We rely on a small number of third parties to deliver parts of our service — hosting, payment, email, security and delivery. This page lists each of them, what they do for us, the categories of data they receive, where they are, and the legal mechanism covering the relationship. It forms part of our Privacy Policy.
Most of these companies act as our processors: they handle personal data only on our instructions and may not use it for their own purposes. A few act as independent controllers — they decide for themselves how they handle the data in order to meet their own legal and operational obligations — and those are listed separately below, because your rights against them are exercised under their own privacy notices rather than ours.
We require every processor to be bound by a written data protection agreement, to apply appropriate security measures, to restrict access to staff who need it, and not to engage a sub-processor without equivalent protections.
Two different things are recorded against each entry below, and they do different jobs. A data processing agreement governs what a processor may do with personal data on our behalf. A transfer mechanism — Standard Contractual Clauses, or the provider’s certification under the EU-US Data Privacy Framework — is what allows the data to leave the European Economic Area or the United Kingdom in the first place. Most providers include their transfer mechanism inside their data processing agreement rather than as a separate document.
Some of the providers below are certified under the EU-US Data Privacy Framework. Where that applies, it is an additional route that can make a transfer lawful; it does not replace the data processing agreement, which governs what the provider may do with the data. We therefore record both, and we record the mechanism each provider’s own agreement actually relies on rather than the certification alone.