Why sub-processors matter
Websites and SaaS platforms may use third-party providers for hosting, infrastructure, security, analytics, communication, support, payment, email delivery, backups or operational tooling.
Website context
The public website may involve hosting providers, security services, analytics tools, form handling and communication services depending on the live configuration. The privacy and cookie policies should match the technologies actually in use.
Customer service context
For customer services, the relevant sub-processor list should be provided through the applicable agreement, data processing addendum, security pack or procurement response.
Provider changes
Provider lists can change as services evolve. Material changes should be managed according to the customer contract and data processing terms where applicable.
Due diligence
Providers should be reviewed for role, data access, security, location, retention, service importance and contractual protections where relevant.
Supplier categories
Relevant supplier categories may include hosting, domain and DNS services, server management, analytics, email delivery, CRM, support desk, payment processing, backup, monitoring, security tools and professional advisers. The exact list should match the live service setup.
Data access assessment
Not every supplier has the same access. Review should consider whether the provider stores personal data, only transmits it, has administrative access, processes logs, hosts files, supports the system or merely provides a public resource.
Customer notification
Where customer contracts require notice of new or replacement sub-processors, the notice route, objection period and consequences should be set out in the applicable agreement or data processing addendum.