Sub-processors
Who handles data for us, where, and under what safeguard. The list our Data Processing Agreement and privacy notice point to.
Five providers stand behind this website, our enquiries and our business records: Vercel, Scaleway, Proton, Cloudflare and OVHcloud. All hold data in the UK, the EU or Switzerland; Vercel and Cloudflare are US-incorporated and are named as the exceptions they are. The tools that will run managed IT plans are listed in section 3 as rows to be named: none of them handles client data yet, and none will until it is named here with its residency and safeguard. We give clients at least 30 days' notice before adding a sub-processor that will process their data.
1. What this page is
Under UK GDPR Article 28(2), a processor may engage another processor (a sub-processor) only with the controller's prior written authorisation. This page is that authorisation in published form: by starting or continuing an engagement with Dacros, you authorise the sub-processors listed here, and it is the canonical list that section 7 of our Data Processing Agreement refers to. It is also the list behind the providers named in our privacy notice, for the data we hold as controller.
2. Our own systems: the standing list
These providers handle data for every visitor to this website, every enquiry, and every client's quotes and invoices.
| Provider | Role | Residency | Data | Safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosts this website, pinned to the London (lhr1) region. The contact form's server function runs here and passes each enquiry to Scaleway for delivery. | United Kingdom (London). Vercel Inc. is US-incorporated. | Server logs (IP address, user agent, pages requested); each contact-form enquiry in transit. | Data processing agreement with the UK Addendum to the EU standard contractual clauses. |
| Scaleway SAS | Transactional email (Paris): sends each contact-form enquiry on to our inbox. Also holds the encrypted off-site copies of our business-system backups. | France (Paris). Scaleway SAS is a French company. | The name, business, email, phone and message you submit, in transit; backup files encrypted on our own server before upload, so Scaleway holds ciphertext only. | No international transfer: EU company, EU region. Scaleway's standard data processing agreement, part of its contractual terms. |
| Proton AG (Proton Mail) | Our business mailbox, hello@dacros.com, where enquiries and anything you email us are received and kept; and billing@ticketwavehq.com, from which the quotes and invoices we email are sent. | Switzerland. | Enquiries and correspondence; your name, email address and the content of the quotes and invoices we send you. | The UK recognises Switzerland under adequacy regulations, so no further safeguard is needed. Proton's data processing agreement. |
| Cloudflare, Inc. | DNS, CDN and security in front of this website. | A global network of edge locations, including the UK and the EU. Cloudflare, Inc. is US-incorporated. | DNS queries and request metadata (IP address, user agent) as traffic passes through; no personal data is persisted at the edge. | Data processing agreement with the UK Addendum. A documented exception, kept by design: the network is global. |
| OVHcloud (OVH Limited) | Hardware in Gravelines, France, for three things we run ourselves: our analytics server (Plausible Community Edition, cookieless), our remote-support relay, and our business system (quotes, invoices and client records). | France (Gravelines). Our contract is with OVH Limited, the UK company. | Analytics: cookieless pageview records with no personal profiles, kept 24 months. Relay: the device's support ID, its IP address and the connection time, deleted after 90 days, with connection logs deleted after 7 days; never session content, which is encrypted end to end. Business system: client contact and billing records, quotes and invoices, kept for the engagement plus six years. | No international transfer: an EEA data centre. OVH Limited's data processing agreement, part of its contract. |
3. The managed IT toolchain
A managed IT plan is run with tools, and each tool that holds your data is a sub-processor. We have not yet chosen them, so we have not named them: a vendor is named here only once it is on our vendor register with a data processing agreement on file, and never before. Until a row is named, nothing in that row handles client data. Residency for every row: UK or EU where a suitable tool offers it, stated here when the tool is named. Safeguard for every row: a data processing agreement on file before the tool handles your data, and the notice in section 7.
| Tool | Vendor | Data it would hold |
|---|---|---|
| Remote monitoring and management (RMM): the agent that watches and patches devices | [To be named before the first plan is sold] | Device names and identifiers, signed-in usernames, IP addresses, installed software and patch state; remote control only during an attended session or on instruction. |
| Helpdesk (ticketing) system | [To be named before the first plan is sold] | The requester's name and email, the text of each request and its attachments, and the note of what was done. |
| Microsoft 365 or Google Workspace backup | [To be named before the first plan is sold] | A second copy of the mailboxes, files, calendars and contacts named in your Order: the largest single holding in a plan, and the row that matters most. |
| Password manager or IT documentation platform | [To be named before the first plan is sold] | The credentials we hold for you, and your network, device and configuration records. |
| DMARC reporting | [To be named before the first plan is sold] | Aggregate reports naming the servers that send mail as your domain (IP addresses and domains); no message content. |
| VoIP carrier (Complete plan, and telecoms projects) | [To be named before the first plan is sold] | Call records, numbers, voicemail and voicemail-to-email content, only where we administer your phone system. |
4. Your own providers, which we administer
Two providers appear in almost every plan without being sub-processors of ours: Microsoft (Microsoft 365) and Google (Google Workspace). Your tenant is yours, under your own contract with them, and they are your processors, not ours. We administer the tenant on the terms in section 4 of the DPA. Where its data sits depends on the tenant: a Microsoft 365 tenant keeps its core customer data at rest in the geography it was created in (the United Kingdom, for a tenant created here); Google Workspace lets an organisation choose a data region for data at rest on some editions and not on others. Both companies are US-incorporated. We record your tenant's region in the documentation we keep for you. If we ever supply licences to you, which we do not today, the position changes and this page will say so.
5. Conditional engagements
These are not standing sub-processors. Each is engaged only in the circumstance stated.
| Provider | When engaged | Residency | Data | Safeguard |
|---|---|---|---|---|
| WhatsApp LLC (part of Meta) | Only if you choose to message us through the WhatsApp link on our contact page. We do not start WhatsApp conversations. | United States: WhatsApp may store and process messages there. | Your number, your messages to us and ours to you. | WhatsApp's own terms and privacy policy apply, with its own transfer safeguards. Engaged by your choice, not ours. |
| A subcontractor for cabling or network installation | Only on a project that needs one, and only after we have told you who it is. We remain fully responsible for their work. | United Kingdom; named in the notice we give you. | Site contact details and access arrangements, nothing more. | Our contract with them, with confidentiality terms; no personal data from your systems is shared. |
6. International transfers
By default, data stays in the United Kingdom or the European Economic Area. Scaleway and OVHcloud are European companies with European data centres, so no international transfer arises for the data they hold. Proton is in Switzerland, which the UK recognises under adequacy regulations. Vercel serves this site from London and Cloudflare runs a global network; both are US-incorporated, and any transfer outside the UK and the EEA is covered by their data processing agreements with the UK Addendum to the EU standard contractual clauses. WhatsApp is engaged only by your choice, under its own terms. For the managed IT toolchain, residency and safeguard are stated in section 3 as each tool is named.
7. Notification of changes
Before we add a sub-processor that will process your data, we give you at least 30 days' written notice by email to the address on your Order, naming the provider, its role, residency, the data involved and the transfer safeguard. You may object on reasonable data protection grounds within that period. If we cannot meet your objection, you may end the engagement, and we refund any fee paid for the period after it ends. Naming a tool in section 3 counts as adding a sub-processor and carries the same notice.
To receive these notices without being a current client, email hello@dacros.com with the subject "Sub-processor changes".
8. Verification
Each provider in sections 2 and 5 has a data processing agreement with us, in its contract or signed separately. Clients on a plan may ask for copies of those agreements, and for the register entry behind any tool named in section 3: email hello@dacros.com.
9. Related documents
Data Processing Agreement · Plan terms · Privacy notice · Website terms of use
10. Changelog
- Version 1.0, 15 October 2026. First publication: the five standing providers behind this website, our enquiries and our business system; Microsoft and Google as the client's own processors; WhatsApp and project subcontractors as conditional; and the six managed IT tools listed as rows to be named before the first plan is sold.