The short version. A handful of providers handle personal data for us. Each one works under a written data processing agreement. We give clients 30 days' notice before we add or replace one that handles their customers' data. Anyone can ask for email updates.
These providers process personal data on our behalf in two situations:
- For our own business, such as replying to enquiries and billing clients. Our privacy notice explains this.
- For our clients, when we host a client's website and handle its visitors' data. For that data we are the client's processor, and these providers are our "sub-processors" under our Data Processing Addendum.
Each entry below says which of the two applies.
The list
Cloudflare, Inc.
- What they do: host our website and our clients' websites (Cloudflare Pages), deliver pages quickly, run DNS, protect sites from attacks and bots, count visits without cookies (Web Analytics), deliver form messages (Pages Functions) and forward email sent to our addresses and to our clients' domains (Email Routing).
- Used for client websites: yes.
- Where: Cloudflare's worldwide network, usually in the data centre nearest each visitor. Cloudflare is based in the USA.
- Transfer safeguard: Cloudflare's data processing agreement includes the EU Standard Contractual Clauses and the UK Addendum. Cloudflare also takes part in the Data Privacy Framework.
- Their agreement: Cloudflare customer DPA
Stripe
- What they do: take card and Direct Debit payments, and send invoices and receipts.
- Used for client websites: no. Stripe handles our clients' billing details, not their customers' data.
- Where: the UK, the EU and the USA.
- Transfer safeguard: Stripe's data processing agreement includes the EU Standard Contractual Clauses and the UK Addendum. Stripe also takes part in the Data Privacy Framework.
- Their agreement: Stripe DPA
- Good to know: Stripe also uses some payment data for its own fraud checks and legal duties. For that, Stripe decides how the data is used, under the Stripe Privacy Policy.
Email provider: Proton AG (Proton Mail)
- What they do: run our mailboxes, including hello@northpin.studio and privacy@northpin.studio.
- Used for client websites: only when a support email contains a client's customer data.
- Where: Switzerland
- Transfer safeguard: Switzerland is covered by UK adequacy regulations, so no extra safeguard is needed
- Their agreement: Proton AG (Proton Mail) data processing agreement
Freelancers on a project
If a freelancer helps with a client's project, for example a translator, they work under a written contract with confidentiality and data protection terms. They only handle client website data if the client has approved them by name in the Order Form or later in writing.
Not in use
- Web3Forms and Formspree are form services we could switch to. We don't use them now. If we ever do, we'll check their data processing agreement and add them here before any form data goes to them.
- AI tools. We use AI tools to help draft text, translations and code, but we don't put personal data into them, so none appear on this list. If that ever changes, we'll add the tool here first and give clients 30 days' notice.
- Tools we haven't chosen yet. Any other provider we start using, for example for e-signatures, accounting, mailboxes or a password manager, is added to this list before it handles any client data, with at least 30 days' notice to clients under a Care Plan.
Other organisations that receive data
Some organisations receive personal data but decide for themselves how to use it. They aren't our sub-processors, because they don't act on our instructions:
- Google, when you use our website check. Your browser sends the address you type straight to Google's PageSpeed Insights service.
- WhatsApp and Telegram, if you choose to talk to us there.
- Our domain registrar and the domain registries, when we register or renew a domain in a client's name. They use the domain holder's details under their own rules.
- Our bank, accountant, solicitor and insurer, when we need them.
- Public authorities, such as HMRC, when the law requires it.
Changes and updates
Before a new sub-processor starts handling our clients' customers' data, we update this page and email every client with a data processing agreement at least 30 days in advance. Clients can object during that time. Our Data Processing Addendum explains how.
Get updates by email. Anyone can ask to hear about changes to this list. Email privacy@northpin.studio with "Sub-processor updates" in the subject line. We'll only use your email address to send you these updates, and you can stop them at any time.