Sub-processor policy
Last updated: 5th August, 2024
To ensure the provision of our Services, Consent Kit may engage and use data processors with access to certain Customer Data or Personal Information (each, a “Subprocessor”). This page provides information about each Subprocessor.
Please email support@consentkit.com if you have any questions.
Data categories
Consent Kit has two categories of data.
- Customer: Is defined as being a Consent Kit user, a customer. A person who has an log-in to Consent Kit. For example a researcher or research ops person.
- Participant: Is defined as a person who the User or User’s Organisation is doing research with. Participant data is collected and managed by the User.
Participant sub-processors
A list of the sub-processors that Consent Kit uses to process and store Participant data.
Application
Sub-processors that store and process Participant data in the application.
| Name | Purpose | Data processed | Processing location | Safeguard |
|---|---|---|---|---|
| Heroku | Host our application and data stores Manage SSL |
Research data |
EU 🇪🇺
USA 🇺🇸
|
Standard Contractual Clause |
| AWS | Secure storage for uploaded consent | Files |
EU 🇪🇺
|
Standard Contractual Clause |
| Sparkpost | Email provider - Application emails | Name, Email address |
EU 🇪🇺
|
Standard Contractual Clause |
| Postmark | Email provider - Application emails (US alternative) |
Name, Email address |
USA 🇺🇸
|
Standard Contractual Clause |
| Mailgun | Email provider - Bulk emails sent to participants | Name, Email address |
EU 🇪🇺
|
Standard Contractual Clause |
Customer sub-processors
A list of the sub-processors that Consent Kit uses to process and store Customer data.
These services do not hold participant data unless outlined above.
Application
Sub-processors that store and process Customer data in the application.
| Name | Purpose | Data processed | Processing location | Safeguard |
|---|---|---|---|---|
| Heroku | Host our application and data stores Manage SSL |
Application data |
EU 🇪🇺
USA 🇺🇸
|
Standard Contractual Clause |
| AWS | CDN and customer logos | Files |
EU 🇪🇺
|
Adequacy Agreement |
| Postmark | Email provider - Application emails | Name, Email address |
USA 🇺🇸
|
Standard Contractual Clause |
| Sparkpost | Email provider - Application emails (EU alternative to Postmark) |
Name, Email address |
EU 🇪🇺
|
Adequacy Agreement |
| Stripe | Payment processor | Payment details |
UK 🇬🇧
|
Adequacy Agreement |
| AppSignal 1 | Monitoring and error tracking | Name, Email address |
EU 🇪🇺
|
Adequacy Agreement |
| Segment | Data management and analytics | Name, Email address |
USA 🇺🇸
(migration to EU in progress) |
Standard Contractual Clause |
| Mixpanel | Product analytics. (Data received from Segment) |
See Segment data |
EU 🇪🇺
|
Adequacy Agreement |
| Intercom 2 | Customer support. (Data received from Segment) |
See Segment data |
USA 🇺🇸
(migration to EU in progress) |
Standard Contractual Clause |
| Userlist 3 | Promotional email delivery | Name, Email address |
USA 🇺🇸
|
Standard Contractual Clause |
- Sometimes data is processed to help troubleshoot support issues.
- Only processed when support is contacted.
- Only is you have subscribed to our newsletter. Newsletter and onboarding emails can be opted out of
To protect Customer data when transferring outside the UK, We have the appropriate safeguards in place with all of our subprocessors.
We do not, and will never sell any data to third parties.
We never contact your participants directly.
Get help
Can't find what you are looking for?