Sub-processors
Last updated
This is the complete list of third parties that process data on our behalf in running the business. Each is bound by a data processing agreement. It is published openly so that clients can see exactly who handles their data, without having to ask.
| Processor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Website hosting, CDN, DNS and DDoS protection | Server request data (IP, user agent, URL, timestamp) | Global edge; EU data localisation available |
| Resend | Transactional delivery of contact form submissions | Name, email, business, enquiry details and message | EU / US, under SCCs |
| WhatsApp Business (Meta) | Replying to enquiries sent by WhatsApp | Phone number, name and messages you send | EU / US, under SCCs |
| Google Workspace | Business email, documents and calendars | Business contact details and correspondence | EU region, under SCCs |
| GitHub | Source control for code we write for clients | Code and configuration; no client personal data by policy | US, under SCCs |
During client projects
No sub-processor is introduced into a client project without written agreement. Hosting, domains, e-commerce platforms, booking tools and AI model providers used for a client are chosen with the client and registered in the client's name wherever possible, so that you hold the relationship and the exit rights. Anything contracted on your behalf is named in the project agreement.
Changes to this list
Existing clients are notified in writing at least 30 days before we add a sub-processor that would handle their data, with the opportunity to object. Email hello@rubradigital.com to be added to that notification list.