1. Purpose
This Subprocessor List identifies material third-party providers and subprocessors used by DXBMARK to deliver services, operate its website, process payments, schedule meetings, provide support, host infrastructure, deploy software, manage CRM and project workflows, and process customer-related data.
This list supports DXBMARK's Privacy Policy, Data Processing Agreement, Cookie Policy, Security Statement, and SLA / Support Policy. Provider use may vary depending on the service, customer project, infrastructure requirements, payment method, customer location, written agreement, and technical configuration.
2. Scope
This list may apply where DXBMARK:
- Processes personal data as a processor on behalf of a B2B customer
- Uses service providers to support controller activities described in the Privacy Policy
- Provides SaaS, hosting, support, development, automation, integration, CRM, dashboard, portal, or website services
- Uses third-party platforms for payments, meetings, support, analytics, consent management, deployment, communication, or infrastructure
Not every provider listed is used for every customer or service.
3. Active Providers
| Provider | Service category | Purpose | Data categories | Role | Location / transfer notes | Legal / privacy / DPA documentation | Status | Used for | Notes |
|---|---|---|---|---|---|---|---|---|---|
| Zoho | CRM, accounting, invoicing, project management, business administration | Customer records, invoicing, billing, CRM, project workflows, business records | Contact details, company data, invoice records, billing records, project notes, communications | Service provider / subprocessor where applicable | Global / depends on Zoho account and data center settings | Zoho privacy, security, and data processing documentation | Active | CRM, accounting, project management, business administration | Specific Zoho products may include Zoho CRM, Zoho Books, Zoho Projects, or similar tools |
| Stripe | Payment processing | Card payments, checkout, payment links, subscriptions, invoicing payments, fraud prevention, disputes | Billing details, payment metadata, card metadata, transaction records, fraud signals, contact details | Payment processor / service provider | Global / subject to Stripe terms and transfer mechanisms | Stripe privacy policy and data processing terms | Active | Payments, subscriptions, invoices, checkout, fraud prevention | DXBMARK does not store full card numbers or CVV codes |
| PayPal | Payment processing | PayPal checkout, payment authentication, transaction processing, fraud prevention, disputes | Billing details, payment metadata, transaction records, account identifiers, fraud signals | Payment processor / service provider | Global / subject to PayPal terms and transfer mechanisms | PayPal privacy and legal documentation | Active | Payments and checkout where enabled | Availability may vary by country, currency, risk review, and service type |
| Cookiebot by Usercentrics | Consent management | Cookie banner, consent records, cookie declaration, preference management, consent withdrawal | Consent choices, timestamps, IP address, user agent, cookie preferences, policy version | Service provider / subprocessor where applicable | Global / EU and international transfers may apply depending on configuration | Cookiebot/Usercentrics privacy and DPA documentation | Active | Cookie consent and preference management | Actual cookie inventory should be maintained through Cookiebot scan and declaration functionality |
| Tawk.to | Live chat, chatbot, support, ticketing | Live chat, chatbot assistance, support routing, ticketing, customer service communications | Name, email, phone, company name, chat messages, support issue details, timestamps, technical metadata, attachments | Service provider / subprocessor where applicable | Global / depends on provider infrastructure | Tawk.to privacy and data processing documentation | Active | Support, chat, chatbot, ticketing | Use may depend on website configuration and consent settings |
| Calendly | Scheduling | Meeting booking, consultation scheduling, reminders, calendar invitations, availability management | Name, email, phone, company name, role, meeting time, time zone, meeting notes, calendar metadata | Service provider / subprocessor where applicable | Global / subject to Calendly terms and transfer mechanisms | Calendly privacy and DPA documentation | Active | Booking consultations, meetings, discovery calls, support sessions | Use may depend on service and scheduling workflow |
| Google Meet | Video meetings and communication | Remote meetings, consultations, support sessions, project calls | Contact details, meeting metadata, chat content, recordings where enabled and consented | Service provider / subprocessor where applicable | Global / subject to Google terms and transfer mechanisms | Google privacy and workspace documentation | Active | Video meetings and remote service delivery | Meeting recordings should be used only where enabled and consented |
| Cloudflare | DNS, CDN, security, bot protection | DNS management, CDN, DDoS protection, bot protection, web security, traffic routing | IP address, request logs, security events, device/browser metadata | Service provider / subprocessor where applicable | Global edge network | Cloudflare privacy, security, and DPA documentation | Active | DNS, CDN, security, performance, bot protection | Use depends on domain and infrastructure configuration |
| Vercel | Hosting, deployment, application platform | Website and application hosting, deployments, previews, serverless functions, platform logs | Hosted content, deployment metadata, logs, IP addresses, technical metadata, application data where applicable | Service provider / subprocessor where applicable | Global / region depends on configuration | Vercel privacy, security, and DPA documentation | Active | Hosting, deployments, previews, applications | Use depends on project architecture and written agreement |
| GitHub | Code repository, issue tracking, CI/CD | Private repositories, version control, project issues, code review, deployment workflows | Code, commits, usernames, emails, issues, project files, technical logs | Service provider / subprocessor where applicable | Global / subject to GitHub terms and transfer mechanisms | GitHub privacy and data protection documentation | Active | Source code, repositories, issues, CI/CD | Customer access depends on written agreement and payment status |
| MWHEBA LTD / MWHEBA Creative Agency | Hosting, infrastructure, web services, operational support | Hosting coordination, managed infrastructure, web services, deployment support, technical infrastructure services | Hosted content, application data, logs, backups, technical metadata, account data where applicable | Service provider / infrastructure partner / subprocessor where applicable | Depends on selected infrastructure and service arrangement | Provider documentation or written agreement applies | Active | Hosting, VPS, managed infrastructure, deployment, support where agreed | DXBMARK is responsible only for services it expressly agrees to manage in writing |
| Google services, where enabled | Analytics, search, tags, productivity, email, meeting, documents | Google Search Console, Google Analytics, Google tags, email, documents, calendar, productivity, measurement where enabled | IP address, device/browser data, page views, search and performance data, email content, calendar metadata, documents, contact records | Service provider / subprocessor where applicable | Global / subject to Google terms and transfer mechanisms | Google privacy, data processing, and product documentation | Active where enabled | Search performance, analytics, tags, business productivity, meetings | Analytics and marketing tags should respect consent settings where required |
4. Potential or As-Needed Providers
| Provider | Service category | Purpose | Data categories | Role | Location / transfer notes | Legal / privacy / DPA documentation | Status | Used for | Notes |
|---|---|---|---|---|---|---|---|---|---|
| Zoom | Video meetings and webinars | Remote meetings, consultations, support calls, webinars | Contact details, meeting metadata, chat content, recordings where enabled and consented | Service provider / subprocessor where applicable | Global | Zoom privacy and DPA documentation | Potential / as needed | Meetings and support | Used only if selected for a service or meeting |
| Contabo | Hosting and infrastructure | VPS, servers, hosting infrastructure, backups, deployment | Hosted content, server logs, IP addresses, application data, backups, technical metadata | Hosting provider / subprocessor where applicable | Depends on selected region | Contabo privacy and legal documentation | Potential / as needed | Hosting, VPS, infrastructure | Use depends on written agreement and infrastructure design |
| Hostinger | Hosting and domain services | Hosting, domains, DNS, email, web infrastructure | Hosted content, domain records, DNS records, logs, account data, technical metadata | Hosting/domain provider / subprocessor where applicable | Depends on selected service and region | Hostinger privacy and legal documentation | Potential / as needed | Hosting, domains, DNS, email | Use depends on customer or project requirements |
| GoDaddy | Domain, DNS, hosting, email | Domain registration, DNS, hosting, email, SSL, business services | Domain records, contact details, DNS records, account data, technical metadata | Registrar / hosting provider / subprocessor where applicable | Global | GoDaddy privacy and legal documentation | Potential / as needed | Domains, DNS, hosting, email | Domain and renewal terms are subject to provider rules |
| Namecheap | Domain, DNS, hosting, email | Domain registration, DNS, hosting, email, SSL | Domain records, contact details, DNS records, account data, technical metadata | Registrar / hosting provider / subprocessor where applicable | Global | Namecheap privacy and legal documentation | Potential / as needed | Domains, DNS, hosting, email | Domain and renewal terms are subject to provider rules |
| Tasjeel.ae | Domain registration and DNS | UAE domain registration, DNS management, domain services | Domain records, registrant contact details, DNS records, account data | Registrar / domain provider / subprocessor where applicable | UAE / provider locations may apply | Tasjeel.ae privacy and legal documentation | Potential / as needed | Domains and DNS | Used where customer or project requires supported domain services |
| Other domain, hosting, infrastructure, email, support, analytics, or deployment providers | Business and technical services | Service delivery under a written agreement | Data categories depend on the service | Service provider / subprocessor where applicable | Depends on provider and selected region | Provider documentation applies | Potential / as needed | Customer projects, hosting, email, support, analytics, deployment | Used only where required by service scope, customer instruction, or written agreement |
5. Provider Changes
DXBMARK may update this Subprocessor List from time to time as services, infrastructure, providers, payment methods, tools, customer needs, legal requirements, and business operations evolve.
For active B2B customers where DXBMARK acts as processor and where required by applicable law or written agreement, DXBMARK will provide reasonable notice of material new subprocessors or material changes to subprocessors.
Customers may object to a new material subprocessor on reasonable data protection grounds within the objection period stated in the applicable agreement or notice.
6. Customer-Specific Providers
Some providers may be selected, owned, controlled, or instructed by the customer. Where a customer owns or controls a provider account, the customer is responsible for:
- Maintaining its own account terms and compliance
- Managing billing and renewal where applicable
- Maintaining access controls and authorized users
- Ensuring lawful data processing
- Reviewing the provider's terms, privacy notices, security commitments, and data processing terms
DXBMARK is responsible only for third-party providers that DXBMARK expressly agrees to manage in writing.
7. Relationship to Other Policies
This Subprocessor List should be read with:
- Privacy Policy Section 7
- Data Processing Agreement Section 7 and Annex B
- Cookie Policy
- Security Statement
- SLA / Support Policy
- Any applicable proposal, invoice, statement of work, service plan, or written agreement
8. Contact Information
For privacy or subprocessor questions, contact:
Privacy enquiries: privacy@dxbmark.com Legal enquiries: legal@dxbmark.com Support: support@dxbmark.com Website: https://www.dxbmark.com
End of Subprocessor List