1.Overview
BambooHR engages third-party entities ("Sub-Processors") to assist in providing the Services. Each Sub-Processor processes Personal Data on behalf of BambooHR, and BambooHR has entered into written data processing agreements with each Sub-Processor that impose data protection obligations consistent with those in the BambooHR Data Processing Agreement.
This page lists BambooHR's current Sub-Processors for the Services as defined in the Data Processing Agreement. BambooHR will provide at least thirty (30) days' advance notice of any material changes to this list in accordance with the Data Processing Agreement. Customers may object to new Sub-Processors as described in the DPA.
2.Change Notification Process
To receive email notifications when this Sub-Processor list is updated, customers can subscribe by contacting us via our contact page with the subject line "Sub-Processor Notification Request". Customers will receive advance notification of additions or replacements at least thirty (30) days before the change takes effect.
If you wish to object to the addition of a new Sub-Processor, please contact us via our contact page with the subject line "Sub-Processor Objection" within thirty (30) days of the notification date. BambooHR will consider your objection in good faith. If BambooHR cannot accommodate your objection, you may have the right to terminate your subscription under the DPA.
3.Current Sub-Processors
Infrastructure and Hosting: Amazon Web Services, Inc. (AWS) - United States - Cloud infrastructure and data storage; Google LLC - United States - Cloud services and analytics.
Operations and Support: Salesforce, Inc. - United States - Customer relationship management; Zendesk, Inc. - United States - Customer support ticketing; Twilio Inc. - United States - Communications and SMS services; SendGrid (Twilio) - United States - Transactional email delivery; Slack Technologies LLC - United States - Internal team communication.
Security and Monitoring: Cloudflare, Inc. - United States - Content delivery network and security; New Relic, Inc. - United States - Application performance monitoring; Datadog, Inc. - United States - Infrastructure monitoring and logging.
Payments: Stripe, Inc. - United States - Payment processing; Zuora, Inc. - United States - Subscription billing.
Product Analytics: Amplitude, Inc. - United States - Product analytics; FullStory, Inc. - United States - User experience analytics (subject to applicable opt-out controls).
4.Third-Party Integrations
In addition to the Sub-Processors listed above, customers may enable optional third-party integrations through the BambooHR Marketplace. When a customer enables an integration, the third-party provider operates as a separate controller or processor of Personal Data, and that provider's own privacy policy and terms of service apply.
BambooHR is not responsible for the data practices of third-party integration providers and recommends that customers review the privacy policies of any integrations they enable. For questions about third-party integration data processing, customers should contact the relevant integration provider directly.
