1. What this page is
Under UK GDPR Article 28(2), a processor that engages another processor (a "sub-processor") must do so only with the prior written authorisation of the controller. This page is that authorisation in published form, by entering or maintaining a subscription with VerySEOly, you authorise the sub-processors listed below. It is also the canonical reference that any signed DPA between us points to.
2. The standing list
These seven sub-processors touch personal data on every visit or for every subscriber. Our own Plausible Community Edition server, on OVHcloud hardware in France, runs the cookieless analytics on veryseoly.com, and Sentry captures the visitor IP address when it records an error.
| Sub-processor | Role | Residency | Data category | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Static hosting + CDN + edge functions; Vercel Analytics + Speed Insights | United Kingdom, London region lhr1 (Vercel Inc. is US-incorporated) | Page renders, server logs (IP, user-agent), first-party Analytics + Speed Insights telemetry (cookieless) | DPA + UK IDTA Addendum (for any US support routing); ISO 27001 + SOC 2 Type II |
| Hetzner Online GmbH | Infrastructure for the server that runs our database (PostgreSQL, operated by us, since 10 October 2026) | European Union, Nuremberg (Germany); Hetzner Online GmbH is a German company | The email address and website address of anyone who uses the Site Score's “Email it to me” box, kept up to 12 months for the follow-up emails; the records of the proposals we send (when each is viewed, with a hashed form of the viewer's IP address and their browser and device type, and whether it is accepted or declined, with any reason given). Enquiries sent through our forms are not stored here: they are recorded in our business system, under OVHcloud below | No international transfer: EU company, EU data centre. Hetzner's standard Article 28 data processing agreement (AVV); ISO 27001-certified data centres. The database accepts connections only over TLS with a client certificate we issue |
| Scaleway SAS | Transactional email for the forms on this site (Scaleway TEM, Paris), which carries your enquiry to our inbox and your Site Score report to you, and off-site storage of the database's nightly backups | European Union, Paris (France); Scaleway SAS is a French company | The enquiries sent through our forms, on their way to our inbox; your email address and the Site Score report we send you; backup files of our database (the categories above), encrypted on our own server before upload (Scaleway holds ciphertext only and we hold the keys) | No international transfer: EU company, EU region. Scaleway's standard Article 28 data processing agreement, part of its contractual terms |
| Cloudflare, Inc. | DNS + inbound email routing + CDN edges | European Union + United Kingdom edge POPs | DNS queries, inbound email forwarded to our mailbox | DPA + UK IDTA Addendum; ISO 27001. Documented exception (global network kept by design). |
| OVHcloud (OVH Limited) | Hardware for our own analytics server (Plausible Community Edition, which counts pageviews on veryseoly.com without cookies), for our business system (Odoo, which we run ourselves: the enquiries sent through this site's forms, quotes, invoices and client records; Odoo S.A., which publishes the software, receives no enquiry data), and for our remote-support relay, used only when you ask for a remote session | France (Gravelines) | Cookieless pageview records with no personal profiles and no shared identifiers, kept 24 months; enquiries (your name, email, phone, business name, message and the website address you give us), kept up to 12 months and then deleted unless they become a project; client contact and billing records, quotes and invoices, kept for the engagement plus six years for accounting; for remote sessions, the device ID, IP address and connection time, deleted after 90 days, never session content | DPA; EEA |
| Functional Software, Inc. (Sentry) | Error monitoring (captures the visitor IP at the point of an error) | European Union (de.sentry.io ingest region; Functional Software, Inc. is US-incorporated) | Error events with stack trace, URL, browser/device, and visitor IP address | DPA + UK IDTA Addendum; EU ingest region pinned |
| Proton Mail (Proton AG) | The email we send you about quotes and invoices, from billing@ticketwavehq.com; and mailboxes for clients who had one set up before 10 October 2026 (new business email is set up by Dacros, another trading name of TicketWave HQ Ltd) | Switzerland | Your name and email address and the content of the quotes and invoices we send; email content for named client mailboxes | DPA; Swiss data-protection adequacy (UK and EU recognised) |
2a. Conditional engagements (not standing processors)
The following are not standing sub-processors. They are engaged only in the circumstances stated, and are listed here for transparency. MailerLite is the EU platform for our own newsletter, engaged when you subscribe to it (double opt-in); Plain is engaged only when a helpdesk add-on is included in your engagement. A CRM set up as part of an engagement is opened in your name, under your own contract with its provider; it processes data for you, not for us, so it is not a sub-processor of ours.
| Provider | When engaged | Residency | Data category | Transfer safeguard |
|---|---|---|---|---|
| Resend, Inc. | Outbound email for account and billing notices, engaged only when those flows are switched on; not in use at 11 October 2026 (the site's forms are sent through Scaleway TEM, above) | European Union (EU region) | Recipient email, message content, send/open metadata | DPA + UK IDTA Addendum (Resend, Inc. is US-incorporated; EU-region infrastructure by selection) |
| MailerLite (UAB "MailerLite") | Our own newsletter, subscriptions and broadcasts with double opt-in (activated July 2026) | European Union (Lithuania) | Newsletter subscriber email + signup source + send metadata | DPA under UK / EU GDPR; EU-established processor; any transfer outside the UK or EEA under SCCs / UK IDTA Addendum |
| Plain | Helpdesk, engaged only when a helpdesk add-on is included in your engagement | United Kingdom (London-based) | Support tickets, message content, end-user email | DPA; UK data controller |
| Plausible Insights OÜ (Plausible Analytics cloud) | Cookieless web analytics for a client site whose analytics we still run in Plausible's cloud, engaged only until that site moves to our own analytics server | European Union (Germany) | Aggregated, cookieless pageview counts for that client site; no personal profiles and no shared identifiers | DPA; EU-hosted |
3. International transfers
Our default architecture keeps personal data on UK or EU infrastructure. Several vendors are US-incorporated or operate global networks: Cloudflare (DNS + edge) is a documented exception kept by design; Vercel (London hosting + support routing), Resend (EU-region email, when those flows are enabled), and Sentry (EU ingest region, de.sentry.io) each store the relevant personal data inside the UK or EEA while their parent companies are US-incorporated. For each, any transfer outside the UK and EEA is protected by the UK International Data Transfer Agreement / Addendum to the EU SCCs (or an equivalent safeguard, including UK adequacy regulations where they exist).
Hetzner and Scaleway are EU companies operating EU data centres (Nuremberg and Paris), so our database and its backups involve no international transfer at all.
Proton Mail, for mailboxes set up before 10 October 2026, is Swiss-resident. The UK recognises Switzerland under adequacy regulations, so no IDTA is needed.
4. Notification of changes
Before we add a new sub-processor that will process your personal data, we will give you at least 30 days' written notice by email to the address on file. The notice will include the sub-processor's name, role, residency, data category, and transfer safeguard. You may object on reasonable data-protection grounds within that window; if we cannot accommodate your objection, you may terminate the subscription with a pro-rata refund of any prepaid Fees covering the period after termination.
To subscribe to sub-processor change notifications without being a current client, email hello@veryseoly.com with the subject "Subscribe to sub-processor changes".
5. Audit + verification
Each sub-processor listed above has a Data Processing Agreement in place with us; we hold copies of their published security certifications (ISO 27001, SOC 2, PCI DSS) where applicable. Clients on an active retainer may request copies of the signed DPAs we hold, email hello@veryseoly.com and we will respond within 5 working days.
6. Related documents
Data Processing Agreement · Privacy Policy · Cookie Policy · All legal documents
7. Changelog
- v1.13, 2026-10-20, corrected two entries that overstated what we keep. Hetzner's entry said that the database on its server holds the name, email, phone, message and sector you send through our forms. Enquiries were never stored there: they are emailed to us through Scaleway and recorded in our business system, under OVHcloud. What this site keeps in that database is the email address and website address of anyone who uses the Site Score's “Email it to me” box, for up to 12 months, for the follow-up emails, and the records of the proposals we send, so it is no longer called our lead / client database. Scaleway's entry said that it sends enquiry acknowledgements, which this site does not send; it carries your enquiry to our inbox and your Site Score report to you. These correct descriptions of what was already happening: no sub-processor is added or removed, so the 30-day notice in section 4 does not apply.
- v1.12, 2026-10-20, enquiries sent through this site's forms are now also recorded in our business system, Odoo, which we run on our own server at OVHcloud in Gravelines, France; OVHcloud's entry now lists them, kept up to 12 months unless they become a project. Odoo S.A., which publishes the software, receives no enquiry data. OVHcloud was already a standing sub-processor, so no new sub-processor is added. The summary no longer says we keep no CRM of our own, and no longer calls Proton Mail conditional, which it has not been since v1.11; section 2 now counts the seven standing sub-processors its table lists.
- v1.11, 2026-10-15, OVHcloud now also hosts our business system (quotes, invoices and client records, backed up encrypted to Scaleway), and Proton Mail moves to the standing list because the quotes and invoices we email come from billing@ticketwavehq.com through it.
- v1.10, 2026-10-12, removed Capsule CRM from the conditional list: VerySEOly keeps no CRM of its own (enquiries and client records live in our own database), and a CRM we set up for a client is the client's own account and contract, not a processor engaged by us.
- v1.9, 2026-10-12, removed Stripe Payments Europe Ltd.: VerySEOly no longer takes card payments or subscriptions through this site (fees are invoiced by email, and card details never passed through this site), so there is no payment processor to disclose. Six standing sub-processors remain.
- v1.8, 2026-10-11, analytics for this site moved from Plausible's cloud to our own Plausible Community Edition server, so OVHcloud is now a standing sub-processor (analytics and the remote-support relay) and Plausible Insights OÜ is listed only for a client site still on its cloud. The version line at the top now matches this changelog (it still said 1.5).
- v1.7, 2026-10-11, corrected the email provider: the forms on this site are sent through Scaleway TEM (Paris), not Resend, and Scaleway's entry now says so; Resend moves to the conditional list, engaged only when account and billing notices are switched on. Seven standing sub-processors.
- v1.6, 2026-10-11, the lead / client database moved from Neon Postgres (Frankfurt) to PostgreSQL on a server we operate at Hetzner (Nuremberg, EU), with encrypted nightly backups stored at Scaleway (Paris, EU). Neon Inc. leaves the standing list; Hetzner Online GmbH and Scaleway SAS join it. Eight standing sub-processors.
- v1.5, 2026-10-10, added OVHcloud, which hosts the remote-support relay and is engaged only for remote sessions.
- v1.4, 2026-10-10, Proton Mail now covers only client mailboxes set up before 10 October 2026, because new business email is set up by Dacros, another trading name of TicketWave HQ Ltd; "retainer" now reads as engagement.
- v1.3, 2026-10-07, removed Cal.com (scheduling), which is no longer used: calls are booked by phone or through the contact form. Seven standing sub-processors remain.
- v1.2, 2026-07, activated the newsletter and adopted MailerLite (UAB, Lithuania) as the EU newsletter platform in place of the earlier self-hosted Listmonk plan. Double opt-in is enforced: a subscriber stays "unconfirmed" and receives no campaigns until they click the confirmation link.
- v1.1, 2026-06, corrected the standing list to eight data-touching sub-processors: added Neon Postgres (lead / client database, Frankfurt/EU), Sentry (error monitoring, captures visitor IP, EU ingest), and Cal.com (scheduling). Disclosed Plausible as the cookieless analytics running on
veryseoly.comitself and removed the inaccurate "not used on this site" note. Reclassified Capsule CRM, Listmonk, Plain, and Proton Mail as conditional / add-on rather than standing processors. - v1.0, 2026-06-03, promoted from a section of
/complianceto a standalone canonical disclosure, with transfer safeguards added per-vendor.