Sub-processors

Used across our own business operations, including enquiries submitted through this website.

«TBC — this list must be completed with the real vendor names, purposes and processing regions before launch. An inaccurate sub-processor list is a compliance finding in its own right. The entries below are the categories to fill in, not confirmed vendors.»

• —Cloud hosting and infrastructure — serving this website and our internal systems — region: «TBC».
• —Transactional email delivery — sending enquiry acknowledgements and operational mail — region: «TBC».
• —CRM and enquiry management — storing and routing commercial enquiries — region: «TBC».
• —Productivity and collaboration suite — internal email, documents and scheduling — region: «TBC».
• —Error monitoring and application logging — diagnosing faults — region: «TBC».

On sovereign and carrier engagements the sub-processor chain is defined per contract and is frequently narrower than the corporate list — in-country hosting only, no external monitoring egress, and no third-party analytics. Where a deployment runs inside a client's own estate there may be no sub-processor at all.

The authoritative list for an engagement is the annex to its Data Processing Addendum.

We notify clients in advance of adding or replacing a sub-processor that touches their personal data, with enough notice to object on reasonable data-protection grounds. To be added to the notification list, email dpo@auralink.ae with the contracting entity name.

Where a sub-processor processes data outside the originating jurisdiction, the transfer is covered by an adequacy decision where one applies, and otherwise by Standard Contractual Clauses supported by a transfer impact assessment. Copies are available to clients on request.