Sub-processors

This is the public list of sub-processors that Linqur B.V. engages as a processor. It is the list referred to in Schedule 1 and Schedule 4 of our Data Processing Agreement. Whenever the list changes, this page is updated on the same day the notification goes out to customers.

Two streams of processing

Primary processing takes place exclusively within Linqur’s production infrastructure, hosted in the Netherlands. Delivering SCORM Proxy, LTI Provider Service, Magic Link, Webhooks and the Linqur API needs no processing by any party outside that infrastructure.

Supporting processing only happens if you share personal data with us through a support channel, for example a ticket, an email or a customer call. That processing is incidental and starts at your initiative. You can limit or prevent it by not sending learner data through support channels, or by using pseudonymised data.

Categories of personal data

The table uses these categories.

Code	Category
A	Identification data: first and last name
B	Contact details: email address
C	Unique user identifiers: LMS user_id, LTI user_id, username
D	Learning results and progress: SCORM/xAPI statements, scores, completions, time spent, CMI values
E	Authentication tokens: single-use tokens granting access to a learning environment
F	Technical metadata: IP address, user agent, session logs, timestamps, platform URL

The sub-processors

Sub-processor	What it does and which data	Location	Outside the EEA
Rootnet B.V., Nijmegen, Netherlands	Hosting of the Linqur platform infrastructure: servers, database, application. Access to all categories.	Netherlands	No
Ldesign Media, The Hague, Netherlands	Application and custom development. Incidental access to production data during debugging, on request. Categories A to F.	Netherlands	No
n8n Cloud, n8n GmbH, Berlin, Germany	Workflow automation for the admin user provisioning flow only. Categories A, B and C for admin users. No learner data.	Germany, EU tenant in Frankfurt	No
Google Workspace, Google Ireland Limited, Dublin, Ireland	Office automation: Docs and Drive, for incidental processing of attachments from customer communication. Categories A and B, incidentally C and D.	Ireland, EU tenant	Limited, within Google’s own sub-processor chain, covered by EC SCCs and the EU-US Data Privacy Framework
Missive, Conversation Inc., Québec, Canada	Shared mail client for all @linqur.com mailboxes. Processes email metadata, message bodies and attachments. Categories A and B, incidentally C, D and F.	Canada	Yes, on the European Commission adequacy decision for Canada
ClickUp, mhelp.com Inc., San Diego, United States	Ticketing and quality records. Access to identification and contact data of learners and admin users through tickets you submit. Categories A, B and C, incidentally D in attachments.	United States	Yes, on the EU-US Data Privacy Framework and EC SCCs
Fathom Video Inc., San Francisco, United States	Recordings and transcripts of customer calls, in the context of onboarding, support and customer success. Categories A and B, incidentally D.	United States	Yes, on the EU-US Data Privacy Framework and EC SCCs

A data processing agreement is in place with every sub-processor in this list.

How changes are notified

We notify you in writing at least thirty calendar days before we engage a new or replacement sub-processor. That notification states the name and registered office of the sub-processor, a short description of the processing, the country of storage and processing, the transfer basis if the processing takes place outside the EEA, the categories of personal data involved, and a reference to the data processing agreement we concluded with that party. This page is updated at the same moment.

You have thirty calendar days from receipt to object in writing, with reasons. If we cannot resolve the objection together, you may terminate the main agreement to the extent it concerns the processing in question, at no cost.

If a change cannot wait because of security, continuity of service or mandatory law, we inform you without delay after the change, explain why it could not wait, and you keep the same right to object.

What we do not do

We do not apply automated individual decision-making within the meaning of Article 22 GDPR. We do not process personal data to train our own or third-party AI models. We process regular personal data only, and no special categories of personal data within the meaning of Article 9 GDPR.

Questions

Kristel Sijbers is our Security Officer and Privacy Officer. For questions about this list, a data subject request or an incident: privacy@linqur.com or +31 85 130 8108, Monday to Friday between 08:30 and 17:30.

Related pages: the Data Processing Agreement, our ISO 27001 and ISO 9001 certification and the privacy and security overview.