Makatea uses five categories of providers to deliver the service. All of them process data in the United States, except payments in Mexico. Every transfer is covered by standard contractual clauses. Makatea gives 30 days' notice of any new or changed provider. The list with names is available from the privacy officer.
1. What is a sub-processor?
It is a provider that processes personal data on Makatea's behalf to deliver the service. Makatea is responsible to the customer for the work of each one. Each provider signs its own data processing terms.
2. Which sub-processors does Makatea use?
| Category | What it is used for | Data received | Country | Transfer mechanism |
|---|---|---|---|---|
| Cloud infrastructure | Hosting the platform, database, sign-in and files | Account and portfolio data, messages and files | United States | Standard contractual clauses |
| Analytics and reports | Preparing the weekly reports | Only aggregated metrics and the organization name | United States | Standard contractual clauses |
| Payment processing | Charging the subscription and the payments the customer enables | Order identifiers, amounts and status, without card data | United States and Mexico | Standard contractual clauses when there is a transfer |
| Email delivery | Sending sign-in emails, invitations and reports | Recipient email, organization name and content | United States | Standard contractual clauses |
| Public site measurement | Counting visits to makatea.ai | Pseudonymous identifier, pages viewed and visit source | United States | Standard contractual clauses |
The analytics provider receives only aggregated information, without your customers' data, and does not train models on it. Site measurement is turned on only with consent in the European Union and the United Kingdom. WhatsApp messaging runs on Makatea's own infrastructure in the United States and is not an external provider.
3. Which mechanism covers each transfer?
| Customer region | Mechanism |
|---|---|
| European Union and European Economic Area | Standard contractual clauses of Decision 2021/914, modules 2 and 3 |
| United Kingdom | ICO International Data Transfer Addendum |
| Brazil | ANPD standard clauses, Resolution 19/2024 |
| Colombia | Transmission contract of article 25 of Decree 1377 |
| Ecuador | Standard clauses of Resolution SPDP-SPD-2026-0004-R |
| Peru | Appropriate safeguards of Regulation S.D. 016-2024-JUS |
| Mexico | Referral to processors, which is not a transfer under the LFPDPPP |
Details are in Clause 9 and in the EU and UK Annex of the DPA.
4. How do I learn about a new provider or a change?
Makatea gives notice 30 days before a new provider starts processing data. The notice goes by email to your account contact. This page is updated the same day with the date of the change.
5. How do I subscribe to notices?
Write to rodrigo@makatea.ai with the subject "Sub-processor notices". Send it from the email you want to register. Makatea adds that email to the notice list and confirms by reply.
6. Can I object to a change?
Yes. Reply to the notice within 30 days with your data protection reasons. Makatea reviews the objection with you and looks for a reasonable alternative. Clause 8.3 of the DPA provides for this.
7. How do I get the list with names?
Write to the privacy officer, José Rodrigo Barrios Villa, at rodrigo@makatea.ai. Send it from your account email. Makatea replies with the name, location, function and transfer mechanism of each provider.
8. Change history
| Date | Change |
|---|---|
| October 14, 2026 | First publication of this list |