Bedaki engages the following sub-processors to deliver the Service. We give existing customers at least 30 days' notice before adding a new sub-processor that will have access to personal data. To subscribe to update notifications, email privacy@bedaki.com.
Current Sub-Processors
| Sub-Processor | Purpose | Region | Transfer Mechanism |
|---|---|---|---|
| Vantage Payment Systems SA (Payzone) | Card payment processing for MAD subscriptions (Visa, Mastercard); Bank Al-Maghrib licensed payment institution | Morocco | Domestic processing; cross-border transfer of cardholder data to Visa / Mastercard authorized by CNDP under VPS declaration T-PO-426/2023 |
| Visa Inc. and Mastercard International | Card network authorization, clearing, and settlement for transactions initiated through Payzone | United States; global card scheme | Onward transfer authorized via VPS's CNDP cross-border declaration T-PO-426/2023 |
| Acquiring bank network (Switch National, Morocco) | Settlement of card payments and chargeback handling, via the Moroccan interbank switch | Morocco | Domestic interbank routing |
| OpenAI, OpCo, LLC | Large language model inference for chatbot responses | United States (EU region available on request) | CNDP cross-border authorization; OpenAI DPF certification |
| WhatsApp Ireland Limited | WhatsApp Business Cloud API, message routing and delivery | Ireland (EU) | Meta SCCs; EU-US DPF (where applicable) |
| Meta Platforms Ireland Limited | Messenger and Instagram Messaging APIs for EEA end users | Ireland (EU) | Meta SCCs; intra-EEA processing |
| Meta Platforms, Inc. | Messenger and Instagram Messaging APIs for non-EEA end users | United States | Meta SCCs; EU-US DPF (where applicable); CNDP cross-border authorization |
| Amazon Web Services EMEA SARL (AWS) | Underlying cloud infrastructure, application hosting (compute), managed PostgreSQL database (RDS), object storage for documents / files / media (S3), and transactional email delivery (SES) for account verification, password reset and billing notifications | European Union regions (default) | Intra-EEA processing under AWS GDPR Data Processing Addendum; AWS Standard Contractual Clauses apply for any incidental transfer outside the EEA |
Changes to this list
We will update this page and notify subscribed customers at least 30 days before adding any new sub-processor that has access to personal data. Customers who object to a new sub-processor may terminate the affected portion of the Service for cause within that notice window.
Get update notifications
Email privacy@bedaki.com with subject "Subscribe: sub-processor updates" to be notified of additions or changes. privacy@bedaki.com