Where Accadema acts as a processor for an institution, Article 28 GDPR requires a current list of sub-processors. This is that list, with categories, scope, and notice commitments.
Where Accadema acts as a processor for an institution, the institution is entitled under Article 28 of the GDPR to a current list of sub-processors used by Accadema, the categories of processing they perform, and their location. This page is the canonical version of that list.
Material changes to the sub-processor list — additions, removals, or change of location — are announced thirty days in advance. Institutions on contract receive the announcement through their local partner; the public version of this page is updated at the same time.
The cloud providers and managed-database operators that host the Accadema-hosted deployments. EU-based, EU-jurisdiction. Detail provided to institutions on contract under the data processing agreement.
Transactional email service for password reset, deposit notification and account state changes. EU-based, sender domain authenticated. No marketing emails are sent through this path.
Aggregated server-side error capture for the Accadema-hosted deployment. EU-based, configured to scrub personal identifiers from stack traces before transmission.
Accadema does not engage advertising networks, marketing analytics providers, customer data platforms, or content-syndication networks as sub-processors for the in-product surface. The marketing site CDN providers are dependencies for static asset delivery only and do not receive personal data from this site.
For client-hosted deployments, the institution operates the deployment and Accadema is not a processor. The institution selects and contracts its own infrastructure; Accadema provides the software.
Institutions on contract receive the institution-specific sub-processor list as an annexe to the data processing agreement, with the specific legal entities, EU member states of establishment, and the date each was engaged.
An institution can object to a proposed new sub-processor within the thirty-day notice window. Where an objection cannot be resolved, the institution can terminate the affected service with thirty days' notice and receive a pro-rata refund of pre-paid fees.