Sub-processors
Last updated {date}.
1. What this page is
Sub-processor has the meaning given in the data processing agreement: a third party we engage to process personal data on the Customer's behalf. This page names each one, what it does, and what data reaches it. It is incorporated into that agreement, and the Customer's authorisation under it covers these entries.
The list is dated: the date above changes whenever an entry is added, removed or replaced.
The platform is not yet running in production, so no customer data and no end-user data has reached any platform sub-processor below.
2. Platform sub-processors
These may process customer data and end-user data held in the platform. What is not settled is marked as such, and is settled before the platform carries live data.
| Sub-processor | Entity | Purpose | Data it receives | Domicile | Processing location |
|---|---|---|---|---|---|
| Hosting provider | {hosting provider} | Runs the application servers, the background worker and the database | All customer data and end-user data held in the platform | Named with the provider | {hosting region} |
| Cloudflare | Cloudflare, Inc. | Object storage for the media library, delivery of public media, DNS, and the edge in front of the Service | Uploaded image files and their storage keys; request metadata and content for traffic crossing the edge | United States | Storage {object storage location}; edge traffic at the nearest edge location |
| Email delivery provider | {email delivery provider} | Delivers the only transactional email the platform sends, the organization invitation | The invited person's email address, the organization name, and a single-use acceptance link | Named with the provider | Named with the provider |
| Sentry | Functional Software, Inc., trading as Sentry | Error reporting and tracing, where a connection to it is configured for a deployment | Exception details and stack traces, the service name, and the request method, scheme, host and path. Query strings, request bodies, cookies, IP addresses and credential headers are removed first | United States | {error reporting instance region} |
| Payment processor | Paddle {payment processor legal entity name} | Taking payment, where the Order provides for it. Paddle is the merchant of record for the purchase: it sells the subscription, handles VAT and sales tax, and issues the invoice | Billing email, billing name and an internal organization identifier. No end-user data, and no payment card data passes through Gemifier | Named with the provider | Named with the provider |
3. Website sub-processors
These act only on data from gemifier.io, the marketing website. None has access to the platform, to a customer account or to an end-user record. The analytics and the chat load only after you accept them; the fonts load on every page. See the cookie policy.
| Sub-processor | Entity | Purpose | Data it receives | Domicile | Processing location |
|---|---|---|---|---|---|
| Google Ireland Limited, and Google LLC | Counts visits to the website; serves the web fonts | Analytics events, only after you accept them; your IP address and user agent when a font is requested | Ireland and the United States | Google infrastructure, including outside the EEA and the UK | |
| Tawk.to | tawk.to inc. | The live chat window, loaded only after you accept it | Your IP address, the pages you view while the widget is open, and whatever you type into the chat | United States | Not confirmed |
| FormSubmit | Not confirmed | Relays the contact form to us by email | Everything you type into the form and your IP address. A copy is kept for 30 days | Not confirmed | Not confirmed |
4. Notes on particular entries
- Error reporting is conditional: it runs only where a connection is configured, and nothing in the Service depends on it. Identifying data is off at source, but exception messages and structured log values are not scrubbed, so a message carrying an identifier can still reach it. Retention there is set by that provider, not us: {error report retention}.
- No charge has been taken: nothing has been sent to a payment processor, and one is named here before the first charge.
- Four entries are not confirmed: the object storage region, which is not set in configuration; the error reporting instance, which no account setting confirms; the live chat processing location; and the operator of the form relay and its locations.
5. Adding or replacing a sub-processor
We give at least {sub-processor notice period} written notice before adding or replacing a sub-processor: this page is updated, and a person writes to the contact the Customer names in the Order.
Within that period the Customer may object on reasonable data protection grounds by writing to business@gemifier.io. We will discuss it in good faith and try to resolve it by changing a configuration, a location or the provider.
If it cannot be resolved, the Customer may terminate the affected part of the Service without penalty, and we refund pre-paid fees for the unused part of the term. The rest of the agreement is unaffected.
6. What is not a sub-processor
- Endpoints the Customer registers: a destination the Customer chooses for its own notifications is not our sub-processor. The Customer controls it and is the exporter for that transfer.
- Source hosting and build tooling: these hold source code and build artefacts, receive no customer data, and are not listed.
7. Questions
Data protection contact: business@gemifier.io. What we hold and why is in the privacy policy; the terms on which we process it are in the data processing agreement.