Sub-processors
This page lists every sub-processor engaged by Signedup to process personal data on behalf of our customers, as required by Article 28 of the UK General Data Protection Regulation. A sub-processor is a third party we engage, as your processor, to carry out processing for you as controller. Each is engaged under a written contract imposing the data protection obligations that clause 7.2 of our data processing agreement describes, and we remain responsible to you for each of them as that agreement sets out.
The purpose against each entry describes the processing that sub-processor carries out on our instructions. The country stated is where the personal data concerned is held. Where a supplier is incorporated in, or belongs to a group based in, a country other than the one where the data is held, that is stated too, because the law of the supplier's home country is a matter a controller is entitled to assess for itself.
Cloudflare, Inc.
Delivery of this website and the product to your browser, protection against automated abuse, and storage of files uploaded for import and of the nightly backup copies of your data, together with counting visits to this website without cookies. Stored data is held in the European Union. Incorporated in the United States.
Neon, Inc.
Hosting of the database in which your lists, records and consent history are held. United Kingdom. Incorporated in the United States.
Amazon Web Services EMEA SARL
Delivery of the emails the service sends, such as sign-in and confirmation links and requests to check details, and reports of messages that bounce or are marked as unwanted. United Kingdom. Part of a group based in the United States.
Microsoft Ireland Operations Limited
Our own mailboxes, used when you or the people on your lists write to us. Holds correspondence rather than list records. United Kingdom. Part of a group based in the United States.
Functional Software, Inc. (Sentry)
Receives a report when a page or request fails, so that we find out. Configured not to receive network addresses or personal data. Germany. Incorporated in the United States.
Stripe Payments Europe, Limited
Processing of payment for a subscription. Card details are provided directly to Stripe and are never received by us. Stripe also acts as an independent controller for some payment information, under its own privacy notice. Ireland, with onward transfer to the United States.
Where data is held, and transfers
Personal data at rest is held in the United Kingdom or the European Union. Of the suppliers above, three are incorporated in the United States (Cloudflare, Inc., Neon, Inc., Functional Software, Inc. (Sentry)), and the others belong to groups based there, so personal data may be accessed from the United States, for example for support, and payment information is transferred there by our payment provider.
Where such a transfer needs a safeguard, it relies on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or on the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018. Clause 12 of our data processing agreement sets out the mechanisms in full.
Changes to this list
We will give at least 30 days' notice before a new or replacement sub-processor starts to process personal data on your behalf, by updating this page and by emailing your organisation's account owner. Where a sub-processor has to be replaced urgently to protect the security of your data or to keep the service running, we may give shorter notice, or tell you as soon as practicable afterwards.
You may object to a change by writing to privacy@signedup.io within the notice period, on reasonable grounds relating to data protection. We will discuss the objection with you in good faith. If we cannot reasonably accommodate it, your sole remedy is to end your agreement with us before the change takes effect, in which case we will refund any fees you have paid for the period after it ends. If you do not object within the notice period, you are treated as having accepted the change. Clause 7 of our data processing agreement governs these terms.
Questions about our sub-processors
For further information about any sub-processor named above, write to privacy@signedup.io. We will share what we reasonably can, subject to the confidentiality terms our suppliers impose on us.
Changes to this document
This version was published on 15 September 2026. The notice terms above apply to changes to the list, and this page always shows the date it last changed.