Sub-processors
The companies that process personal data for Trent GECO Limited when we provide Trivet.
Who they are
| Company | What they do | Personal data | Where | Transfer safeguard |
|---|---|---|---|---|
| Google (Google Cloud EMEA Limited and its affiliates, including Google LLC) | Hosting the app (Firebase): the database, file storage, server functions, encryption keys, backups, sign-in, push notifications, server logs, and reCAPTCHA bot protection | Everything stored in the app; sign-in details; browser and device signals for bot protection | London (europe-west2) for the database, files, functions, encryption keys and backups. Sign-in accounts, push notification delivery, reCAPTCHA and the delivery of the app’s web pages are global services and may be processed in the United States and elsewhere | Google’s Cloud Data Processing Addendum, which includes the UK International Data Transfer Addendum, and the UK Extension to the EU-US Data Privacy Framework for Google LLC |
| Brevo (Sendinblue SAS, France) | Sending the app’s emails: sign-in links, invitations, reminders, digests and support replies | Name, email address and the content of each email | The European Union (Brevo states its data centres are in France, Germany and Belgium) | UK adequacy regulations for the European Economic Area |
| MXroute LLC (United States) | Our mailboxes, including hello@trivet.digital | Whatever you put in an email to us | The United States | The UK International Data Transfer Agreement |
| Automatic driving licence checks (DVLA Access to Driver Data, directly or through a provider) (not in use yet) | Checking driving licences, only when an organisation turns on automatic checks | Driver name, date of birth, licence number and the licence record | The United Kingdom | None needed (no transfer outside the UK) |
Payments
Stripe (Stripe Payments Europe Limited, Ireland, and its affiliates) takes subscription payments for us. Card and bank details go straight to Stripe and never reach us. Where: The European Union and the United States. Transfer safeguard: UK adequacy regulations for the EEA, and the safeguards in Stripe’s own data processing terms for the United States.
If your organisation takes booking payments, it does so through its own Stripe account, under its own agreement with Stripe. Stripe is then your provider, not ours.
Changes
We email each organisation’s owner and admins at least 30 days before we add or replace a sub-processor, and update this page. How to object is in section 6 of our data processing terms.