Subprocessors and other recipients
Version 2.0 · Effective from 2026-08-22
What this page covers
This page lists the third parties that receive personal data when ClickMeats runs the website, mobile apps, marketplace, payments, notifications, analytics and support operations.
The recipients are split into two groups, because they do not have the same legal role:
- Processors and sub-processors act only on our instructions, under a UK GDPR Article 28 processor agreement. This is the list our merchants authorise when they accept the Data Processing Schedule in the Platform Terms.
- Other recipients acting as independent controllers decide their own purposes for at least part of what they do with the data. They are not sub-processors, and we cannot direct that processing. Their own privacy terms apply to it alongside ours.
For the broader explanation of how we use personal data, read our Privacy Policy.
Processors and sub-processors
Each of these providers processes personal data on our behalf, on our documented instructions, under an Article 28 processor agreement.
| Provider | Contracting entity | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL | Cloud hosting, API hosting, Lambda compute, database and file storage, monitoring, secrets, backups, and the Cognito authentication service used for sign-in, account verification and password reset. | Account data, order data, merchant and shop data, support and admin data, documents uploaded for merchant onboarding, authentication metadata and password hashes, technical logs and configuration data. | Production infrastructure and the Cognito user pool are configured in AWS Europe (London), eu-west-2, in the United Kingdom. | No restricted transfer arises for data at rest, because production storage and authentication remain in the United Kingdom. Where AWS support or operational access involves a transfer outside the UK, the UK Addendum to the EU SCCs incorporated in the AWS Data Processing Addendum applies. |
| Resend | Resend, Inc. | Transactional email delivery for receipts, order updates, refunds, account and merchant communications. | Recipient email address, email subject, email body, delivery status, message metadata and related technical logs. | Resend processes data in the United States and other locations used to provide email delivery. | UK Addendum to the EU SCCs, incorporated in the Resend data processing agreement. |
| Vercel | Vercel, Inc. | Website hosting, deployment, server-side rendering, routing, static asset delivery and website request logs. | IP address, browser and device metadata, request metadata and limited technical logs. Order and account records remain in AWS and are not intentionally cached by Vercel. | Serverless functions and server-side rendering are pinned to Vercel London (lhr1) in the United Kingdom. Static assets are served from a global edge network, which may handle request metadata outside the UK. | No restricted transfer arises for function execution and rendering, because these are pinned to the London region. For edge routing metadata handled outside the UK, the UK Addendum to the EU SCCs incorporated in the Vercel Data Processing Addendum applies. |
| PostHog EU Cloud | PostHog, Inc. | Opt-in product analytics to understand how users interact with the website and mobile apps. | Pseudonymous usage events, page and screen views, button clicks, device and browser metadata, and analytics identifiers. No analytics data is collected at all unless the user opts in. | PostHog EU Cloud, hosted in the European Union (Frankfurt). | No Article 46 safeguard is required for storage, because the data is held in the European Union and is covered by the UK adequacy regulations for the EEA. Where PostHog support access from the United States involves a transfer, the UK Addendum to the EU SCCs incorporated in the PostHog data processing agreement applies. |
| Sentry | Functional Software, Inc. | Error monitoring, crash reporting, performance diagnostics and technical fault investigation. | Crash and error data, stack traces, device and browser metadata, performance data, session identifiers where configured, and limited technical context. Session Replay is disabled. Our ClickMeats account data, project settings and authentication tokens are held in the United States even where error events are stored in a European region. | Sentry processes data in the United States, and in the EEA where a European region is configured for event storage. | UK Addendum to the EU SCCs, incorporated in the Sentry Data Processing Addendum. |
| Google Firebase Cloud Messaging | Google Ireland Limited | Android push-notification delivery and mobile messaging infrastructure. | Push-notification tokens, device identifiers, message metadata and delivery diagnostics. The visible alert is content-free — no shop name, address, collection time, customer name or item detail. The delivery payload does carry an internal order reference and a notification type, so the app can open the right screen when tapped. | Google processes data globally to provide Firebase and messaging services. | UK Addendum to the EU SCCs, incorporated in the Google Cloud and Firebase data processing terms. |
| Cloudflare | Cloudflare, Inc. | DNS, domain security, DDoS protection and traffic routing. | IP address, DNS and request metadata, security logs and technical routing data. | Cloudflare operates a global network and may process limited technical data outside the UK and EEA. | UK Addendum to the EU SCCs, incorporated in the Cloudflare Data Processing Addendum. |
| Namecheap | Namecheap, Inc. | Domain registration, and the Private Email service that operates the ClickMeats business mailboxes. Because our published contact address is a Namecheap-hosted mailbox, this service carries our customer support, complaint, data-rights and merchant enquiry correspondence. | Business contact details and domain registration data. For the email service: the full content of messages sent to and from our business mailboxes, including sender and recipient addresses, subject lines, message bodies, attachments, and any personal data a correspondent chooses to include, together with mailbox and delivery metadata. | Namecheap processes data in the United States and other locations used to provide domain and email services. | Confirmation requested from Namecheap. The written Article 46 instrument for the Private Email service is not yet verified, so no specific safeguard is asserted here. |
Other recipients acting as independent controllers
These recipients are listed for transparency. They are not sub-processors, so they do not form part of the Article 28 authorisation given under the Data Processing Addendum.
| Recipient | Contracting entity | Purpose | Data categories | Why they are a controller | Location | Transfer mechanism |
|---|---|---|---|---|---|---|
| Stripe | Stripe Payments UK Limited | Payment processing, payment authentication, refunds, receipts, connected merchant accounts and payouts. Separately, Stripe carries out its own fraud screening, sanctions and anti-money-laundering checks, and regulatory record-keeping. | Payment details, payment method data, billing and contact data, order amount, payment references, refund data, fraud and verification data, and merchant payout and onboarding data. | For fraud screening and for the record-keeping and financial-crime obligations it carries as an authorised payment institution, Stripe decides its own purposes and means. For that processing it is a controller in its own right and not our sub-processor. | Stripe processes data in the UK, EEA, United States and other locations needed to provide payment services. | Stripe Payments UK Limited is the UK contracting entity. For its own controller purposes Stripe relies on its own lawful bases and transfer mechanisms. Where Stripe processes on our instructions, the UK Addendum to the EU SCCs incorporated in the Stripe data processing agreement applies. |
| Apple Push Notification service | Apple Inc. / Apple Distribution International Limited | iOS push-notification delivery. | Device token, an internal order reference, a notification type, and delivery diagnostics. The visible alert is content-free — no shop name, address, collection time, customer name or item detail. The order reference is carried so the app can open the right screen when the alert is tapped; it is meaningless without access to our systems. | Apple does not offer developers a UK GDPR Article 28 processor agreement for the Apple Push Notification service, and determines its own purposes for operating that service. It therefore receives the device token as an independent controller rather than as our processor. | Apple processes data globally to provide push-notification services. | Apple’s own developer and service terms govern the transfer. ClickMeats does not rely on an Article 28 processor route for APNs. Because the alert itself is content-free, what reaches Apple is limited to the device token, an internal order reference and a notification type. |
International transfers
ClickMeats keeps personal data in the United Kingdom wherever we control where it sits. Our production backend, database, file storage and authentication all run in AWS Europe (London), and our website functions and server-side rendering are pinned to Vercel's London region.
Where a recipient does process personal data outside the UK, the specific mechanism we rely on for that recipient is named in the tables above. We do not use a general “appropriate safeguards” formula, because a transfer needs a route that can actually be identified.
We do not rely on the UK Extension to the EU-US Data Privacy Framework for any recipient listed on this page. We also do not treat a user's consent to analytics as a transfer mechanism: analytics consent governs whether we collect the data at all, and is a separate question from how a transfer is lawfully made.
We keep a transfer risk assessment for the recipients above and review it when we add, remove or materially change a recipient.
Changes to this list
We update this page when we add, remove or materially change a recipient. If a change materially affects how your personal data is processed, we will update the version and effective date and provide any notice required by law or by our contracts.
Contact
Questions about this list or how ClickMeats uses service providers can be sent to admin@clickmeats.co.uk.