GoTo Meeting, GoTo Webinar, GoTo Training
and GoTo Stage Sub-Processors

Data Hosting Locations
Entity Name

Hosting Type

Location

Equinix, Inc.,
Switch, Inc., Crown
Castle InternationalCorp.

Co-location facilities

United States,Europe (Customer

Amazon WebServices

Cloud Hosting Provider

United States

Microsoft Corp.,
incl. Azure

Cloud hosting provider

United States,
Netherlands,
IrelandOracle America,
Inc.

Cloud hosting provider

United States, Europe,
APAC

Entity Name

PurposeLocation

CloudFront

Content Delivery Network (CDN)

United States, Europe,
Worldwide*

content is only stored in
Equinix and Switch datacenters in the UnitedStates)

Third Party Sub-Processors*Only used if customer accesses
service from a location outside
U.S./Europe

Pendo.io, Inc.

In-product messaging, user experienceguide and onboarding platform

United States, United
Kingdom, Israel

Twilio (SendGrid)

Communication platform for email delivery United States

Qualtrics

Feedback and survey responses

United States

Google LLC, Incl. Google
Cloud (if enabled)

Voice-to-text transcription provider forcertain non-English languages (GoToMeeting)

Worldwide*

Filestack, Inc.

File upload service provider (GoToWebinar)

United States

Stripe Inc.

Payment service provider (GoTo Webinar; United StatesGoTo Stage)

PayPalPayment service provider (GoTo Training; United States
GoTo Stage)

AddEvent

Calendar invite generation (GoToWebinar; GoTo Training)*Google Transcription is an optionalfeature and Google does not store ormaintain translations after conclusionof the processing operation

United States

Version: v. 3.4 | September 2023

Akamai Kona & Prolexic

Rate limiting, security request filtering and Worldwide
DDOS protection (GoTo Meeting)

GOTO AFFILIATES
In addition to the sub-processors above, GoTo may utilize the affiliates listed in the GoTo Affiliates SubProcessor Disclosure which can be found at https://www.goto.com/company/trust/resource-center.
DATA TRANSFERS
Where GoTo transfers personal data in connection with its services, it does so in compliance with dataprotection regulations and utilizes the following frameworks to safeguard transfers, as applicable:•••

Standard Contractual Clauses (or “Model Clauses”)
APEC Cross-Border Privacy Rules (or “APEC CBPR”)
APEC Privacy Recognition for Processors (or “APEC PRP”)

More information on GoTo’s privacy program, including transfer mechanisms, risk assessments, andsupplemental measures may be found at https://www.goto.com/company/trust/privacy.
DATA PROCESSING ADDENDUM
GoTo offers a comprehensive global Data Processing Addendum (“DPA”), which is designed to meetthe requirements of applicable data privacy laws and regulations. Please visit
https://www.goto.com/company/legal to learn more.
TECHNICAL AND ORGANIZATIONAL MEASURES
GoTo’s security and privacy practices are outlined in its Trust and Privacy Center athttps://www.goto.com/company/trust/privacy, as well as in Technical and Organizational Measures(“TOMs”) documentation which outline encryption types used, data retention periods, certifications
maintained, and other relevant measures implemented by GoTo. Product-specific TOMs may be foundat https://www.goto.com/company/trust/resource-center.