Recipients and Subprocessors
This register names every processor and every other recipient that receives personal data from us. Where a provider does not disclose a further body that receives data through it, we state that body's category. Part A is the list of subprocessors under § 9 of our Data Processing Agreement. The register also forms part of our Privacy Policy.
"Location" states where the body processes the data. "Safeguard" states the basis on which data reaches a country outside the European Economic Area.
Part A: Subprocessors
These bodies process the data that we process on behalf of our customers.
| Body | Service | Location | Safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting | EU (Frankfurt); provider based in the USA | standard contractual clauses |
| Neon (Databricks, Inc.) | Database | EU (Frankfurt); provider based in the USA | EU-US Data Privacy Framework; standard contractual clauses |
| Google Cloud EMEA Limited (Google Cloud and Firebase) | File storage | EU (Frankfurt) / USA | EU-US Data Privacy Framework; standard contractual clauses |
| Plus Five Five, Inc. (Resend) | Email delivery | USA; sending via EU region | EU-US Data Privacy Framework; standard contractual clauses |
| Google Cloud EMEA Limited (Gemini API) | AI reading of selected documents | USA and other Google locations | EU-US Data Privacy Framework; standard contractual clauses |
| OpenAI Ireland Ltd. | AI property valuation; AI reading of selected documents | Ireland / USA | Standard contractual clauses |
| Google Cloud EMEA Limited (Google Workspace) | Our mailbox: email communication with customers and handling enquiries | Ireland / USA and other Google locations | EU-US Data Privacy Framework; standard contractual clauses |
Part B: Our processors for our own purposes
As our processors, the bodies in Part A also process the account, contract and usage data for which we are the controller. The bodies below are not subprocessors.
| Body | Service | Location | Safeguard |
|---|---|---|---|
| Google Ireland Limited (Google Analytics) | Statistics on our public pages and the checkout page, only with consent | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
| Stripe Payments Europe, Limited | Managing and billing our subscriptions | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
Part C: Independent controllers
These bodies process the data they receive under their own responsibility.
| Body | Service | Location | Safeguard |
|---|---|---|---|
| Google (Google Maps Platform) | Address suggestions while you type; map on share pages | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
| Google (Sign in with Google) | Signing in with your Google account | Ireland / USA | EU-US Data Privacy Framework |
| Stripe Payments Europe, Limited | Executing payments, fraud prevention and Stripe's legal obligations | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
| OpenStreetMap Foundation | Determining the district from coordinates | United Kingdom | Adequacy decision (Art. 45 GDPR) |
| Search providers that OpenAI uses for its web search | Answering the search queries of the market research in an AI property valuation; the search queries reach the search provider through OpenAI | Not published by OpenAI | Not published by OpenAI |
Part D: Joint controller
| Body | Service | Location | Safeguard |
|---|---|---|---|
| Meta Platforms Ireland Limited | Meta Pixel and Conversions API: measuring and targeting our advertising, only with consent. Joint controller under Art. 26 GDPR for collection and transmission; processor for measurement and matching | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
Part E: Services your browser contacts directly
When contacted, the service receives your IP address and browser data. Your browser loads Google Analytics and the Meta Pixel (Parts B and D) only with your consent.
| Body | Trigger | Role | Location | Safeguard |
|---|---|---|---|---|
| Stripe | Payment form on the checkout page and the billing pages | Independent controller | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
| Google (Google Fonts) | Typeface of Stripe's payment form | Independent controller | Ireland / USA | EU-US Data Privacy Framework |
| Google Cloud EMEA Limited (Google Cloud and Firebase) | Uploading and downloading files | Processor (Part A) | EU (Frankfurt) / USA | EU-US Data Privacy Framework; standard contractual clauses |
| Google (Google Maps Platform) | Map on a share page, after you open it | Independent controller | Ireland / USA | EU-US Data Privacy Framework; standard contractual clauses |
Changes
We notify customers of any intended addition or replacement of a subprocessor (Part A) under § 9 of the Data Processing Agreement. We voluntarily also give customers at least 30 days' notice before a joint controller (Part D), or an independent controller that receives data we process on behalf of our customers (Part C), is added. We announce changes to Parts B to E that concern new purposes, categories of recipients or third-country transfers as described in the Privacy Policy.
The effective date of this version is displayed above this document.