Overview
When an organisation uses OneTaskList, OneTaskList Pty Ltd processes its people’s data on its behalf under our Data Processing Agreement (DPA). The companies below help us do that. Each works only on our instructions, under a written contract with data protection terms at least as strict as our DPA. We stay responsible for them.
Our sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Microsoft (Azure) | Hosting, databases, storage, logs, encryption keys, and sending service emails | The region you choose, with backups in its paired region. Sign-in runs in the EU for every region. |
| Microsoft (Microsoft 365) | Alerts to our team about new sign-ups and feedback (name, email address and region) | Australia |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Delivering notifications, only for people who turn them on. Their browser picks the service. | Each service’s own infrastructure |
Where your data is stored
Your organisation chooses a region. Its accounts, connections, tasks and technical logs are stored there, on Microsoft Azure.
| Region | Location | Backup copy |
|---|---|---|
| EU | Netherlands | Ireland |
| UK | London | Cardiff |
| US | Virginia | California |
| Australia | Melbourne | Sydney |
Our team works from Australia and may access data from there to support the service. That access, and any transfer out of the EU or UK, is covered by the European Commission’s Standard Contractual Clauses and the UK Addendum, as set out in the DPA.
Who isn’t a sub-processor
- Tools your people connect, such as Jira, Slack or Microsoft 365. They act under your organisation’s or your users’ own agreements with them.
- AI providers your people choose with their own keys. Requests go from the browser straight to the provider, not through our servers.
- Microsoft, when OneTaskList runs in your own Azure subscription. Microsoft is then your processor for that hosting, not ours.
Changes to this list
We give customers at least 30 days’ notice before adding or replacing a sub-processor, by email to their contact and by updating this page. A customer can object on reasonable data protection grounds within that time, as the DPA describes. To get notices, email privacy@onetasklist.com.
Questions about this page? Contact us at legal@onetasklist.com.