Sub-Processors
Last updated: 2026-05-19
ActiveDonor engages the sub-processors listed below to help deliver the Service. We have a Data Processing Agreement (or equivalent contractual safeguard) in force with each one, consistent with POPIA and, where applicable, GDPR.
Sub-processors marked (opt-in) are only engaged when the NPO chooses to enable the relevant feature. Where the integration additionally requires the NPO to connect their own account with the vendor (Mailchimp, Paysoft), the NPO maintains the primary relationship with the vendor, this is shown in the DPA column as NPO-controlled.
Tier 1: Donor data sub-processors
These services may process donor personal data.
| Sub-processor | Purpose | Data processed | Country | DPA |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure | Donor and account data at rest and in transit | South Africa (Region: Cape Town) | Yes |
| Functional Software, Inc. (Sentry) | Error monitoring | Application logs and request metadata | United States | Yes |
| The Rocket Science Group LLC (Mailchimp) (opt-in) |
Email marketing | Email address and contact name | United States | NPO-controlled |
| Paysoft Holdings (Pty) Ltd (opt-in) |
Debit-order collections | Bank account and mandate data | South Africa | NPO-controlled |
| OpenAI, L.L.C. (opt-in) |
AI provider | Sample rows from uploaded files. Data is anonymised, so no charity identifiers are sent. Not used to train OpenAI’s models. | United States | Yes |
Tier 2: Operational sub-processors
These services process data about our NPO customers (the account holder and their staff), not donors.
| Sub-processor | Purpose | Data processed | Country | DPA |
|---|---|---|---|---|
| Bento Software Inc. | Product analytics and lifecycle email | NPO user contact and usage data | United States | Yes |
| Paystack Payments (Pty) Ltd | Payment processing | Payment and transaction data | South Africa | Yes |
| Xero Limited | Accounting integration | VAT Invoice and Billing data | Australia / New Zealand | Yes |
| Twilio Inc. (Segment) | Product analytics | Application user activity events | United States | Yes |
| Mixpanel, Inc. | Product analytics | Application user activity events | United States | Yes |
| Celonis SE (Make.com) | Workflow automation | Account event data | European Union | Yes |
| Crisp IM SARL | Live chat support | Customer support chats | France | Yes |
| Google LLC | Conversion tracking and tag management | Visitor activity on marketing and authenticated app | United States | Yes |
| Roxr Software Ltd (Clicky) | Website analytics | Visitor activity on marketing pages | United States | Yes |
| Optimizely, Inc. | Marketing-site experimentation | Visitor activity on marketing pages | United States | Yes |
Regulatory disclosures
ActiveDonor also transmits data to the following entity, which is not a sub-processor but is listed here for full transparency.
South African Revenue Service (SARS)
Where an NPO designates ActiveDonor as its submitting entity for Section 18A tax certificates, we submit the required IT3(d) data to SARS on the NPO’s behalf. This is a legal disclosure to a regulator under the Income Tax Act, not a sub-processing arrangement. SARS is the controller of the data once received, and the submission is a statutory obligation of the NPO that ActiveDonor facilitates.
- Data submitted: Section 18A donation records and donor identifiers required by SARS (donor name, ID/tax number, donation amount, certificate number).
- When: Only when the NPO has appointed ActiveDonor as its submitting entity and has issued Section 18A certificates during the reporting period.
- Jurisdiction: South Africa.
Changes and notifications
We will update this page when we add, replace or remove a sub-processor. NPOs with an active subscription can request to be notified of changes by emailing [email protected].
