Sub-Processor List
- Effective date:
- 11 June 2026
- Review date:
- 11 June 2027
1. Purpose
This list identifies the sub-processors currently engaged by Waivern Limited to process personal data on behalf of its customers (who act as controllers in their relationship with Waivern). It is incorporated by reference into the Data Processing Agreement and constitutes the authorised sub-processor list contemplated by Article 28(2) and Article 28(4) of the UK GDPR. Customers are notified of additions, removals, or material changes to this list in accordance with the sub-processor change provisions set out in that Data Processing Agreement.
2. Sub-Processor List
| Sub-processor (vendor) | Corporate entity / group | Service provided and nature of processing | Categories of personal data processed | Location(s) of processing | International transfer mechanism (if processed outside the UK) |
|---|---|---|---|---|---|
| Vercel | Vercel Inc. | Primary hosting and infrastructure for the Waivern product and marketing site. Stores and serves customer data transmitted via the platform. | IP addresses, system configuration information, names, email addresses, phone numbers, account preferences, support communications, and any personal data submitted by customers via the platform. | United States (primary); global edge network via sub-processors (AWS, Microsoft Azure, GCP) | UK IDTA |
| Amazon Web Services (AWS) | Amazon Web Services, Inc. / Amazon Web Services EMEA SARL | Cloud infrastructure underlying Vercel (named Vercel sub-processor) and potentially used directly. Storage, compute, and database services. | Any customer data processed via AWS-backed services; may include all categories of personal data processed by Waivern’s platform. | Customer-selected AWS region; EU regions (France, Germany, Ireland, Italy, Spain, Sweden), Switzerland, United Kingdom; transfers outside selected region only where necessary | EU SCCs 2021 (Article 46); UK IDTA |
| Microsoft Azure | Microsoft Corporation / Microsoft Ireland Operations Limited | Cloud hosting and infrastructure. Named sub-processor of Vercel; also covered by the Microsoft Products and Services DPA for Waivern’s own use of Microsoft services. | Any personal data processed via Vercel infrastructure hosted on Azure; staff and customer data processed through Microsoft 365 services. | United States (global); EU/EEA (EU Data Boundary services) | UK Addendum to EU SCCs 2021 (Article 46); UK Extension to EU-US DPF (Article 45 adequacy) also available per Microsoft DPA |
| Google Cloud Platform (GCP) | Google LLC / Google Cloud EMEA Limited | Cloud data storage and platform services. Named sub-processor of Vercel; also used directly by Waivern. | Any personal data stored or processed via GCP-backed services. | Customer-selected region; global GCP data centre locations | EU SCCs 2021 (Article 46) per Google Cloud DPA; UK GDPR supplementary terms applied via SCCs |
| Railway Corporation | Railway Corporation | Backend infrastructure and application hosting. Processes profile and contact data, payment data, commercial data, device and IP data, web analytics, social network data, company account data, and company usage data. | Profile or contact data, payment data, commercial data, device/IP data, web analytics, social network data, company account data, company usage data. | United States | UK Addendum to EU SCCs 2021 (Article 46); governed by the laws of England and Wales for UK Addendum disputes |
| Anthropic | Anthropic, PBC | Large language model (LLM) provider - default AI/LLM for the Waivern Compliance Tool, processing compliance-related content submitted by customers. | Categories of personal data submitted by customers via the Waivern Compliance Tool, as determined by the customer in accordance with the agreement. | United States | UK Addendum to EU SCCs 2021 (Article 46); governed by Republic of Ireland law for EU SCCs |
| OpenAI | OpenAI OpCo, LLC / OpenAI Ireland Ltd. (for EEA/Switzerland customers) | Large language model (LLM) - fallback AI provider for the Waivern Compliance Tool. | Names, contact information, demographic information, and any other information provided by customers or end users in unstructured data. | United States (San Francisco, CA); EEA (OpenAI Ireland Ltd.) | UK Addendum to EU SCCs 2021 (Article 46); governed by the laws of England and Wales for SCC/UK Addendum disputes |
| GitHub | GitHub, Inc. (Microsoft group) | Source code hosting (organisation: waivern-compliance). Processes contributor and repository data including personal data of staff and collaborators. | Basic personal data (name, email address, username), authentication data, device identification data, and any personal data included in repository content. | United States; other countries in which GitHub or its sub-processors operate | UK Addendum to EU SCCs 2021 (Article 46); governed by UK law for UK Addendum |
| Google Workspace | Google LLC / Google Ireland Limited | Productivity suite and staff email. Processes staff personal data including communications, calendar data, and document content. | Staff identity data, email communications, calendar data, and document content. | United States; Ireland; global Google data centre locations | EU SCCs 2021 (Article 46) per Google Workspace DPA; UK GDPR supplementary terms applied via SCCs |
| Microsoft 365 / Microsoft Entra ID | Microsoft Corporation / Microsoft Ireland Operations Limited | Authentication and identity management for staff and product; productivity tools (Microsoft 365). Processes authentication credentials and associated identity data. | Authentication data, contact information, unique identification numbers, and any personal data processed through Microsoft 365 applications. | United States (global); EU/EEA (EU Data Boundary services) | UK Addendum to EU SCCs 2021 (Article 46); UK Extension to EU-US DPF (Article 45 adequacy) also available per Microsoft DPA |
| Stripe | Stripe, LLC / Stripe Payments Europe, Limited (SPEL) | Card payment processing. Processes payment and billing data for Waivern’s customers. | Payment method account details, bank account details, billing and shipping address, name, order description, device ID, email address, IP address and location, order ID, payment card details, tax ID, unique customer identifier, and identity documents where required for verification. | United States; global (Stripe affiliates and sub-processors in other jurisdictions) | EU SCCs 2021 and UK IDTA referenced in DPA |
| Postmark (ActiveCampaign) | AC PM LLC (ActiveCampaign group) | Transactional email delivery. Processes email recipient data and message metadata on behalf of Waivern. | Email address, name, message content (including attachments), metadata (IP address, location, operating system, browser, device, email client), spam complaints. | United States (AWS data centres; Deft/ServerCentral data centre) | UK Extension to the EU-US Data Privacy Framework (Article 45 adequacy); UK Addendum to EU SCCs 2021 (Article 46) as alternative if DPF unavailable |
| Mailchimp (Intuit) | The Rocket Science Group LLC d/b/a Mailchimp (Intuit group) | Email marketing and newsletter delivery. Processes marketing contact data and engagement data on behalf of Waivern. | Identification and contact data (name, address, contact details), marketing preferences, IT information (IP addresses, cookies data, online navigation data, location data, browser data). | United States; other locations where Mailchimp, its affiliates, or sub-processors maintain data processing operations | UK Addendum to EU SCCs 2021 (Article 46); EU-US DPF including UK Extension (Article 45 adequacy) as primary mechanism where available |
| Salesforce / Slack | Salesforce, Inc. and applicable SFDC group entities | Team communication and messaging. Processes staff communications and any personal data shared within the Slack workspace. | First and last name, title, position, employer, contact information, ID data, professional life data, localisation data of staff, contractors, and any third parties communicated with via Slack. | United States | UK Addendum to EU SCCs 2021 (Article 46); governed by the laws of England and Wales where the Agreement is governed by UK law |
| Canva | Canva Pty Ltd (entity identified on the Order Form) | Design and visual content creation. Processes personal data submitted by Waivern staff in the course of creating marketing and design materials. | Personal data submitted by Waivern staff or users to Canva through use of the service; personal data of third parties included in design content. | Global (Australian HQ); processing locations per Canva sub-processor list | UK Addendum to EU SCCs 2021 (Article 46, version B1.0) |
| Miro | RealtimeBoard, Inc. dba Miro | Online whiteboarding and collaboration. Processes personal data of staff and any third parties included in board content. | Any customer personal data submitted to Miro under Waivern’s account, including staff identity data and any content added to boards. | United States (San Francisco, CA); other locations per Miro sub-processor list | UK Addendum to EU SCCs 2021 (Article 46); EU-US DPF / UK Extension to EU-US DPF (Article 45 adequacy) as primary mechanism where applicable |
| Meta (Facebook) | Meta Platforms, Inc. / Meta Platforms Ireland Limited | Advertising and analytics. Processes personal data associated with advertising campaigns and audience targeting on Waivern’s behalf. | Advertising performance data as submitted to Meta by Waivern; may include IP addresses, device identifiers, behavioural and engagement data used for audience targeting and conversion measurement. | United States (primary); EU/EEA; other countries | UK Addendum to EU SCCs 2021 (Article 46) |
| LinkedIn Corporation / LinkedIn Ireland Unlimited Company (as identified on the applicable LinkedIn ordering document) | Advertising, analytics, and marketing. Processes Insight Tag data and matched audience and advertising criteria data on behalf of Waivern. Also used for recruitment. | Insight Tag data (member pseudonym, IP address, device/browser characteristics, timestamp, URL); marketing leads and matched audience contact targeting data (hashed email, employer, job title, country, mobile device IDs); advertising criteria via Real Time Bidding. | United States (primary data centres); EU (Glint EU data storage, optional) | UK Addendum to EU SCCs 2021 (Article 46); governed by England and Wales for UK personal data disputes | |
| Google Analytics | Google LLC / Google Ireland Limited | Web analytics. Processes website visitor data including behavioural and technical metrics on waivern.com on behalf of Waivern. Property G-SNNESL7MGP. | IP addresses, device identifiers, language setting identifiers, screen resolution, device type, operating system, user session data, click-event behaviour data, non-precise location data (city/country), conversion behaviour, user engagement data. | United States; other countries in which Google maintains facilities | UK IDTA and UK Addendum to EU SCCs |
| Google Ads / Google DoubleClick | Google LLC / Google Ireland Limited | Advertising conversion tracking and remarketing. Cookie-based tracking observed on waivern.com including conversion linker (_gcl_au) and DoubleClick test cookie on .doubleclick.net. | Advertising performance data; IP addresses, device identifiers, click-event and conversion behaviour data. | United States; other countries in which Google maintains facilities | UK IDTA and UK Addendum to EU SCCs |
| Usercentrics A/S (Cookiebot) | Usercentrics A/S | Consent management platform (CMP). Processes website visitor consent records on behalf of Waivern. | Consent ID, consent date and time, consent state, user agent (browser vendor and version, operating system), HTTP agent, HTTP referrer, URL visited, user language, IP address, geolocation. | EU/EEA (Ireland - Microsoft Azure primary; Netherlands - Microsoft Azure hot fail-over); United States (Akamai CDN sub-processor) | Primary processing in EU/EEA. Adequacy rating from UK means no mechanism required. |
| ElevenLabs | ElevenLabs, Inc. (as defined in the Agreement) | Text-to-speech and voice AI. Processes audio/voice content and text input submitted via the Waivern platform where voice features are used. | Audio or video recordings, text input, and other content uploaded by or on behalf of Waivern. | EEA (primary); United Kingdom; Switzerland; Brazil; United States (via sub-processors listed at compliance.elevenlabs.io) | UK Addendum to EU SCCs 2021 (Article 46) |
| SUPERFRUITS SAS (Gojiberry AI) | SUPERFRUITS SAS | LinkedIn and email marketing platform. Processes B2B prospect and lead data for marketing outreach campaigns on behalf of Waivern. | First and last name, location (country or city), job title and current position, LinkedIn URL and profile identifier, professional headline, industry and company information, company website and domain, business email address and phone number, intent signals, customer user account identifiers, campaign data, usage logs and interaction records. | European Union (AWS eu-west-3 / Paris, France); EU and US (certain sub-processors for communication, support, analytics, monitoring, payment processing, and B2B data enrichment) | EU SCCs 2021 (Article 46); |
| WhatsApp LLC / WhatsApp Ireland Limited | Business messaging. Processes customer contact and communications data via the WhatsApp Business service. | Customer contact information as described in the WhatsApp Business Terms; content of business communications with customers. | European Economic Area (primary - WhatsApp Ireland Limited); United States; other countries globally | UK Addendum to EU SCCs |
3. Change Notification and Maintenance
This list is the authoritative, current record of the sub-processors engaged by Waivern Limited, and it is incorporated into and referenced by the Data Processing Agreement. Customers have granted general advance authorisation for the engagement of sub-processors under that Agreement.
Waivern Limited shall inform affected customers in advance, and in any event before the change takes effect, of any intended addition or replacement of a sub-processor, so as to give each customer the opportunity to object.
A customer that objects to an intended change may terminate its Data Processing Agreement and Main Agreement, without penalty for the act of termination, by giving written notice within thirty (30) days of Waivern Limited’s communication of the change. If a customer does not exercise this right within that thirty (30) day period, the change is deemed accepted and the new or replacement sub-processor may be engaged.
This list is reviewed upon any addition, removal, or material change affecting a sub-processor, and in all cases at least annually. The Data Protection Officer (Vincent Nunan) is accountable for maintaining the accuracy of this list and for ensuring that any new sub-processor engagement is assessed against the requirements of Article 28 UK GDPR before that engagement commences.