Skip to content
English
Contact us
Go to become.education
  • There are no suggestions because the search field is empty.

BECOME Sub-Processor Register

Introduction

BECOME uses a small number of carefully selected third‑party service providers (“sub‑processors”) to help us deliver, support, and secure our services. These providers may process personal information strictly on our behalf and only in accordance with our instructions.

This page lists each active sub‑processor, the purpose for which they are engaged, the categories of data they may process, and the countries in which data may be stored, processed, or accessed. We update this register whenever changes occur, and we notify customers in advance of any additions or data‑location changes.

Active Sub Processors

Sub-Processor Nature and Purpose of Processing Categories of Personal Data Location of Processing Security Measures
Hubspot, Inc.
CRM, communications, support management
Staff contact details, school contacts, support interactions, planning/admin metadata

Sydney, Australia (AWS)

Backups: US (Virginia, Oregon), EU (Germany), Canada (Montreal)
SOC 2, SOC 3; ISO 27001 via AWS

https://trust.hubspot.com/
Xero Ltd Accounting & Invoicing Billing contact, orgaisation details, payment /invoice history United States (AWS)
ISO/IEC 27001:2022, SOC 2 Type II, PCI‑DSS
Thinkific Labs Inc Learning Management System used for some professional learning Staff names, emails, course participation United States (AWS and GCP) 

SOC 2 Type 1 https://www.thinkific.com/security-overview/
Twilio SendGrid, Inc System generated email delivery and event tracking Staff emails, school contacts, email metadata, transactional notifications

United States 

SOC 2 via Twilio

https://security.twilio.com/

Countries Where Data May Be Disclosed

Due to the infrastructure of our sub‑processors, personal information may be stored or accessed from the following countries:

  • Australia
  • United States
  • Canada
  • Germany (EU)
  • Singapore (where applicable for regional failover)

When personal information is transferred internationally, we implement contractual and technical safeguards including encryption, access controls, regional hosting options where possible, and GDPR‑compliant transfer mechanisms.

Advance Sub‑Processor Change Notifications

We provide customers with at least 30 days’ notice before:

  • adding a new sub‑processor
  • changing the purpose for which a sub‑processor is used
  • changing the primary data‑hosting region for a sub‑processor

Notifications are sent via our subscription list and posted on this page. To receive advance notifications of changes, including new sub-processors, you can subscribe here.

Change Log

Date Change Effective Date Notification Issued
30.3.2026 Added Sub‑Processor Register page including Hubspot, Xero, SendGrid and Thinkific 30.3.2026 N/a