Sub-processors

This page lists the third parties that Shog Consulting (FZC) uses to run Shog Corporate Training and that may process personal data on our behalf. It is for customer organisations reviewing the service, and it forms part of the Data Processing Agreement.

The list

We would rather tell you that a region is not fixed than invent one. Where a region above is uncertain, it is uncertain because the answer depends on a provider's configuration or on your own tenant, and you are better placed than we are to establish it for your tenant.

Which of these apply to you

Two of them always apply. Oracle Cloud Infrastructure hosts the service, and Microsoft delivers the transactional email that carries magic links, one-time codes, enrolment notices and reminders. Stripe applies whenever you pay us.

The rest depend on choices you make:

• Connected storage. Microsoft SharePoint or OneDrive, and Google Drive, are engaged only if an administrator connects one of them during setup. Only one provider can be connected per organisation. Once connected, certificates, identity photographs and signed declarations are written to your storage and not to ours.
• Provider sign-in. Google and Microsoft act as identity providers only where your administrators choose to sign in with them. Learners never use them, because learners sign in with a private emailed link and a one-time code rather than a password.

If you connect no storage and your administrators use email and password sign-in, then Google is not engaged at all, and Microsoft is engaged only for email delivery.

What each one does and does not receive

Oracle Cloud Infrastructure holds everything we hold: the platform database, your organisation's own database, the key vault, and our object storage of course material. It does not hold your certificates or your staff's identity evidence, which are written to the storage you connect. Learner names, email addresses and phone numbers are encrypted at rest with per-organisation keys before they reach storage.

Stripe receives your billing contact and payment details. It does not receive learner records.

Microsoft, for email delivery, receives the recipient address and the content of the message we send, which includes the learner's name and the link or code. Where you have connected SharePoint or OneDrive, Microsoft holds the files you have asked us to write to your own tenant.

Google, where you have connected Drive, holds the files we write to your own tenant. Where an administrator signs in with Google, Google confirms that person's identity to us.

Changes to this list

We may add or replace a sub-processor. Before doing so we will:

• give the account contacts at least 30 days' notice by email, and
• update this page.

Keep your account contacts current, because that email address is where the notice goes.

Your right to object

You may object to a new or replacement sub-processor on reasonable data protection grounds within the 30-day notice period, by writing to training@shogconsulting.com and telling us the grounds.

We will try to resolve the objection, for example by describing a control that answers your concern or, where practical, by offering a configuration that does not use that sub-processor. If we cannot resolve it, you may terminate the affected part of your subscription and receive a pro rata refund of the fees you have paid for the unused part of the term. That is the remedy available; there is no further liability for us on this point.

Our responsibility for them

We remain responsible to you for the performance of each sub-processor's data protection obligations, and we put terms on each of them that are no less protective than those in our Data Processing Agreement with you.

Nothing on this page changes who controls the data. You remain the controller of your learners' personal data, and we remain the processor.

Questions about this list go to training@shogconsulting.com.