LUP Technologies AB (“LUP”, “we”, “us”, or “our”) uses certain sub-processors (including third parties, as listed below) and content delivery networks to assist it in providing the LUP Services, as described in our Terms of Service (“ToS”). Defined terms used herein shall have the same meaning as defined in the ToS.
When does LUP act as a Data Processor vs. a Data Controller?
- As a Data Processor: LUP processes personal data on behalf of customers (e.g., handling driver check-ins, managing logistics notifications).
- As a Data Controller: LUP determines how and why some personal data is processed (e.g., usage analytics, fraud prevention, security monitoring).
Customers using LUP’s services must ensure they have the appropriate legal basis for collecting and sharing data with us. Customers are responsible for informing their end users (e.g., drivers) that LUP processes their data as a sub-processor.
What is a Sub-processor
A sub-processor is a third party data processor engaged by LUP, including entities from within the LUP Group, who has or potentially will have access to or process Service Data (which may contain Personal Data). LUP engages different types of sub-processors to perform various functions as explained in the tables below.
Due Diligence & Compliance
LUP undertakes a commercially reasonable selection process to evaluate the security, privacy, and confidentiality practices of all sub-processors that may have access to or otherwise process personal data. We ensure that all sub-processors meet GDPR and other applicable data protection laws.
Data Transfers Outside the EEA:
Some of our sub-processors operate outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure adequate safeguards such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Binding Corporate Rules (BCRs) where applicable
- Encryption and other technical safeguards
A full list of sub-processors, their locations, and compliance measures is provided below.
Customer Rights Regarding Sub-Processors
Customers have the right to object to the engagement of new sub-processors if they believe it will negatively impact their compliance obligations. Customers may submit objections via email to support@lupnumber.com.
LUP will provide reasonable notice before engaging a new sub-processor. If a customer objects, LUP will work with the customer to find a resolution, which may include discontinuing the use of the service.
List of sub-processors
LUP owns or controls access to the infrastructure that LUP uses to host and process Service Data submitted to the Services, other than as set forth herein. Currently, the LUP production systems used for hosting Service Data for the Services are located in co-location facilities in the United States and Europe and in the infrastructure sub-processors listed below. Subscriber accounts are typically established in one of these regions based on where the Subscriber is located, but may be shifted among locations to ensure performance and availability of the Services. The following table describes the countries and legal entities engaged by LUP in the storage of Service Data. LUP also uses additional services provided by these sub-processors to process Service Data as needed to provide the Services.
| Company and Location | Data-processing | Legal references |
|---|---|---|
| Amazon Web Services, Inc., United States (Frankfurt Data Centers Used) | Server and storage hosting for cloud-based applications and data storage solutions. AWS provides infrastructure for processing and storing data securely, ensuring high availability, redundancy, and compliance with security standards such as ISO 27001, SOC 1, SOC 2, and SOC 3. | AWS offers a GDPR-compliant AWS Data Processing Addendum (AWS DPA) that incorporates AWS’s commitments as a data processor, including Standard Contractual Clauses. |
| 46elks AB, Sweden | SMS notifications to drivers, two-way communication, and automated calls for real-time updates and alerts. | 46elks operates under Swedish telecom regulations (LEK / PTS). Documented as data controller for SMS and telephony services. |
| Google LLC, United States | Google Analytics, Google Ads / remarketing, and Google reCAPTCHA for analytics, advertising, and form protection. | Processed under Google Ads Data Processing Terms, Google Privacy Policy, and related partner policies. |
| Loopia AB, Sweden | DNS and nameserver hosting for reliable domain resolution and secure management of web services. | Operates under Swedish and EU data protection laws; General Terms include GDPR compliance. |
| Microsoft Corporation, United States | Microsoft Clarity for website analytics, session recording, and heatmaps. | Complies with GDPR; see Microsoft Clarity Security and Privacy FAQs and Terms of Use. |
| LinkedIn Corporation, United States | Business networking, advertising, and analytics via LinkedIn Ads and Insights. | LinkedIn Data Processing Agreement and Privacy Policy. |
| HubSpot, Inc., United States (Data processed and stored on EU servers) | CRM, marketing automation, email campaigns, and analytics. | HubSpot Data Processing Agreement (DPA) and Privacy Policy. |
| 365id AB, Sweden | Identity verification and document scanning for secure driver check-ins. | Processes data in compliance with GDPR; see 365id Privacy Policy. |
| Meta Platforms, Inc. (Facebook), United States | Facebook Ads, remarketing, and audience engagement; Facebook Pixel for campaign optimization. | Meta Data Processing Terms and Facebook Privacy Policy. |
| Gartner, Inc., United States | Industry research, market analysis, and benchmarking. | Gartner Privacy Policy and applicable GDPR practices. |
Content Delivery Networks
As explained above, our Services may use content delivery networks (“CDNs”) to provide the Services, for security purposes, and to optimize content delivery. CDNs do not have access to Service Data but are commonly used systems of distributed services that deliver content based on the geographic location of the individual accessing the content and the origin of the content provider. Website content served to website visitors and domain name information may be stored with a CDN to expedite transmission, and information transmitted across a CDN may be accessed by that CDN to enable its functions.
Changes
These Terms will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on our website.
If you have any questions about these Terms, please contact us at support@lupnumber.com