Sub-processors

Clokio uses the following third-party service providers (sub-processors) to help us deliver our services. All sub-processors are bound by Data Processing Agreements (DPAs) and comply with GDPR requirements.

Notice of Changes: We will notify customers at least 30 days before adding new sub-processors. You may object to new sub-processors by contacting us at support@matat.co.il.

Infrastructure & Hosting

Provider	Purpose	Location	Data Processed
Railway Corp. Privacy Policy	Application hosting & MySQL database	USA	All platform data (employees, attendance, leaves, projects)
DigitalOcean LLC (Spaces) Privacy Policy	Object storage for profile pictures, leave documents, task attachments, screen recordings	Frankfurt (EU)	User-uploaded files only (no relational data)

Communications

Provider	Purpose	Location	Data Processed
Mailgun (Sinch) Privacy Policy	Transactional emails	EU	Email addresses, names
Google Firebase (FCM) Privacy Policy	Mobile push notifications	USA	Device tokens, notification content
Pusher Channels (Pusher Ltd.) Privacy Policy	Realtime updates to the admin dashboard (attendance events)	EU (Ireland)	Organization id, employee name, event type — no personal payload beyond display name

Device Platform Services

Provider	Purpose	Location	Data Processed
Apple Inc. Privacy Policy	iOS app distribution, Face ID/Touch ID	USA	Biometric data (on-device only), app usage
Google LLC Privacy Policy	Android app distribution, biometric auth	USA	Biometric data (on-device only), app usage

International Data Transfer Safeguards

For sub-processors located outside the European Economic Area (EEA), we ensure adequate protection through:

EU-US Data Privacy Framework: For US-based processors certified under the framework
Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
Supplementary Measures: Additional technical and organizational measures where required

Questions?