Sub-processors and recipients

What this page is for

Two obligations meet here. Article 13(1)(e) GDPR makes us tell you who receives personal data. Article 28(2) makes us tell our customers before we let a new sub-processor near the data they entrust to us. One published register satisfies both, and it means neither you nor a procurement team has to ask us for a list.

This page is Annex 3 of the data processing agreement. It is the same register, rendered from the same source.

How to read the two roles

Processor — acts only on our documented instructions, under a written contract that passes on every obligation we owe you, including the security measures and the transfer safeguards. We stay fully liable for what it does. These are sub-processors in the Article 28(4) sense.

Separate controller — receives personal data but decides its own purposes for at least part of what it does, so it is not our sub-processor and we cannot instruct it. Tpay is the case that matters: to execute and settle a payment, and to meet its own duties under payment-services law, anti-money-laundering law, accounting law and the card-scheme rules, Tpay decides for itself. It publishes its own privacy notice and you have the full set of GDPR rights against it directly, in addition to your rights against us. Describing Tpay as our processor would be convenient and wrong.

The rules we hold ourselves to

• We keep the list short. Every provider is a place data can go wrong, so a new one has to earn its place. The whole register is short enough to read in a minute; that is deliberate.
• 30 days notice before a change. Before we add or replace a sub-processor, customers are told at least 30 days in advance, by email or in the product.
• You can object. On reasonable data protection grounds, within those 30 days. If we cannot find an alternative that works, you may terminate the affected subscription without penalty and get the unused prepaid period back. Objecting is not a breach of contract and we will not treat it as one.
• Same obligations, all the way down. Each contract imposes the obligations in the DPA, including Annex 2’s security measures and the Standard Contractual Clauses where a transfer needs them.
• No training on your data. The AI provider is contractually barred from using your inputs or outputs to train its models.
• We publish what is in use, not what we might use. A provider that is configured but switched off does not appear here; when we turn it on, it appears with notice first.

Transfers outside the EEA

Rows marked with an asterisk involve a transfer to, or access from, a third country. The transfer tool is Article 46(2)(c) GDPR — the European Commission’s Standard Contractual Clauses, concluded with each provider as part of its data processing agreement, backed by a transfer impact assessment and by the encryption, access control and minimisation measures in Annex 2. Where a provider also holds an EU–US Data Privacy Framework certification, that applies in addition; we do not lean on it alone.

Ask us for the clauses covering a specific provider and we will send them: [email protected].

Who else can see personal data, outside this register

Not every recipient is a technology provider, so for completeness: our accountant and tax adviser, our bank, and — where we need to establish or defend a legal claim — lawyers, auditors or insurers. Public authorities receive data only where a legal provision obliges us to hand it over, and we check the basis before answering a request rather than treating an informal one as an order. The privacy policy covers all of this.

The register

Current as of the date at the top of this page.