3 Sixty One Limited ("361") runs Conflow. These are the companies that process customer data for us so that Conflow can work. Each one acts only on our instructions. This list is the current version of Annex III of the Conflow Data Processing Agreement.
We tell customer administrators by email at least 10 business days before we add or replace a sub-processor. The customer can object within 30 days.
Current sub-processors
| Subprocessor | Processing task | Country of location | Personal data involved |
|---|---|---|---|
| Microsoft: Microsoft Azure: App Service, Database for PostgreSQL Flexible Server, Blob Storage, Key Vault, Application Insights / Log Analytics | Hosting the Service: servers, database, files, backups, secrets, logs | New Zealand (New Zealand North region, Auckland) | All Customer Personal Data |
| Microsoft: Azure Static Web Apps | Serving the web app's static files (code, styles, images) and passing 361 super admin requests through to the API | Hong Kong (East Asia region) | Business data: none (the app calls the API in New Zealand directly). Super admin requests: Customer name, User names, emails, roles, last sign-in |
| SMTP2GO | Sending invitation and password-reset emails | Australia (account hosted in Australia) | Recipient name and email address. SMTP2GO keeps the sender, recipient, subject, time and delivery status for about 35 days. Email archiving is off, so the email text is not stored |
| Google (Google Workspace) | Receiving and answering support emails that Customer sends to support@3sixtyone.co (support email only) | United States and other countries | Whatever Customer includes in a support email |
Not sub-processors
Not Subprocessors (no Customer Personal Data): Microsoft Azure Container Registry (container images, New Zealand North), GitHub (source code and deployments), Healthchecks.io and UptimeRobot (uptime and backup-job checks).
Your own AI app. If your business turns on Conflow AI (it cannot be turned on yet), a user can connect their own AI app (for example, Anthropic's Claude or OpenAI's ChatGPT). That app reads data at your business's direction, under your own agreement with the AI provider. It is not a sub-processor of 361.
Your own sign-in provider. If your business signs in with Microsoft 365 or Google Workspace, Microsoft or Google acts under your business's own agreement with them.
361's own systems. 361 also uses Xero for its own invoices. Website contact and demo forms go through Microsoft Azure Static Web Apps and SMTP2GO to our Google Workspace email. None of these hold the data inside Conflow. See the Privacy Policy for details.
Questions
Email support@3sixtyone.co.