Sub-processors

These run under Gochi's own account or app with the provider, and receive data only when a customer uses the feature named.

A customer can connect Gochi to providers it has its own account with. Those providers act for the customer, under the customer's own agreement with them, and receive data only when the customer connects them. We list them so it is clear where data goes:

• SMS providers: Twilio, Clickatell, SMSPortal, BulkSMS. Phone numbers and message text, to send and receive SMS.
• Payment gateways: Payfast, Yoco, Peach Payments, Ozow, Paystack, SnapScan, iKhokha. Invoice amounts and references, and sometimes the payer's name and email, so the customer's clients can pay online. Card details are entered on the gateway's own page.
• Debit orders and bank feeds: Netcash, Investec, Stitch. Debit order mandates with the client's name and contact details; bank transactions read into Gochi.
• Couriers: Bob Go, The Courier Guy, Shiplogic. The recipient's name, phone number, email and delivery address, to book deliveries.
• Online stores: Shopify, WooCommerce, Takealot. Orders and customers read into Gochi; stock levels and order status sent back.
• Accounting: Sage, Xero, QuickBooks, Microsoft Business Central. Invoices, credit notes, payments and client names and email addresses, kept in step.
• Phone systems and recording storage: PBXware, 3CX and others. Numbers dialled and call records; call recordings read from the customer's own storage when played.
• Email marketing: SendGrid, Mailchimp. Recipients' email addresses, message content and opt-in status, for the customer's campaigns.
• Review sites: Trustpilot, Hellopeter, App Store, Google Play, G2, Judge.me, Trusted Shops, Feefo, REVIEWS.io, Yotpo. Reviews read into Gochi, and the replies the customer writes.
• Microsoft Teams (Workflows webhooks). Short summaries of the events the customer chooses, posted into its Teams channels.
• Webhooks and automation tools the customer sets up. Whatever events and fields the customer chooses to send to its own addresses.
• Security tools: Microsoft Defender, SentinelOne, Sophos, ESET, Bitdefender, Huntress, Acronis. Alerts read into Gochi, which can name devices and their users.
• Systems the customer moves away from (for example HubSpot, Salesforce, Zendesk, ConnectWise, Datto RMM, Trello). Gochi only reads from them, to bring the customer's own data in.

Gochi also calls the following services, which receive no personal data, so they are not sub-processors:

• Frankfurter (European Central Bank reference rates). Currency codes, for exchange rates.
• NIST National Vulnerability Database, CISA Known Exploited Vulnerabilities, OSV.dev. Software product names and versions, to check for known vulnerabilities.
• Domain registries (RDAP and WHOIS) and WordPress.org. Domain names and version checks, for website audits.
• Let's Encrypt. Domain names, for security certificates.
• Afrihost. Gochi's domain name records.

Customers give general written authorisation for us to engage the sub-processors listed above, in line with Article 28(2) of the GDPR. Before we add or replace a sub-processor we will update this page and notify account holders by email at least 30 days in advance.

You may object to a new sub-processor within 30 days of that notice by emailing welcome@gochi.tech with your reasons. We will work with you in good faith to find an alternative. If we cannot reasonably accommodate the objection, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees for the unused period.

We remain fully liable to you for the performance of each sub-processor's obligations, as required by Article 28(4) of the GDPR, and we impose terms on them that are no less protective than those we owe you, including in respect of onward transfers as section 72 of POPIA requires.

See our Privacy Policy, Terms of Service and security page. A data processing addendum incorporating the EU Standard Contractual Clauses is available from welcome@gochi.tech.