Sub-processors

This page lists the third parties that Shog Consulting (FZC) uses to run Shog Consulting & Corporate Training and that may process personal data on our behalf. It is for customer organisations reviewing the service, and it forms part of the Data Processing Agreement.

The list

We would rather tell you that a region is not fixed than invent one. The two that are not fixed follow your own Microsoft or Google account, which you can check and we cannot.

Which of these apply to you

One of them always applies. Oracle Cloud Infrastructure runs the service and sends the emails that carry sign-in links, one-time codes, enrolment notices and reminders. Stripe applies whenever you pay us.

The rest depend on choices you make:

• Ask Shog. OpenAI processes a question only when you submit it to the workspace assistant. Opening the drawer or reading Guides does not call OpenAI. Do not paste credentials or confidential information. Shog retains operational metadata for 30 days, not conversation text. Responses are requested with storage disabled; OpenAI's applicable abuse-monitoring retention still applies.

• Connected storage. Microsoft SharePoint or OneDrive, and Google Drive, are engaged only if an administrator connects one of them during setup. Only one provider can be connected per organisation. Once connected, certificates, identity photographs and signed declarations are written to your storage and not to ours.
• Provider sign-in. Google and Microsoft act as identity providers only where your administrators choose to sign in with them. Learners never use them, because learners sign in with a private emailed link and a one-time code rather than a password.

If you connect no storage and your administrators sign in with an email address and password, then neither Google nor Microsoft is engaged at all.

What each one does and does not receive

Oracle Cloud Infrastructure holds everything we hold: the platform database, your organisation's own database, the key vault, and our own store of course material. It also carries the emails we send, which means the recipient's address and whatever the message says, usually a learner's name and the link or code they need. It does not hold your certificates or your staff's identity evidence, which are written to the storage you connect. Learner names, email addresses and phone numbers are encrypted before they are stored, with a key belonging to that one organisation.

Stripe receives your billing contact and payment details. It does not receive learner records.

Microsoft receives nothing unless you bring it in. Where you have connected SharePoint or OneDrive, it holds the files you have asked us to write to your own account. Where an administrator signs in with Microsoft, it confirms that person's identity to us.

Google, where you have connected Drive, holds the files we write to your own account. Where an administrator signs in with Google, Google confirms that person's identity to us.

Changes to this list

We may add or replace a sub-processor. Before doing so we will:

• give the account contacts at least 30 days' notice by email, and
• update this page.

Keep your account contacts current, because that email address is where the notice goes.

Your right to object

You may object to a new or replacement sub-processor on reasonable data protection grounds within the 30-day notice period, by writing to training@shogconsulting.com and telling us the grounds.

We will try to resolve the objection, for example by describing a control that answers your concern or, where practical, by offering a configuration that does not use that sub-processor. If we cannot resolve it, you may terminate the affected part of your subscription and receive a pro rata refund of the fees you have paid for the unused part of the term. That is the remedy available; there is no further liability for us on this point.

Our responsibility for them

We remain responsible to you for the performance of each sub-processor's data protection obligations, and we put terms on each of them that are no less protective than those in our Data Processing Agreement with you.

Nothing on this page changes who controls the data. You remain the controller of your learners' personal data, and we remain the processor.

Questions about this list go to training@shogconsulting.com.