GTO FisherService Provider and Subprocessor List
Effective date: Pending confirmation
Last updated: 12 September 2026
This notice explains the outside organisations that process personal data for GTO Fisher, operated by ASTRA LOGIC TECHNOLOGY PTE. LTD. Read it with our Privacy Policy.
1. Roles
A processor or service provider processes information for the purpose we instruct under a contract. A subprocessor helps us carry out processing for an enterprise customer where our agreement makes us its processor. A payment seller, merchant of record, accountant or fraud service may act as an independent controller for its own legal responsibilities. Roles can differ by activity; being on this list does not make every recipient a subprocessor.
2. Provider details
The provider table displayed with this notice identifies the legal name, function, data categories, role, processing and remote-access countries, retention or deletion terms relevant to the function, and a link to the provider’s privacy information. It covers active providers receiving production personal data. A feature is available only where its required provider disclosure and safeguards are in place.
3. Functions and data
| Function | Data normally needed | Limits |
|---|---|---|
| Hosting, database, storage and backup | Account records, saved study content, requested files and technical events | Access by authorised personnel; location, retention and deletion follow the specified service |
| Network delivery, security and access control | IP address, request metadata, security and session identifiers | Only service delivery and protection; non-essential measurement follows cookie choices |
| Authentication | Account identifier, email, authentication and session events | Passwords and tokens protected; identity information limited to sign-in needs |
| AI inference and attachment processing | Relevant prompt/history, extracted attachment content, selected solver context | No general-model training on private content by default; security retention separately disclosed |
| Email, support and diagnostics | Reply address, requested support material, error or delivery events | Private content minimised; optional marketing requires its own permission |
| Payment, merchant of record, tax and fraud | Checkout details, transaction, location/tax and refund/dispute information | Seller and role shown before payment; independent payment notice governs its own processing |
| Permitted analytics | Minimised device, feature and event data | Non-essential processing follows required consent; no behavioural advertising |
4. Payment providers
The seller and checkout provider are identified before payment and on the receipt. Dodo Payments is included as a production recipient when it actually handles the relevant transaction. Airwallex's role in this arrangement is the company's receiving account for software-sale proceeds, rather than the consumer checkout provider; its listing describes only information actually shared for settlement and account services. An approval alone does not establish that a provider has received personal information. Complete card details are normally collected by the checkout provider; we receive entitlement and transaction information needed to operate subscriptions. The verified list describes each recipient's actual role and location.
5. AI and optional improvement
Before private content is sent to an AI provider, its entry describes the requested function, processing countries and relevant input/output retention, including abuse-monitoring retention. Private content is not made available for general-model training by default. Optional improvement requires a separate informed choice that identifies content, purpose, reviewers, recipients, duration and withdrawal. See our AI Policy.
6. Overseas access and safeguards
Processing includes remote administration and support access, not only the location of a database. Our provider table identifies relevant countries. Required mechanisms may include comparable contractual protection under Singapore law, a valid adequacy route, EEA Standard Contractual Clauses with supplementary measures, the UK Addendum or IDTA, or the relevant local mechanism. A safeguard for one region does not automatically cover another. You can request information or a copy of applicable safeguards at support@gtofisher.com; we may redact confidential business or security details while supplying legally required information.
7. Changes and objections
We update the list when a provider, purpose or material location changes. We give any advance notice required by law or our enterprise contract before the change takes effect. Enterprise objections are handled under the applicable DPA; consumer privacy rights remain available. If a justified objection cannot be resolved through safeguards or a reasonable alternative, available remedies may include disabling an optional feature, ending the affected service, and the refund or other remedy required by law or contract. A page update alone is not consent to a new purpose.
8. Contact
Provider questions, change objections and transfer requests: support@gtofisher.com.
ASTRA LOGIC TECHNOLOGY PTE. LTD., 36 Robinson Road, #21-01, City House, Singapore 068877.