# Sub-processor List: [Provider name]

> Format for the public list of sub-processors that a processor (for
> example a SaaS provider) engages to process customers' personal data,
> with the change notice and objection process. Based on GDPR Art.
> 28(2) and 28(4) (Regulation (EU) 2016/679; the UK GDPR has the same
> article numbers). Replace every `[bracketed]` value and every row
> marked *Example*.
> **This is a documentation format, not legal advice.** Check the current text and your
> data processing agreements before publishing.

<!--
Guidance: How to use this template
- Under general written authorisation, Art. 28(2) requires the
  processor to inform the controller of intended additions or
  replacements so that the controller can object. This page plus a
  notification channel is the usual way to do that. The notice period
  and objection process must match your DPA (legal-lite/dpa, section 7
  and Annex III).
- Art. 28(4) requires the same data protection obligations to be
  imposed on each sub-processor by contract; the processor stays fully
  liable for them. Do not list a provider here until that contract is
  signed.
- List every entity that can access customer personal data, including
  your own affiliates and support providers, not only hosting.
-->

| Field | Value |
|---|---|
| Document ID | [PRIV-SUB-001] |
| Provider (processor) | [Legal name] |
| Owner | [@owner, Privacy] |
| Last updated | YYYY-MM-DD |
| Notice period for changes | [30] days before the new sub-processor starts processing |
| Subscribe for change notices | [Link to subscription form or RSS feed] |

## Current sub-processors

<!-- Guidance: One row per legal entity. Give the location of processing, not only the company's head office, and the transfer tool where data leaves the EU, EEA or UK (compliance/transfer-impact-assessment). -->

| ID | Sub-processor (legal entity) | Service provided | Personal data processed | Location of processing | Transfer tool | Since |
|---|---|---|---|---|---|---|
| SUB-001 | [Hosting provider] | [Cloud hosting and storage] | [All customer data] | [EU region (country)] | [None needed] | YYYY-MM-DD |
| SUB-002 | [Email delivery provider] | [Transactional email] | [Names, email addresses] | [Country] | [SCCs (EU) 2021/914 / adequacy decision] | YYYY-MM-DD |
| SUB-003 | [Support tool provider] | [Customer support tickets] | [Contact details, ticket content] | [Country] | [Tool] | YYYY-MM-DD |
| SUB-004 *(Example)* | Ferncliff Hosting GmbH (fictional) | Hosting for Tarnwick Forms | All form content and account data | Germany | None needed | 2026-01-05 |

### Affiliates

| ID | Affiliate | Role | Location | Transfer tool |
|---|---|---|---|---|
| SUB-AFF-001 | [Group company] | [Follow-the-sun support] | [Country] | [Intra-group SCCs] |

## Changes and objections

<!-- Guidance: Describe the exact process agreed in the DPA. State how customers object, within what time, and what happens if you cannot accommodate the objection. -->

1. We announce an intended new or replacement sub-processor on this
   page and by [email to subscribed contacts] at least [30] days before
   it starts processing personal data.
2. A customer may object on reasonable data protection grounds by
   writing to [privacy@example.com] within [the notice period].
3. We will discuss the objection in good faith and, where possible,
   offer an alternative. If we cannot, the customer may [terminate the
   affected service and receive a refund of prepaid fees for the unused
   period], as set out in the DPA.
4. In an emergency (for example to keep the service secure or
   available) we may replace a sub-processor at shorter notice and will
   explain why.

## Change log

| Date announced | Change | Sub-processor | Effective date |
|---|---|---|---|
| YYYY-MM-DD | [Added / Removed / Location changed] | [Name] | YYYY-MM-DD |
| 2026-11-02 *(Example)* | Added: transactional email for form receipts | Wrenmoor Mail Ltd (fictional), Ireland | 2026-12-02 |

## Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR), Art. 28(2) and 28(4),
paraphrased in original words; the UK GDPR uses the same article
numbers. Related templates: legal-lite/dpa,
compliance/transfer-impact-assessment, legal-lite/privacy-policy.
This is a documentation format, not legal advice. Original text written
for this collection; examples are fictional.
Template licence: MIT.