Subprocessors

1. What are subprocessors

Subprocessors are third-party service providers that process personal data on behalf of Inventorygram under contract. Unlike data controllers who determine how data is processed, subprocessors act as data processors and only handle data according to Inventorygram's written instructions.

Subprocessors may process data including customer names, email addresses, payment information, transaction history, business data, and usage analytics. Each subprocessor is restricted to processing data only for the specific service they provide and is contractually obligated to implement appropriate security measures and comply with applicable data protection laws.

2. Current subprocessors

Inventorygram currently uses the following subprocessors to support our operations. This list is current as of May 20, 2026.

Note: This list may be updated as we add or modify services. For the most current list of subprocessors, please refer to this page or contact us at privacy@inventorygram.com.

3. Why we use subprocessors

Inventorygram uses subprocessors for operational necessity and to provide a secure, reliable service. Specifically:

• Payment processing: Flutterwave and Paystack provide secure payment processing, fraud detection, and transaction settlement. As a Nigerian-based platform, these processors provide localized payment solutions and regulatory compliance.
• Infrastructure and hosting: Namecheap provides domain management, DNS services, and hosting infrastructure that supports our platform's availability and performance.
• Service reliability: Using specialized service providers ensures that critical functions (payments, hosting, communications) are handled by experts with appropriate security certifications and redundancy.
• Regulatory compliance: Our subprocessors are selected based on their compliance with applicable data protection regulations including GDPR, UK GDPR, Swiss FADP, and Nigerian NDPR.

4. Data protection safeguards

Inventorygram implements robust safeguards to ensure that subprocessors protect your data appropriately:

• Contractual obligations: All subprocessors are bound by Data Processing Agreements (DPAs) that require them to implement appropriate technical and organizational security measures consistent with this policy.
• Limited data access: Subprocessors receive only the minimum personal data necessary to perform their designated function. They do not receive access to data beyond what is required for their service.
• Security standards: We select subprocessors that maintain industry-standard security certifications (ISO 27001, SOC 2 compliance, etc.) and implement encryption, access controls, and audit logging.
• Confidentiality: Subprocessors are contractually prohibited from disclosing your data to unauthorized parties or using it for any purpose other than providing the contracted service.
• Restricted transfers: Any further transfers of data (to sub-subprocessors) require prior written approval from Inventorygram and the data controller.
• International safeguards: For subprocessors located outside the EU/UK/Switzerland, we implement Standard Contractual Clauses (SCCs) and other mechanisms to ensure adequate data protection levels.

5. Subprocessor agreements

Each of our subprocessors operates under a Data Processing Agreement (DPA) or similar contract that includes:

• A requirement to process personal data only on Inventorygram's documented instructions;
• Implementation of appropriate technical and organizational security measures;
• Confidentiality obligations for all personnel with access to personal data;
• Commitment to assist with data subject rights requests (access, deletion, rectification);
• Right for Inventorygram to audit and inspect security and compliance measures;
• Obligation to notify Inventorygram of any data breach or security incident;
• Agreement to delete or return personal data upon contract termination;
• Provisions for sub-subprocessor approval and accountability.

These agreements are reviewed regularly to ensure continued compliance with applicable data protection laws.

6. Changes and notification

Inventorygram may add, remove, or replace subprocessors as our business evolves and our needs change. When we make changes to our subprocessors, we will:

• Provide notice: We will update this page with the new subprocessor information and updated effective date;
• Advance notification: For material changes that may affect data protection, we will provide notice via email to registered customers at least 30 days before the change takes effect;
• Maintain standards: Any new subprocessor will be required to meet the same data protection standards and contractual obligations as our existing subprocessors;
• Data transfer safeguards: Any transition of data to a new subprocessor will be conducted securely and only with appropriate authorization;
• Objection rights: If a material change affects you, you may object to the addition of a new subprocessor by contacting privacy@inventorygram.com within 30 days.

Critical subprocessors (payment processors, data hosting providers) are unlikely to change frequently, but any changes will be communicated promptly.

7. Contact us

If you have questions about our subprocessors, concerns about data protection, or requests for additional information about a specific processor, please contact us:

• Email: privacy@inventorygram.com
• Data Protection Officer: dpo@inventorygram.com
• Legal inquiries: legal@inventorygram.com

We will respond to subprocessor inquiries and data protection concerns within 30 days.