Sub-Processors

We require every Sub-processor to be under a data protection agreement meeting GDPR Article 28, and we remain responsible to you for what they do. Where data goes outside the EEA, the safeguards are set out in Section 14 of our Terms.

Add your email and we'll tell you 14 days before any new Sub-processor starts handling your data. Nothing else — this list is only ever used for these notices, and you can unsubscribe from any of them.

You gave us general authorisation to use Sub-processors when you accepted our Terms, so we don't need a new signature each time this list changes. What we owe you instead is notice and a say.

Before a new Sub-processor begins processing your data, we tell you at least 14 days ahead, by email or in-app notice and by publishing it on this page. If you object on reasonable data-protection grounds, we'll work with you to find a commercially reasonable solution. If we can't find one within 30 days, you can terminate the affected Services without penalty.

This is set out in full in Section 14 of our Terms of Service, which is also our Data Processing Agreement. If you need a counter-signed copy for a compliance review, you can download one here.