List of Processors
Last updated: 17 August 2026
This page is the public register referenced by our Privacy Policy. It lists the third parties that process personal data on behalf of SalesTim, trading as nBold, so you can see who is involved in delivering the service before you entrust us with data.
The data controller is SalesTim, Registration No. 898 922 638 RCS Paris, 231 rue Saint-Honoré, 75001 Paris, France.
Processors for the nBold application
These parties are involved in running the nBold application and may process personal data held in it.
| Processor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Cloud infrastructure for the nBold application — production databases, object storage, backups and key management. | France | Data stays in the EU; no transfer mechanism required. |
| Microsoft Entra ID and Microsoft Graph (Microsoft Corporation) | Identity and authentication — nBold stores no passwords — and the Microsoft 365 APIs the product operates on, under the consent granted by your administrator. | Your own Microsoft 365 tenant region | Microsoft’s data protection terms, including Standard Contractual Clauses where applicable. |
| Cloudflare, Inc. | TLS termination, content delivery, DDoS protection, and bot protection on our forms (Turnstile). | Global edge network; company established in the United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| GitHub, Inc. | Source-code hosting, CI/CD and security alerting. GitHub does not process customer personal data; it is listed because it is a critical-tier vendor under our Third-Party Management Policy. | United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
Microsoft Azure is the only subservice organization named in our SOC 2 Type II report.
Processors for billing and payments
| Processor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Chargebee | Subscription billing and invoicing. Card details are passed directly to our payment processor and never travel through nBold servers; we retain only the last four digits of the card and the billing address, as described in the Privacy Policy. | European Union | Data stays in the EU; no transfer mechanism required. |
Processors for our website, marketing and support
These parties process data from visitors to nbold.com and from people who contact us. They have no access to data held in the nBold application. Analytics and marketing trackers are set only if you accept them — you can change your choice at any time via Cookie preferences.
| Processor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| HubSpot, Inc. | Customer relationship management — the contact and demo request forms on this website. | United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| Google (Google Ireland Limited / Google LLC) | Google Analytics 4 web analytics and Google Ads conversion measurement, subject to your consent. | European Union and United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| LinkedIn (Microsoft Corporation) | Advertising and conversion tracking, subject to your consent. | United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| Intercom, Inc. | Support conversations and the nBold Success Center knowledge base. | United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. |
How we manage processors
Our Third-Party Management Policy governs how parties reach this list and how they stay on it:
- Due diligence before engagement. We review a prospective processor’s security posture — certifications, public security documentation and incident history — and assess the risk it introduces.
- Contractual coverage. A data processing agreement, security commitments, audit rights and breach notification terms are in place before any data is shared.
- Publication before go-live. A processor handling personal data is added to this page before it begins processing.
- Ongoing review. Critical and high-tier processors are reviewed at least annually. A vendor breach, a change in service, a change in the vendor’s own subprocessors, or a change in certification status triggers an out-of-cycle review.
- Removal on termination. When an engagement ends, data held by the processor is deleted under our Data Disposal Policy, credentials are revoked or rotated, and the processor is removed from this page.
Changes to this list
We update this page when a processor is added or removed. Where we are contractually required to notify customers of a change, we do so.
If you have questions about this list, a specific processor, or our data processing agreement, email us at privacy@nbold.com.