Sub-processor List
PoodleCollective uses certain third-party service providers in delivering its services.
This page identifies third parties that may act as sub-processors where PoodleCollective processes personal data on behalf of a client and uses that provider as part of that processing.
A provider listed below is only a sub-processor in circumstances where it actually processes Client Personal Data on PoodleCollective's behalf.
Current sub-processors
Google Workspace
Service: Google Workspace, including Google Drive, Docs, Sheets and Gmail.
Purpose: Business productivity, document storage, collaboration and email.
Client Personal Data that may be processed:
Personal data may be processed where information supplied by or accessed on behalf of a client is included in documents, spreadsheets, files or communications used by PoodleCollective to provide the Services.
This does not include ordinary business contact and account information that PoodleCollective processes as a controller in its own right.
Cloudflare
Service: Cloudflare website infrastructure, DNS, caching, content delivery, security and related services.
Purpose: Website delivery, performance, caching, DNS management and security.
Client Personal Data that may be processed:
Depending on the Cloudflare services used, this may include IP addresses, request information, technical identifiers, security information, logs and other data transmitted through the client's website.
Cloudflare is treated as a PoodleCollective sub-processor only where PoodleCollective provides or controls the relevant Cloudflare service on the client's behalf.
Where the client contracts with and controls its own Cloudflare account directly, Cloudflare is not engaged by PoodleCollective as a sub-processor.
Zume Hosting
Service: Website and server hosting.
Purpose: Hosting websites, applications, databases and associated website infrastructure.
Client Personal Data that may be processed:
Depending on the website being hosted, this may include website account information, customer information, ecommerce information, form submissions, IP addresses, server logs and other Personal Data stored or transmitted through the hosted website or application.
Zume Hosting is treated as a PoodleCollective sub-processor only where PoodleCollective provides or controls the relevant hosting service on the client's behalf.
Where the client contracts with and controls its own Zume Hosting account directly, Zume Hosting is not engaged by PoodleCollective as a sub-processor.
Processing locations / transfers:
Personal Data may be processed outside the UK where permitted under Applicable Data Protection Law. Where a restricted transfer is initiated by PoodleCollective, an appropriate lawful transfer mechanism will be used.
Services that are not normally sub-processors
PoodleCollective also uses development tools and services that do not ordinarily process Client Personal Data on our behalf.
GitHub and GitLab may be used to store website or application source code. PoodleCollective does not intentionally store Client Personal Data, production databases, passwords, API keys, access tokens or other sensitive credentials in source-code repositories.
Where a repository would be used to Process Client Personal Data on behalf of a Client, the relevant provider will be treated as a Sub-processor where required by Applicable Data Protection Law and added to the Sub-processor List.
Locally installed development tools, code editors and terminal applications, including tools such as Zed, VS Code and macOS Terminal, are not third-party processors merely because they are used by PoodleCollective to work on client systems.
AI-assisted development tools are not treated as Sub-processors solely because they are used during development. Where an AI service processes Client Personal Data on behalf of PoodleCollective, that provider will be treated as a Sub-processor where required by Applicable Data Protection Law.
Changes to sub-processors
The Client gives PoodleCollective general authorisation to use Sub-processors in accordance with the PoodleCollective Data Processing Terms.
Where we intend to appoint a new Sub-processor or replace an existing Sub-processor involved in Processing Client Personal Data, we will provide affected Clients with reasonable advance written notice in accordance with our Data Processing Terms.
We will also update this Sub-processor List to reflect the change.
Clients may object to a proposed change where they have reasonable grounds relating specifically to the protection of their Personal Data.
Further information
More information about how PoodleCollective processes Client Personal Data, engages sub-processors and handles international data transfers is available in our Data Processing Terms.