/ legalsubprocessors
Subprocessors
Last updated 6 October 2026
The third parties below process personal data on our behalf to help us deliver the NDGM platform and website. We engage each under written terms that meet UK GDPR Article 28, and where data is transferred outside the UK an appropriate safeguard applies.
We give at least 30 days’ notice before adding or replacing a subprocessor. Customers may object on reasonable data-protection grounds — to receive change notices, email [email protected] and ask to join the subprocessor notification list.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare | DNS, DDoS protection and TLS termination at the edge — routing metadata only | Global anycast network (US-headquartered) | UK Extension to the EU–US Data Privacy Framework |
| Scaleway SAS (Iliad Group) | Transactional email delivery (SMTP relay) for account, security and notification emails — recipient address and message body | France (European Union) | UK adequacy regulations (EU/EEA) — no transfer outside the EEA |
| Dedicated infrastructure | Compute and storage for the platform — processes all customer data. AI inference is performed in end-to-end encrypted enclaves (see Venice.ai) | United Kingdom | No international transfer — UK-hosted |
| Venice.ai, Inc. (Wyoming, USA) | AI inference for platform features and the Ask NDGM website assistant — data is end-to-end encrypted to attested hardware enclaves; Venice relays ciphertext only and does not retain prompts or outputs | United States | Details on request — [email protected] |
| Phala Network (enclave operator, via Venice.ai) | Hosts the confidential-computing enclaves (Intel TDX) in which encrypted AI requests are decrypted and processed — data is inaccessible to the operator by hardware isolation. NDGM accepts only Phala enclaves | United States (US-West) and India | Details on request — [email protected] |
| Meta Platforms (WhatsApp) | Internal notifications to the NDGM team about website enquiries, demo requests and Ask NDGM questions — website visitors only, no platform customer data | Global (US-headquartered) | Details on request — [email protected] |
Self-hosted (Sovereign) deployments run entirely within the customer’s own estate; in that mode none of the above process customer data on our behalf. This list reflects our hosted service and is kept current.