Sub-processors
Draft. This document is awaiting legal review, and details in [square brackets] are still to be confirmed.
1. Sub-processors
These providers process personal data on our behalf under written contracts, as the Data Processing Agreement requires.
| Company | What for | Data | Where | Safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage and server functions | All account and Customer Data | [SUPABASE PROJECT REGION, e.g. EU (Ireland)]; support access from the USA | Data Processing Addendum; EU Standard Contractual Clauses and UK Addendum for any access from outside the EEA / UK |
| Vercel Inc. | Application hosting, content delivery and cookie-free visitor analytics | Requests to the Services (IP address, pages visited, device type); data passing through the application | Global edge network; functions in [VERCEL FUNCTION REGION] | Data Processing Addendum; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Sending account and invoice emails | Recipient email address, name and message content | USA | Data Processing Addendum; Standard Contractual Clauses |
| Google LLC | Mailbox connection when a customer connects a Google mailbox | The connected mailbox's messages | Global | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Microsoft Corporation | Mailbox connection when a customer connects a Microsoft 365 or Outlook mailbox | The connected mailbox's messages | Global | EU–US Data Privacy Framework and Standard Contractual Clauses |
| [ROUTING AND GEOCODING PROVIDER] | Driving routes and times for transport jobs; finding the coordinates of an address; the town for a driver's location | Start and end coordinates of a route; addresses being searched (which can be pickup or drop-off addresses); approximate coordinates (rounded) | [PROVIDER REGION] | Data Processing Addendum; [TRANSFER MECHANISM, if outside the EEA / UK] |
2. Public services the applications use
Some features call public services directly. They receive only the limited data shown.
| Company | What for | Data | Where | Safeguard |
|---|---|---|---|---|
| OpenStreetMap Foundation | Map tiles | IP address; the map area being viewed | United Kingdom and EU | UK adequacy decision |
| Norwegian Meteorological Institute (MET Norway) | Weather forecasts for the driver's location | Approximate coordinates (rounded) | Norway | Within the EEA |
| unpkg (Cloudflare) | Map marker images | IP address | Global | EU–US Data Privacy Framework |
3. Changes
We give at least 30 days' notice before adding or replacing a sub-processor. To be told by email, write to privacy@ghslink.com with the subject "Sub-processor updates".