Sub-Processor Register

Article 28 of the EU General Data Protection Regulation (and the parallel UK GDPR provisions) requires data controllers to engage processors only under a written contract. Indian DPDPA 2023 requires equivalent due diligence on Data Processors. Publishing this register makes it transparent to users which third parties handle the personal data they entrust to us, and on what basis.

We update this register whenever a sub-processor is added, removed, or changed.

Google LLC / Google Cloud (Firebase) — hosting, authentication, Firestore database, Cloud Storage, Cloud Functions, App Check, Cloud Logging. Region: data is processed across Google Cloud's global infrastructure (typically the European Union, the United States, and India). Lawful basis for transfer: Standard Contractual Clauses (Module 2 / Module 3) incorporated by reference into Google's Data Processing Addendum at https://cloud.google.com/terms/data-processing-addendum. Privacy notice: https://firebase.google.com/support/privacy.

Razorpay Software Private Limited — payment processing, refund processing, payment-instrument tokenisation, payout settlement. Region: India. Razorpay is itself a regulated payment aggregator under RBI guidelines and a separate Data Fiduciary for the card / UPI / banking credentials it collects directly from the customer (we never see those credentials). Privacy notice: https://razorpay.com/privacy.

Our SMTP / transactional email provider — delivery of order confirmation, tax invoice, refund acknowledgement, and report-ready emails. The provider is configured via the SMTP credentials set in the production environment; the current provider is operated under its standard data-processing terms.

Google Calendar — only when the consultant explicitly authorises the calendar integration on their dashboard, in which case live consultation slots are mirrored to their personal Google Calendar via OAuth 2.0. No customer personal data is shared beyond the booking time and order reference.

Google Places API — used to resolve birth-place autocomplete suggestions during booking. Each query is mediated server-side via a Cloud Function (no direct browser-to-Google call), so the Places API never sees the user's IP or session token.

Each sub-processor is bound to process personal data only on RMG Astro Private Limited's documented instructions, and only for the purposes listed above. They are not permitted to use the personal data for their own marketing, profiling, or onward sale, except as strictly required to fulfil the service we have engaged them to provide.

Razorpay processes financial-transaction data (including the payer's name, contact information, and the amount) for the purpose of payment authorisation, fraud prevention, statutory tax reporting, and dispute / chargeback resolution, in line with the RBI's payment-aggregator framework.

Where a sub-processor stores or processes personal data outside India (Google Cloud, the SMTP provider) we rely on Standard Contractual Clauses or other approved transfer mechanisms incorporated into the sub-processor's data-processing terms. The full transfer notice is in the Privacy Policy, Section 5.

Before engaging a new sub-processor we (a) review their security and privacy posture, (b) ensure a written data-processing agreement is in place, and (c) update this register. We will not transfer customer personal data to a new sub-processor without first updating this page.

If you have a concern about any of the listed sub-processors, write to riteshghorpade.astro@gmail.com with the subject line 'Sub-Processor Question'. Indian DPDPA users may also reach our Grievance Officer using the address in the Privacy Policy.