Sub-Processor List
- Effective date:
- 24 August 2026
- Review date:
- 23 August 2027
1. Purpose
This list identifies the sub-processors currently engaged by Waivern Limited to process personal data on behalf of its customers (who act as controllers) in connection with the services provided under Waivern Limited’s Data Processing Agreement. This list is incorporated by reference into that Agreement and constitutes the authorised sub-processor schedule for the purposes of Article 28(2) and Article 28(4) of the UK GDPR. Customers are notified of any addition, removal or material change to this list in accordance with the sub-processor change provisions of the Data Processing Agreement.
2. Sub-Processor List
| Sub-processor (vendor) | Corporate entity / group | Service provided and nature of processing | Categories of personal data processed | Location(s) of processing | International transfer mechanism (if processed outside the UK) | Status |
|---|---|---|---|---|---|---|
| Vercel | Vercel Inc. | Primary hosting and infrastructure for the Waivern platform and marketing website. Processes personal data included in customer traffic and support interactions. | IP addresses, system configuration information, name, email address, phone number, account preferences, support communication content. | United States (primary); global edge network | UK IDTA (Article 46, UK GDPR) | Confirmed |
| Amazon Web Services (AWS) | Amazon Web Services, Inc. / Amazon Web Services EMEA SARL | Cloud infrastructure, data hosting, storage and backups. Processes personal data hosted within the customer-selected AWS region, including as a sub-processor to Vercel. | Any personal data uploaded by the customer to AWS-hosted services, which may include account data, usage data and content determined by the customer. | Customer-selected AWS region; EU regions available: France, Germany, Ireland, Italy, Spain, Sweden; also Switzerland and United Kingdom. Transfers outside the selected region only where necessary. | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Microsoft Azure | Microsoft Corporation | Cloud hosting and infrastructure, including as a sub-processor to Vercel and via Microsoft 365 / Entra ID for staff identity and authentication services. | Authentication data, identity data, account and contact information, communications content. | United States (global); EU/EEA data boundary services available | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Google Cloud Platform (GCP) | Google LLC / Google Ireland Limited | Cloud data storage and platform infrastructure, including as a sub-processor to Vercel. | Data relating to individuals provided via the services, as determined by the customer. | Customer-selected region; global data centre locations | EU SCCs 2021 (Article 46, UK GDPR - applied to UK GDPR context) | Confirmed |
| Railway Corporation | Railway Corporation | Backend infrastructure and application hosting for Waivern services. | Profile and contact data, payment data, commercial data, device and IP data, web analytics, social network data, company account data, company usage data. | United States | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Anthropic | Anthropic, PBC | Large language model (LLM) provider. Processes customer data submitted to the Waivern Compliance Tool to generate compliance analysis and outputs. | Data categories determined by the customer in accordance with the agreement, which may include business and professional information, compliance documentation content and associated personal data. | United States | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| OpenAI | OpenAI OpCo, LLC (OpenAI Ireland Ltd. for EEA/Switzerland-based customers) | Large language model (LLM) provider (fallback). Processes customer data submitted to the Waivern Compliance Tool where OpenAI is used as a fallback AI provider. | Names, contact information, demographic information, any other information provided by end users in unstructured data. | United States (San Francisco, CA); EEA (OpenAI Ireland Ltd.) | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| GitHub | GitHub, Inc. (a Microsoft company) | Source code hosting and version control for Waivern’s engineering organisation. May process personal data included in code repositories, commit metadata and associated communications. | Basic personal data (name, email address), authentication data, pseudonymous identifiers, device identification data, any personal data included in hosted repository content. | United States; any country in which GitHub or its sub-processors operate | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Google Workspace | Google LLC / Google Ireland Limited | Productivity suite and email for Waivern staff. Processes personal data included in staff email, documents and collaboration tools. | Data relating to individuals provided via the services by or at the direction of the customer or its end users, including staff communications and business correspondence. | United States / Ireland; global data centre locations | EU SCCs 2021 (Article 46, UK GDPR - applied to UK GDPR context) | Confirmed |
| Salesforce / Slack | Salesforce, Inc. (and applicable SFDC group entities) | Team communication and messaging platform for internal Waivern staff communications. | First and last name, title, position, employer, contact information (company, email, phone, physical business address), ID data, professional life data, personal life data, localisation data. | United States | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Postmark (ActiveCampaign) | AC PM LLC | Transactional email delivery. Processes personal data of email recipients in connection with service-related communications. | Email address, name, IP address, location, operating system, browser, device, email client, message metadata and content, spam complaint data. | United States | UK Extension to the EU-US Data Privacy Framework (Article 45 adequacy) | Confirmed |
| Mailchimp | The Rocket Science Group LLC d/b/a Mailchimp (an Intuit company) | Email marketing and newsletter distribution. Processes contact data of marketing subscribers and prospects. | Identification and contact data (name, address, contact details), marketing preferences, IT information (IP addresses, usage data, cookies data, browser data). | United States; any location where Mailchimp, its affiliates or sub-processors maintain data processing operations | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Stripe | Stripe, LLC / Stripe Payments Europe, Limited (SPEL) | Payment card processing and billing. Processes financial and identity data of customers making payments for Waivern services. | Payment method account details, bank account details, billing and shipping address, name, order description, device ID, email address, IP address and location, order ID, payment card details, tax ID, unique customer identifier, government-issued identity documents. | United States; global (Stripe affiliates and sub-processors in other jurisdictions) | UK IDTA (Article 46, UK GDPR - referenced in DPA) | Confirmed |
| Canva | Canva Pty Ltd (entity identified on the applicable Order Form) | Design and visual content creation tool used by Waivern staff. Processes personal data submitted by users within the platform. | Personal data submitted by users through use of the service, which may include images, names and contact details of individuals depicted or referenced in design content. | Global (Australian headquarters); processing locations as listed at canva.com/policies/subprocessors | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Miro | RealtimeBoard, Inc. d/b/a Miro | Online whiteboarding and visual collaboration tool used by Waivern staff. Processes personal data submitted by users to the platform. | Any personal data submitted to the service under the customer’s Miro account, which may include names, contact details and content shared in collaboration boards. | United States (San Francisco, CA); any country in which Miro, its subsidiaries or sub-processors maintain facilities | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| LinkedIn Ireland Unlimited Company (and LinkedIn Corporation as identified on the applicable ordering document) | Advertising and analytics platform. Processes personal data of website visitors and marketing audiences via the LinkedIn Insight Tag and advertising campaign tools. | Member pseudonym, IP address, device and browser characteristics, timestamp, URL (Insight Tag data); hashed email address, employer, job title, country, mobile device IDs (matched audience and advertising data). | United States (primary data centres) | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed | |
| Meta | Meta Platforms, Inc. (and applicable Meta group entities) | Advertising and analytics platform. Processes personal data of website visitors and advertising audiences in connection with Waivern’s use of Meta advertising products. | Online identifiers, device data, advertising interaction data and other data as described in Meta’s advertising terms. | United States; European Union / EEA; other countries | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| Google (Ads and Analytics) | Google LLC / Google Ireland Limited | Web analytics and advertising performance measurement for the Waivern website. Processes personal data of website visitors. | Online identifiers, pseudonymous advertising data, IP address, device and browser characteristics, session and interaction data, advertising conversion data. | Global; data centre locations as published by Google | EU SCCs 2021 (Article 46, UK GDPR - applied to UK GDPR context) | Confirmed |
| Usercentrics / Cookiebot | Usercentrics A/S | Consent management platform. Records and manages cookie consent signals for visitors to www.waivern.com. | Consent ID, consent date and time, consent state, user agent (browser vendor and version, operating system), HTTP agent, HTTP referrer, URL visited, user language, IP address, geolocation. | EU/EEA (Ireland - Microsoft Azure primary; Netherlands - hot failover); EU (Bunny CDN); United States (Akamai CDN) | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR - noting the transfer mechanism was not fully specified in the DPA on file; confirmed via supplementary review) | Confirmed |
| ElevenLabs | ElevenLabs, Inc. (as defined in the Agreement) | Text-to-speech and voice AI services. Processes audio and text content submitted by users in connection with voice AI product features. | Audio or video recordings, text input, other content uploaded by or on behalf of the customer. ElevenLabs is currently used only for internal testing; no client data is currently processed through ElevenLabs. | EEA (primary); United Kingdom; Switzerland; Brazil; United States (via sub-processors listed at compliance.elevenlabs.io) | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
| WhatsApp LLC / WhatsApp Ireland Limited (Meta group) | Business messaging platform. Processes personal data of contacts communicated with via WhatsApp Business services. | Customer contact information as described in the WhatsApp Business Terms. | EEA (primary - WhatsApp Ireland Limited); United States; other countries globally | UK Addendum to EU SCCs 2021 (Article 46, UK GDPR) | Confirmed |
3. Change Notification and Maintenance
This list is the authoritative, current record of the sub-processors engaged by Waivern Limited and is incorporated into and referenced by the Data Processing Agreement. Customers have granted general advance authorisation for the engagement of sub-processors in accordance with the terms of that Agreement.
Waivern Limited shall inform affected customers in advance, and in any event before any change takes effect, of any intended addition or replacement of a sub-processor, so as to give each customer the opportunity to object to the proposed change.
A customer that objects to an intended change may terminate its Data Processing Agreement and Main Agreement, without penalty for the act of termination itself, by giving written notice within thirty (30) days of Waivern Limited’s communication of the change. If a customer does not exercise this right within that thirty (30) day period, the change shall be deemed accepted and the new or replacement sub-processor may be engaged.
This list is reviewed upon any addition, removal or material change of a sub-processor, and at least annually. The Data Protection Officer is accountable for maintaining this list and ensuring that it remains accurate and current.