Sub-processor List

Operator of afina CLP: IVT Communications FZC LLC (“IVT”, “afina”)
Contact: privacy@afinadmp.com
Effective date: 08.10.2026
Version: 1.0
This page lists the sub-processors engaged by IVT in the delivery of afina CLP, and explains which categories of providers involved in a campaign are not IVT's sub-processors and why. It is the reference disclosure under Art. 28 GDPR and the change-notification source named in the afina CLP Terms of Service §6 and the Data Processing Agreement.

A. Website and corporate sub-processors

Engaged by IVT across the afina websites (afinaclp.com, afinadmp.com) and IVT's corporate infrastructure; not every provider below is used on every website.

Sub-processor	Location	Purpose	Personal-data categories	Transfer safeguard
Tilda Publishing	Cyprus / vendor cloud	Website hosting; form transit	Contact-form submissions in transit; strictly-necessary cookies	Adequacy decisions or Standard Contractual Clauses (2021/914)
SendPulse Inc.	USA	Contact-form recipient; consent audit trail; marketing automation	Contact name, email, phone, company; consent records; email interaction data	Standard Contractual Clauses (2021/914)
DDoS-Guard	Belize / global edge	Anti-bot and DDoS protection	IP address; request metadata; short-lived challenge tokens	Strictly necessary processing; contractual safeguards
Cloudflare, Inc.	USA / global regions	Edge proxy, CDN and DDoS protection for website traffic; CDN for website script libraries	IP address; request metadata	Standard Contractual Clauses (2021/914)
Google LLC (reCAPTCHA)	USA	Bot detection on contact forms	IP address; browser signals; interaction signals	Standard Contractual Clauses (2021/914)
Google LLC (Workspace / Fonts)	USA	Corporate email; font serving	Email content; sender/recipient metadata; font request metadata	Standard Contractual Clauses (2021/914)
Zapier, Inc.	USA	Workflow automation (form submissions → CRM)	Contact-form data in transit; workflow metadata	Standard Contractual Clauses (2021/914)
Digital Ocean, LLC	USA / global regions	Infrastructure for IVT corporate systems (non-product workloads)	No direct product personal data — corporate workloads only, in all deployment models	Standard Contractual Clauses (2021/914)
Notion Labs, Inc.	USA	Corporate knowledge base	Corporate documents; incidental personal data in business records	Standard Contractual Clauses (2021/914)

B. Product sub-processors — deployments in IVT's managed cloud

Where afina CLP is deployed in IVT's managed cloud infrastructure, IVT selects and contracts the infrastructure and platform vendors. Hosting is matched to the operator's / client's jurisdiction.

Category	Sub-processor	Region	Status
Cloud hosting (per market)	To be announced — selection in progress	Matches the operator/client jurisdiction	Deployment-specific details are available under the applicable Data Processing Agreement
Identity / SSO provider	To be announced — selection in progress	Matched to hosting region	Deployment-specific details are available under the applicable Data Processing Agreement
Support / ticketing	To be announced — selection in progress	Matched to hosting region	Deployment-specific details are available under the applicable Data Processing Agreement
Observability / logging	To be announced — selection in progress	Matched to hosting region	Deployment-specific details are available under the applicable Data Processing Agreement
Operational tooling (remote administration, secrets, CI/CD, image registry)	None at this time	—	IVT currently engages no third-party operational tooling that processes personal data or holds credentials to systems that do; IVT's own tooling is self-hosted and covered by the applicable TOMs annex and Data Processing Agreement. Any future third-party tooling will be listed here before use, per the change-notification process below

Subscriber phone numbers are encrypted before upload and are never stored in plaintext in any IVT-managed component; decryption for matching and scoring occurs inside the data supplier's environment.

B-bis. Infrastructure engaged by the Mobile Network Operator

Where afina CLP is deployed inside infrastructure that a Mobile Network Operator (“MNO”) owns and controls — either its own network or on-premises data centre, or a cloud account held in the MNO's name in which IVT deploys and operates the Platform — the infrastructure providers involved are selected and contracted by that MNO. They process personal data on the instruction of the MNO as controller and are sub-processors of the MNO, not of IVT. IVT therefore does not list them here; their absence from Sections A and B is a boundary of responsibility rather than an omission.

For each such deployment, the identity of the infrastructure providers, the processing region and the applicable safeguards are recorded in the Data Processing Agreement with that MNO and in the deployment-specific annex, and are available to the Customer on request. IVT remains a processor for the operation of the Platform inside that infrastructure and remains accountable for the technical and organisational measures set out in the applicable TOMs annex.

C. Not sub-processors: communication providers

Communication providers (SMS / email / push / RCS / WhatsApp) are engaged by the Advertiser — not by IVT — under a separate processing agreement per campaign. Personal data is revealed to the communication provider only at the moment of dispatch, and the provider acts on the Advertiser's direct instruction rather than under IVT's DPA. These providers are therefore not afina CLP sub-processors for the purposes of Art. 28 GDPR and are not included above. The Advertiser, as controller of subscriber data, is responsible for placing an appropriate processing agreement with the selected provider and for the transfer mechanism required by the applicable regime before dispatch.

Changes to this list

IVT gives Customers no fewer than 30 days' advance written notice before adding or replacing a sub-processor, posted on this page and — where subscribed — sent by email. In emergencies materially affecting the security or continuity of the Service, the period may be reduced to no fewer than 7 days. Customers may object on reasonable data-protection grounds within 14 days of the notice; if unresolved within 30 days, the Customer may terminate the affected Service on written notice without liability and receive a pro-rata refund of pre-paid fees.

Questions: privacy@afinadmp.com

Cookie Notice

Cookie Settings

sales@afinadmp.com