GDPR & Data Processing

Where Customer Data Lives

All EdSmart customer data, including school, staff, parent and student information, is stored at rest in Microsoft Azure data centres located in Australia. EdSmart is certified to ISO 27001:2022, and our information security program covers data governance, retention and destruction, encryption in transit and at rest, access control, incident response and vendor risk management.

A small number of service functions involve data transiting or being processed by providers outside Australia. These are listed transparently below.

Sub-Processors

To deliver our Services, Cloud Paper Group engages the following third party Sub-Processors. Each is bound by contractual obligations and consistent with our privacy obligations under the Privacy Act 1988 (Cth).

Infrastructure Sub-Processors

Entity	Purpose	Entity Country	Customer Data Location
Microsoft Corporation (Microsoft Azure)	Cloud hosting of the EdSmart platform, applications and databases	USA	Australia (Azure Australia regions). All customer data is stored at rest in Australia
Cloudflare, Inc.	DNS, content delivery and TLS for EdSmart web traffic	USA	In transit only via global network edge. No customer data is stored at rest by Cloudflare

Service Sub-Processors

Entity	Purpose	Entity Country	Customer Data Location
SMS Broadcast Pty Ltd	SMS delivery for Australian customers	Australia	Australia
Twilio Inc.	SMS delivery for customers outside Australia only. No Australian customer data is processed by Twilio	USA	USA
ActiveCampaign, LLC (Postmark)	Transactional email delivery (system notifications)	USA	USA. Limited to message content and recipient email address
Atlassian Pty Ltd	Customer support service desk and ticket management	Australia	Australia

Sub-Processor Agreements

Cloud Paper Group maintains data processing terms with each Sub-Processor listed above, consistent with our obligations to Customers. Copies of relevant terms are available to Customers on request.

Changes to Sub-Processors

We will notify the registered account owner of each Customer before engaging a new Sub-Processor that processes Customer personal data, and will update this page at the same time.

‍

This page was last updated on 16 June 2026.

‍