Legal
Sub-processors
Version 1.0, last updated · Draft
Draft. This document is being reviewed by a solicitor before RunYourBlock opens to customers, and may change. Questions: [email protected].
These are the companies we use to provide RunYourBlock that may process personal data. For data a block's company puts into the app, they are our sub-processors under our Data Processing Agreement.
Customer data in the app is hosted in the United Kingdom. The table shows the few cases where data travels further, and the safeguards that apply.
| Provider | What it does for us | Data it handles | Where | Safeguards |
|---|---|---|---|---|
| Amazon Web Services (hosting) | Hosts the app, its database, uploaded documents and backups | All customer data and account data | United Kingdom (AWS Europe (London) region) | AWS Data Processing Addendum with the UK GDPR Addendum. No transfer outside the UK. |
| Amazon Web Services (Simple Email Service) | Sends emails from the app and the website, such as sign-in codes, notifications and messages directors send to residents | Recipient names and email addresses, and the content of each email while it is being delivered | Ireland (AWS Europe (Ireland) region) | AWS Data Processing Addendum with the UK GDPR Addendum. Ireland is treated by the UK as adequate. Amazon Web Services, Inc. is certified under the UK Extension to the EU-US Data Privacy Framework. |
| Hetzner Online | Runs our mail server, which passes emails from the app and the website to Amazon Simple Email Service and holds our own mailbox | Recipient names and email addresses, and the content of each email | Germany | Hetzner Data Processing Agreement (UK GDPR Article 28). Germany is treated by the UK as adequate. |
| Stripe | Takes payment for RunYourBlock subscriptions and runs the billing portal | The block company's billing details, and the account owner's name and email address. Not residents' data. | United States and Ireland | Stripe Data Processing Agreement. Stripe, LLC is certified under the UK Extension to the Data Privacy Framework, with the UK International Data Transfer Addendum as a fallback. |
| Cloudflare | Runs our domain name system (DNS), delivers the website and app quickly and protects them from attacks | Technical data about each request (such as IP address) and the content passing through, which it doesn't store beyond short-lived caches of public pages | Global network, normally the data centre nearest the user | Cloudflare Data Processing Addendum with standard contractual clauses and the UK Addendum. Cloudflare, Inc. is certified under the UK Extension to the Data Privacy Framework. |
What is not on this list
- Your block's bank. Leaseholders pay your company's own bank account. We never receive or hold that money, and your bank isn't our sub-processor.
- Our professional advisers, such as our accountant, who don't have access to customer data.
Changes to this list
We'll give the account owner of every block at least 30 days' notice by email before we add or replace a sub-processor that will handle customer data. If you object on reasonable data protection grounds, tell us. If we can't resolve your concern, you may end your subscription before the change takes effect and we'll refund any fees paid for the period after that.
Questions: [email protected]