Subprocessors, Security & Data Handling

ReviveX relies on selected external technology providers to deliver certain parts of its services.

This may include technology used for:

• CRM
• Data storage
• Communications
• Telephony
• Email
• SMS
• Messaging
• Artificial intelligence
• Workflow automation
• Calendars
• Integrations
• Custom applications
• Support infrastructure

This page is intended to provide transparency regarding those relationships.

It should be read together with:

• Privacy Policy
• Data Processing Agreement
• Service Terms
• AI Use & Limitations
• Acceptable Use Policy

Where ReviveX processes Client-controlled leads, customers or other personal information on behalf of a Client, the standard relationship is generally:

Client = Responsible Party

ReviveX = Operator

Where ReviveX engages another provider to process that Client Data as part of delivering the service, that provider may function as a:

Subprocessor / downstream operator

The exact legal terminology may vary depending on the applicable law and contractual structure.

Using ReviveX does not transfer ownership of the Client's customer database to ReviveX.

As between ReviveX and the Client:

Client Data remains the Client's data.

ReviveX processes Client-controlled information only:

• In accordance with the agreed service
• According to lawful Client instructions
• As reasonably necessary to deliver the service
• As otherwise permitted or required by applicable law

Refer to the Data Processing Agreement for further information.

ReviveX currently uses HighLevel / GoHighLevel platform infrastructure as a core component of the ReviveX CRM and automation environment.

HighLevel may provide underlying functionality including:

• CRM
• Contacts
• Conversations
• Pipelines
• Workflow automation
• Forms
• Calendars
• Communication functionality
• Reporting
• Integrations
• AI-related functionality
• Other platform services

ReviveX may configure, customise and build additional workflows, interfaces, automations and solutions on or around this infrastructure.

ReviveX is the Client-facing service and implementation provider. HighLevel is an underlying technology platform provider. ReviveX does not own HighLevel and is not HighLevel itself.

For data processed through the underlying HighLevel platform, HighLevel may act as a processor or subprocessor within the relevant processing chain.

The exact relationship depends on the service and data involved.

ReviveX relies on HighLevel's applicable contractual, privacy, security and data-processing terms for processing undertaken through HighLevel infrastructure.

• HighLevel Data Processing Agreement
• HighLevel Privacy Policy
• HighLevel Subprocessor List
• HighLevel Security & Compliance Information

Only official HighLevel / GoHighLevel sources are linked above.

The specific information processed depends on the ReviveX services and functionality selected by the Client.

Not every category of Client Data is processed by every provider.

HighLevel maintains its own list of subprocessors.

At the date this page was last reviewed, HighLevel's published subprocessor information identified categories including:

• Cloud infrastructure
• Communication services
• Workflow services
• Customer support
• Analytics
• Payment-related services
• Identity services
• Artificial intelligence services
• Affiliate support entities

HighLevel's published list may change independently of ReviveX.

Rather than duplicating the entire HighLevel list permanently and risking an outdated website record, please refer to the current official source:

View HighLevel's Current Subprocessor List

According to HighLevel's current published subprocessor information, HighLevel uses infrastructure providers that include:

These are HighLevel infrastructure providers, not providers directly contracted by every ReviveX Client. Not all ReviveX data necessarily passes through both providers in every implementation.

ReviveX services may involve communication functionality such as:

• Telephone
• SMS
• Email
• WhatsApp
• Other messaging

Some communication functionality may be delivered through HighLevel or underlying providers used by HighLevel.

HighLevel's current public subprocessor list identifies communication providers including services such as Twilio, Mailgun and LeadConnector.

However, this does not mean every ReviveX Client uses every provider. The actual provider depends on:

• Channel
• Client configuration
• Location
• Platform functionality
• Messaging setup
• Technical architecture

Provider usage is service-dependent.

Some ReviveX services use artificial intelligence.

AI functionality may be supplied through:

• HighLevel AI functionality
• HighLevel-integrated AI providers
• A ReviveX-configured third-party AI service
• A custom Client implementation

HighLevel currently publishes a list of AI-related subprocessors.

However, not every provider on HighLevel's list automatically processes every ReviveX Client's data. AI provider involvement depends on the features actually enabled.

View HighLevel's Current Subprocessor List

ReviveX may also connect a Client environment to additional external providers when required for a particular implementation.

Examples may include:

• Client calendar systems
• Client email accounts
• Client CRM systems
• Accounting platforms
• Custom APIs
• Business applications
• Communication platforms
• Payment services
• Custom software
• Third-party databases

A service provider connected solely at the Client's request may not necessarily be a general ReviveX subprocessor for all Clients.

Provider-specific processing should be disclosed during implementation where relevant.

A provider should only be identified as a ReviveX or underlying subprocessor where it is actually used, the relevant functionality is enabled, and the provider relationship has been verified.

Providers are not automatically listed as direct ReviveX subprocessors unless the relationship and use have been verified.

Where a provider appears only on HighLevel's own subprocessor list, it is described accurately as an underlying HighLevel subprocessor that may be used depending on functionality.

ReviveX does not claim that all Client Data remains exclusively within South Africa.

The use of cloud, CRM, communications and AI technology may involve processing in other countries.

For HighLevel infrastructure, current published information indicates processing may occur in the United States and other jurisdictions associated with its providers and affiliates.

The exact processing location may vary according to:

• Service
• Provider
• Communication channel
• AI functionality
• Client configuration
• Infrastructure
• Provider architecture

Clients with mandatory data-location requirements must disclose those requirements before implementation.

Where personal information is transferred or processed outside South Africa, the parties should ensure that applicable cross-border data-protection requirements are considered.

Under POPIA, cross-border transfers must satisfy the applicable requirements for transferring personal information to a third party in a foreign country.

Depending on the circumstances, appropriate measures may involve:

• Applicable foreign data-protection laws
• Contractual protections
• Binding corporate rules
• Consent where appropriate
• Another lawful transfer basis

Refer to the ReviveX Data Processing Agreement.

ReviveX applies a layered approach to security.

Security involves responsibilities at several levels:

Security is therefore a shared responsibility.

ReviveX aims to maintain appropriate and reasonable technical and organisational measures according to:

• The nature of the information
• The nature of the processing
• Reasonably foreseeable risks
• The technology involved
• The service architecture

Security safeguards should be:

• Established
• Maintained
• Reviewed
• Updated as risks change

No security programme eliminates all risk.

For services running through HighLevel infrastructure, HighLevel publishes information concerning its own technical and organisational safeguards.

According to HighLevel's current published Data Processing Agreement and security information, these include measures such as:

Every one of these controls is attributed to HighLevel. These are not independently operated or certified by ReviveX unless separately verified.

HighLevel may publish certifications, audit reports or security attestations relating to its platform.

Where referenced, wording must always make the distinction clear.

Use wording such as:

"HighLevel states that its platform has..."

or:

"The underlying HighLevel platform publishes..."

A certification belonging to an underlying provider is not automatically a certification of ReviveX.

ReviveX should apply reasonable access controls to Client environments under its management.

These may include:

• Individual user access where available
• Role-appropriate permissions
• Limiting administrative privileges
• Removing unnecessary access
• Secure credential practices
• Multi-factor authentication where supported and appropriate
• Restricting support access to legitimate purposes

A particular control is stated as always mandatory only where ReviveX has actually implemented it as a universal requirement.

Clients are responsible for securing access under their control.

Clients should:

• Use strong passwords
• Use multi-factor authentication where available
• Avoid credential sharing
• Limit administrator access
• Remove access for former staff
• Review user access periodically
• Secure connected email and calendar accounts
• Secure devices used to access ReviveX
• Report suspected compromise promptly

Clients should not send sensitive credentials unnecessarily through:

• Open chat
• Ordinary CRM notes
• AI knowledge sources
• Unsecured documents

Where ReviveX requires temporary access to a third-party service for implementation, access should be handled through a reasonably secure process.

Permanent passwords should not be retained where they are no longer required.

Clients should avoid providing AI systems with information that is unnecessary for the workflow.

Particular caution should be used with:

• Passwords
• Authentication secrets
• Banking credentials
• Private keys
• Highly sensitive confidential material
• Special personal information

AI workflows should follow the principle of:

Only provide the information reasonably required for the task.

Refer to AI Use & Limitations.

ReviveX workflows should seek to collect only information reasonably necessary for the identified business purpose.

The fact that a CRM or AI system can store additional information does not mean that information should automatically be collected.

ReviveX services may operate through logically separated Client environments or accounts supported by underlying platform architecture.

Physical database separation for each Client is not claimed unless specifically verified.

The accurate concept is logical Client/account separation where supported by the applicable platform.

Authorised ReviveX personnel may require access to a Client environment for legitimate purposes including:

• Setup
• Configuration
• Support
• Troubleshooting
• Security investigation
• Optimisation
• Client-requested changes

Access should be limited to what is reasonably necessary for the relevant task.

Client-controlled personal information and confidential information should be treated as confidential.

Personnel or contractors with legitimate access should be subject to appropriate confidentiality expectations or obligations.

Client Data must not be intentionally disclosed for unrelated purposes.

Retention depends on:

• Client instructions
• Service requirements
• Legal requirements
• Platform functionality
• Backup cycles
• Security requirements
• Contractual obligations

ReviveX does not promise a single universal retention period for every data category.

Where ReviveX acts as Operator, the Client should establish appropriate retention requirements for Client-controlled personal information.

Where legally and technically appropriate, Client Data may be:

• Deleted
• Removed
• Suppressed
• De-identified
• Exported and then deleted

following:

• Client instruction
• Termination
• Valid Data Subject request
• Expiry of an appropriate retention period

Deletion may not immediately remove information from every backup copy.

Underlying technology providers may maintain backups for:

• Disaster recovery
• Resilience
• Security
• Business continuity

Backup copies may remain for a limited period after live-system data has been deleted.

ReviveX should not represent deletion as instantaneous removal from every underlying backup unless verified.

Where technically available, Clients may request or perform exports of appropriate Client Data.

Export formats and available data depend on:

• Platform functionality
• Data type
• Service
• Provider restrictions
• Connected systems

Custom migration or data transformation work may require additional fees.

Before terminating a ReviveX service, Clients should identify any data they require for future business purposes.

Where practical and appropriate, Clients should export required data before account access ends.

Following termination, data will be handled according to:

• Service Terms
• Data Processing Agreement
• Applicable law
• Platform capabilities
• Legitimate retention requirements

ReviveX will maintain a process for responding to suspected security compromises relating to information processed under ReviveX's control.

This may involve:

• 1. Identifying the incident
• 2. Containing affected access where possible
• 3. Investigating the scope
• 4. Working with relevant providers
• 5. Preserving relevant evidence
• 6. Assessing the affected information
• 7. Notifying the Client where required
• 8. Supporting appropriate remedial action

Where ReviveX acts as Operator and has reasonable grounds to believe that Client-controlled personal information has been accessed or acquired by an unauthorised person, ReviveX will notify the responsible Client in accordance with applicable law and the Data Processing Agreement.

Under POPIA, the Operator notification obligation applies immediately once the applicable legal threshold is met.

Where the Client is the Responsible Party, the Client generally remains responsible for determining its legal notification obligations relating to affected Data Subjects and the Information Regulator.

ReviveX will provide reasonable assistance where the incident relates to processing performed by ReviveX.

No internet-connected technology can be guaranteed to be completely secure.

ReviveX therefore does not claim that its systems are:

• Hack-proof
• Breach-proof
• 100% secure
• Risk-free
• Immune from cyberattack

Security is an ongoing risk-management process.

An incident or outage may originate from:

• ReviveX
• HighLevel
• A cloud provider
• A telecommunications provider
• An AI provider
• A Client-connected system
• Another third party

ReviveX will work with the relevant provider where appropriate but cannot control independent third-party infrastructure.

The Client may choose to connect ReviveX to external systems.

The Client is responsible for ensuring that it is authorised to connect those systems.

Where a Client authorises a third-party integration, information may be transferred between ReviveX and that provider as necessary for the intended workflow.

The third party's own security and privacy terms may apply.

ReviveX may build custom applications, automations or integrations.

The data architecture of a custom solution may differ from the standard ReviveX CRM environment.

For material custom builds, the applicable project documentation should identify:

• Key providers
• Data flows
• Relevant integrations
• Security responsibilities
• Hosting arrangements where appropriate
• Additional subprocessors where relevant

This standard page does not describe every custom application's entire technical architecture.

When designing custom systems involving personal information, ReviveX should reasonably consider:

• Data minimisation
• Access control
• Authentication
• Appropriate permissions
• Secure integrations
• Data flows
• Confidentiality
• Retention
• Human access
• Incident risk

The level of control should be proportionate to the risk of the system.

Clients must tell ReviveX before implementation if a workflow is expected to process special personal information.

Additional controls or a different architecture may be required.

ReviveX may decline a proposed workflow where the risk cannot reasonably be managed.

Clients must disclose where a proposed implementation is expected to process personal information relating to children.

The legal basis and safeguards should be assessed before implementation.

Clients should not assume a standard ReviveX implementation is suitable for every category of high-risk information.

Where a Client intends to process highly sensitive or regulated data, the requirements should be specifically scoped before deployment.

This may affect:

• Technology selection
• Providers
• Security controls
• Contracts
• Access
• Hosting
• Workflows
• Cost

Where third-party payment functionality is integrated, payment processing may be performed by the relevant payment provider.

ReviveX should avoid storing full payment-card credentials unless a specifically approved and compliant architecture has been implemented.

ReviveX is not claimed to be PCI DSS certified unless independently verified.

A security certification is not displayed as belonging to ReviveX unless the certification was actually issued to ReviveX.

Provider certifications may be mentioned only with clear attribution.

Correct: "The underlying HighLevel platform states that it maintains SOC 2 Type II assurance."

Incorrect: "ReviveX is SOC 2 Type II certified."

Where appropriate, ReviveX may consider publicly available or contractually supplied provider information relating to:

• Privacy
• Security
• Data processing
• Subprocessors
• Incident management
• Reliability

The use of a recognised provider does not eliminate ReviveX's own responsibility to use that provider appropriately.

Technology changes over time.

ReviveX or an underlying provider may:

• Add subprocessors
• Replace subprocessors
• Remove subprocessors
• Change infrastructure
• Change AI providers
• Change communications providers

ReviveX will seek to keep this page reasonably current.

For HighLevel-controlled subprocessors, the most current authoritative source is HighLevel's own published subprocessor list.

A Client that cannot permit use of a particular provider, country, AI model, cloud platform or communication provider must identify that restriction before implementation.

ReviveX will assess whether the requirement can be supported.

It may require:

• Alternative architecture
• Custom development
• Provider changes
• Additional contractual arrangements
• Additional fees

Some requirements may not be technically feasible.

Where a Client has legitimate legal or regulatory concerns regarding a proposed provider, ReviveX should discuss those concerns in good faith.

An objection does not automatically guarantee that ReviveX can provide the same service without the relevant technology provider.

Where an alternative cannot reasonably be supported, the parties may need to consider an alternative service architecture or appropriate contractual solution.

Information concerning third-party providers is based on available provider documentation and may change independently of ReviveX.

Where a third-party provider's own current documentation conflicts with an older description on this page, ReviveX should review and update the website information.

Outdated provider information should not be intentionally preserved.

A Client conducting supplier or security due diligence may contact ReviveX for additional information.

Requests may be made regarding:

• Data flow
• Platform architecture
• Applicable subprocessors
• Security controls
• Data-processing arrangements
• Custom Client requirements

Some information may not be disclosed where disclosure would:

• Create a security risk
• Reveal another Client's confidential information
• Reveal protected credentials
• Violate a provider agreement
• Reveal proprietary technical information unnecessarily

Enterprise or regulated Clients may request completion of a reasonable security or supplier questionnaire.

ReviveX may:

• Complete relevant sections
• Provide applicable provider documentation
• Explain which controls belong to ReviveX
• Explain which controls belong to underlying providers
• Identify items that do not apply

ReviveX should not answer Yes to a control merely because an underlying provider has that control if the question specifically asks whether ReviveX itself maintains it.

Responsibility may vary where a Client-specific agreement or custom technical architecture states otherwise.

The register distinguishes between:

ReviveX should review this page periodically and when material changes occur.

Review should include:

• Core platform provider
• Subprocessor links
• Processing locations
• Security descriptions
• AI provider changes
• Communication-provider changes
• Legal requirements
• ReviveX-specific additional providers

Outdated information should be removed when identified.

Questions regarding subprocessors, security or data handling may be directed to:

ReviveX International
Christopher Parry Photography (Pty) Ltd

Registration Number: 2015/179935/07

Physical Address:
626 32nd Avenue
Villieria
Pretoria
Gauteng
0186
South Africa

Email: chris@revivex.co.za

Telephone: +27 84 511 7736

Website: revivex.co.za

For formal personal-information requests, refer to the ReviveX:

• Privacy Policy
• PAIA Manual

This Subprocessors, Security & Data Handling page should be read alongside the following documents:

• Privacy Policy
• Website Terms of Use
• PAIA Manual
• Cookie Policy
• Service Terms
• Data Processing Agreement
• AI Use & Limitations
• Acceptable Use Policy