Sub-processors

Overview

Under the DPA, the Customer grants Cloudpepper a general authorisation to engage Sub-processors. Cloudpepper enters into written agreements with each Sub-processor imposing data protection obligations no less protective than those in the DPA, and remains fully liable to the Customer for the performance of any Sub-processor’s obligations.

Current sub-processors

The following Sub-processors are authorised as at the “Last updated” date shown above. Capitalised terms have the meaning given to them in the DPA.

Customer-chosen infrastructure

Where a customer elects to deploy the Services on infrastructure they procure directly from a third party of their choice (any data centre, any provider, any country), that third party is not a Sub-processor of Cloudpepper. The customer is responsible for the data protection arrangements with that provider, including putting in place an appropriate data processing agreement and any transfer mechanism required for transfers outside the EEA. See Section 6 of the DPA for the full allocation of responsibilities.

Operational vendors (not sub-processors)

Cloudpepper engages other service providers for its own business operations — for example, payment processing (Stripe), accounting and ERP (Odoo SA), marketing email (Klaviyo), and internal communications (Google Workspace). These providers process personal data that Cloudpepper itself controls, and are therefore not Sub-processors of Customer Data within the meaning of Article 28 GDPR. Information about those providers is set out in our Privacy Policy.

Notice of changes

Cloudpepper gives customers at least thirty (30) days’ prior notice before adding or replacing a Sub-processor. Notice is given by updating this page and, where the customer has designated a contact for sub-processor change notifications, by email to that contact. Customers who wish to receive change notifications by email can subscribe by writing to privacy@cloudpepper.io with the subject line “Sub-processor notifications” and the email address to use.

Where a Sub-processor must be replaced on shorter notice for security, availability, legal or commercial reasons, we will provide notice as soon as reasonably practicable in the circumstances.

Right to object

As set out in Section 5.4 of the DPA, customers may object to the addition or replacement of a Sub-processor on reasonable grounds relating to data protection by giving written notice within thirty (30) days of the notice referred to above. The parties will discuss the objection in good faith with a view to reaching a commercially reasonable resolution. If no resolution can be reached, the customer may, as their sole and exclusive remedy, terminate the affected portion of the Services without penalty, with a refund of any pre-paid fees covering the period after the effective date of termination.

Contact