Sub-processors

What this page is

A sub-processor is a third party that processes personal data on our behalf. Under GDPR Article 28, a processor must tell its clients who those parties are and give them a chance to object before a new one is engaged.

This page covers the sub-processors involved in running this website. Sub-processors for a specific client engagement are listed in that engagement's data processing agreement.

Sub-processors for this website

The set is deliberately small, because the site does very little. There is no advertising network, no marketing automation platform, no chat widget vendor, and no font network, so none of those appear here. There is one analytics provider, Google, and it only receives anything if you allow the Analytics category.

Google is not listed as a sub-processor for the map on our Contact page, and the reason is worth stating rather than leaving to inference. That map does not load unless you ask for it, we send Google nothing about you, and we receive nothing back. If you do load it, Google receives your IP address and browser details directly from your own browser and acts as a controller in its own right for that, not as a processor for us. Your choice is the thing that starts it, and you can decline it and still have the full address, phone number and a plain link out.

Each provider is engaged under a written agreement and is bound by confidentiality and security obligations at least as protective as our own. For hosting, the database and email, each acts only on our instructions. For analytics, Google is engaged under its own data processing terms, and the extent to which Google processes that data for its own purposes rather than solely on our instructions is fixed by those terms rather than by us. Role requires contractual verification, and we would rather say so than print a claim about Google's status that we cannot evidence here.

Sub-processors in client projects

When we build or operate a system for a client, the sub-processors involved depend entirely on that client's architecture and their own choices of cloud provider, payment processor, communications platform, and so on. It would be misleading to publish a single list here as though it applied to every project.

Instead, every engagement that involves personal data has a data processing agreement that names its sub-processors specifically, and that agreement governs. Clients receive advance notice of any addition, as described below.

The controller and processor roles are set out in the Privacy Policy.

How we select and govern them

• We engage a sub-processor only where there is a genuine operational need, and we prefer fewer.
• Each is assessed for security, and for whether their commitments match what we have promised our clients.
• Each is bound by a written contract imposing GDPR Article 28 obligations.
• Where a sub-processor is outside the EEA or the UK, transfers rely on Standard Contractual Clauses with the UK Addendum where applicable.
• We remain fully liable to our clients for the performance of any sub-processor we engage.

Notice of changes, and your right to object

Where we act as processor for a client, we give advance written notice before adding or replacing a sub-processor that will handle that client's personal data. The client may object on reasonable data protection grounds, and we will work with them to find an alternative. Where none can be found, the client may terminate the affected services without penalty.

Notice periods are set in each data processing agreement, and that agreement takes precedence over this page.

Requesting the definitive list

Clients and prospective clients can request the current, engagement-specific sub-processor list, our standard data processing agreement, and our ISO 27001 scope statement:

• Email hello@agiletech.vn
• Phone (+84) 989 324 830