe — Payment processing for global subscriptions. Location: USA — Privacy
Razorpay — Payment processing for Indian subscriptions (INR billing). Location: India — Privacy

Analytics & Product Insights

Google Analytics 4 — Aggregated website analytics. Location: USA — Privacy
Microsoft Clarity — Anonymous session recordings and heatmaps for website usability. Location: USA — Privacy
Google Tag Manager — Tag management for marketing and analytics scripts. Location: USA — Privacy

Marketing & CRM

HubSpot — CRM, marketing automation, and lead capture forms. Location: USA — Privacy
LinkedIn Marketing Solutions — Advertising and conversion attribution. Location: USA — Privacy
Google Ads — Advertising and conversion attribution. Location: USA — Privacy

Customer Support & In-Product Messaging

Zoho Desk — Customer support ticketing. Location: India — Privacy
Zoho SalesIQ — Live chat on website. Location: India — Privacy

Monitoring, Logging & Error Tracking

Sentry — Application error tracking and performance monitoring. Location: USA — Privacy
Datadog — Infrastructure and application performance monitoring. Location: USA — Privacy

Identity & Authentication

Google Sign-In — OAuth authentication for accounts that choose social sign-in. Location: USA
Microsoft Sign-In — OAuth authentication for accounts that choose Microsoft single sign-on. Location: USA

Notification of Changes

We may engage new sub-processors or replace existing ones as our service and infrastructure evolves. In accordance with our Data Processing Agreement, we will:

Notify in-scope customers in writing (typically by email or in-product notification) at least thirty (30) days before the new sub-processor begins processing personal data.
Provide customers with a reasonable period during which they may object to the addition of the new sub-processor.
Work in good faith with any customer that reasonably objects, to identify a commercially reasonable resolution.

Sub-processor Due Diligence

Before engaging any sub-processor, Time Champ:

Reviews the sub-processor’s security and privacy posture, including certifications (e.g., ISO 27001, SOC 2) where applicable.
Executes a written data processing agreement with the sub-processor that incorporates the necessary GDPR Article 28 and DPDP-aligned terms.
Where personal data is transferred outside the EEA, UK, or India, ensures appropriate transfer mechanisms (Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards) are in place.
Reviews each sub-processor periodically and after material changes.

Contact

For questions about our sub-processors, to request our standard Data Processing Agreement (DPA), or to subscribe to sub-processor change notifications, please contact: