Sub-processors
Version 2.1.0 · Effective date: 17 October 2026 · AcademyApp
1. Sub-processors
These companies process academies' data on AcademyApp's behalf, under contract.
| Company | Service | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure | Platform data | EU (Germany / Finland) | UK adequacy regulations |
| Amazon Web Services | Cloud storage, backups and content delivery | Files and content uploaded to the platform | United Kingdom; global delivery network | None needed (UK); UK Addendum to the EU Standard Contractual Clauses |
| Cloudflare, Inc. | Domain name and network services | Website addresses and technical data | USA / global | UK Extension to the EU-US Data Privacy Framework |
| Stripe | Payment processing | Payer details and payment information | EU / USA | UK Extension to the EU-US Data Privacy Framework; UK Addendum to the EU Standard Contractual Clauses |
| GoCardless Ltd | Direct Debit | Payer details and bank details | UK / EU | None needed (UK); UK adequacy regulations |
| Twilio Inc. | SMS and messaging | Phone numbers and message content | USA | UK Extension to the EU-US Data Privacy Framework |
| Meta Platforms | WhatsApp messaging | Phone numbers and message content | EU / USA | UK Extension to the EU-US Data Privacy Framework |
| Resend | Email delivery | Email addresses and email content | USA | UK Extension to the EU-US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical and usage data | EU | UK adequacy regulations |
| OpenAI, L.L.C. | AI features (How we use AI) | Content submitted to AI features, minimised | USA | UK Extension to the EU-US Data Privacy Framework or UK International Data Transfer Agreement; zero data retention |
| OpenStreetMap Foundation | Maps and address lookup | Address searches and technical data | United Kingdom | None needed (UK) |
Stripe and GoCardless also act as independent controllers for their own legal checks, such as identity verification and fraud prevention.
2. Providers an academy connects itself
Where an academy connects its own account with a third-party provider, that provider acts under the academy's own contract with it.
3. AcademyApp's own website
For academyapp.co.uk, AcademyApp is the controller. The website is hosted by Hetzner, and uses PostHog (EU) for analytics only after the visitor's consent.
4. Changes
AcademyApp gives academies at least 30 days' notice before adding or replacing a sub-processor, as set out in the Data Processing Agreement.