/ legalsubprocessors
Subprocessors
Last updated 29 June 2026
The third parties below process personal data on our behalf to help us deliver the NDGM platform and website. We engage each under written terms that meet UK GDPR Article 28, and where data is transferred outside the UK an appropriate safeguard applies.
We give at least 30 days’ notice before adding or replacing a subprocessor. Customers may object on reasonable data-protection grounds — to receive change notices, email [email protected] and ask to join the subprocessor notification list.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare | DNS, DDoS protection and TLS termination at the edge — routing metadata only | Global anycast network (US-headquartered) | UK Extension to the EU–US Data Privacy Framework |
| Scaleway SAS (Iliad Group) | Transactional email delivery (SMTP relay) for account, security and notification emails — recipient address and message body | France (European Union) | UK adequacy regulations (EU/EEA) — no transfer outside the EEA |
| Dedicated infrastructure | Compute, storage and AI inference for the platform — processes all customer data | United Kingdom | No international transfer — UK-hosted |
Self-hosted (Sovereign) deployments run entirely within the customer’s own estate; in that mode none of the above process customer data on our behalf. This list reflects our hosted service and is kept current.