Subprocessors
The third parties that process personal data on our behalf, and the safeguard covering each transfer.
- Effective
- 14 October 2026
- Applies to
- Drentova Group Ltd
About this list
We use a small number of providers to run our services. Each processes personal data only on our instructions, under written terms meeting Article 28 of the UK GDPR. This list is maintained as data rather than prose, so it is accurate on the day you read it.
We give at least 30 days’ notice before adding or replacing a subprocessor. To be told by email, write to [email protected]. The same list is available as JSON at https://drentova.com/legal/api/v1/subprocessors if you would rather monitor it automatically.
Subprocessors
| Subprocessor | Purpose | Location | Transfer safeguard | Data |
|---|---|---|---|---|
| Cloudflare | Content delivery, firewall, DDoS protection and bot checks | United States | UK Addendum to the EU SCCs | IP address, browser and device details, and the content of requests passing through its network |
| Google Cloud | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Dammam) or Qatar (Doha), as the customer chooses | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Hostinger | Self-hosted database and application hosting (default location) | India (Mumbai) | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Oracle Cloud Infrastructure | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Riyadh) | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Resend | Transactional email delivery | United States | UK Addendum to the EU SCCs | Recipient email address and message content |
| Vercel | Application hosting, content delivery and file storage | United States | UK Addendum to the EU SCCs | IP address, request metadata and server logs; uploaded media stored in Vercel Blob |
International transfers
We are based in the United Kingdom and process personal data here wherever we can. Some of the providers we rely on operate outside the UK.
Where personal data is transferred outside the UK, we rely on one of the safeguards permitted by Chapter V of the UK GDPR: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The safeguard applying to each provider is named in the subprocessor table, and we carry out a transfer risk assessment before relying on any of them.
You can ask us for a copy of the safeguards in place for a particular transfer by writing to [email protected].
How to contact us
- Privacy and data protection
- [email protected]