Subprocessors
Last Updated: December 5, 2025
FiraForm uses third-party subprocessors to provide and improve our Service. This page lists all subprocessors that may process customer data on our behalf.
We carefully select our subprocessors and ensure they comply with applicable data protection laws, including GDPR and PDPA. All subprocessors are bound by data processing agreements that meet regulatory requirements.
Notice of Changes: We will notify customers at least 30 days in advance of adding or changing subprocessors via email and by updating this page.
Current Subprocessors
| Subprocessor | Purpose | Data Location |
|---|---|---|
|
Paddle.com Market Limited paddle.com |
Payment processing, billing, subscription management, tax compliance | United Kingdom, United States |
|
Linode (Akamai) linode.com |
Cloud infrastructure, data storage, application hosting | Various global locations |
|
Cloudflare, Inc. cloudflare.com |
DNS services, CDN, DDoS protection, website hosting | Global network |
|
Cloudflare Workers AI cloudflare.com |
Spam detection and content filtering for form submissions | Global network |
|
Zeptomail (Zoho Corporation) zeptomail.com |
Transactional email delivery (notifications, alerts, password resets) | United States, India |
Note: Marketing email services will be added to this list once selected. We will notify all customers before implementing any marketing email provider.
Data Protection Measures
All subprocessors listed above:
- Are bound by data processing agreements (DPAs) meeting GDPR Article 28 requirements
- Implement appropriate technical and organizational security measures
- Process data only as instructed by FiraForm
- Maintain confidentiality of customer data
- Assist with data subject rights requests when applicable
- Notify FiraForm of any data breaches
International Data Transfers
Some subprocessors may transfer or process data outside of Malaysia or the European Economic Area (EEA). Where applicable, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions by relevant authorities
- Other legally recognized transfer mechanisms
Your Right to Object
If you object to our use of a specific subprocessor, please contact us at [email protected] within 30 days of receiving notice of a new subprocessor. We will work with you to find an alternative solution or, if not possible, allow you to terminate your subscription without penalty.
Updates to This List
We may update this list as we add, change, or remove subprocessors. Material changes include:
- Adding a new subprocessor
- Changing the purpose for which a subprocessor processes data
- Changing the location where data is processed
You will be notified via email at least 30 days before any material changes take effect.
Questions?
If you have questions about our subprocessors or data processing practices, please contact us:
Email: [email protected]
Support: [email protected]
This page was last updated on December 5, 2025. Please check back regularly for updates.