Subprocessors

We use a small number of providers to run our services. Each processes personal data only on our instructions, under written terms meeting Article 28 of the UK GDPR. This list is maintained as data rather than prose, so it is accurate on the day you read it.

We give at least 30 days’ notice before adding or replacing a subprocessor. To be told by email, write to [email protected]. The same list is available as JSON at https://drentova.com/legal/api/v1/subprocessors if you would rather monitor it automatically.

We are based in the United Kingdom and process personal data here wherever we can. Some of the providers we rely on operate outside the UK.

Where personal data is transferred outside the UK, we rely on one of the safeguards permitted by Chapter V of the UK GDPR: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The safeguard applying to each provider is named in the subprocessor table, and we carry out a transfer risk assessment before relying on any of them.

You can ask us for a copy of the safeguards in place for a particular transfer by writing to [email protected].