Sub-processors

Last updated: 24 October 2026. The entries under "Who processes your records" are those stated in Annex 3 of the Data Processing Agreement, true as at 22 August 2026.

This is the list the privacy notice points at and the list the Data Processing Agreement authorises at clause 4.1. It is kept current.

Under clause 4.2 of that Agreement we give every customer at least thirty (30) days' written notice before engaging a new sub-processor, and a customer may object on reasonable data protection grounds under clause 4.3.

Who processes your records

These are the sub-processors engaged to deliver the service. Each is bound by a written contract with data protection obligations no less protective than those in our own Agreement, and we remain fully liable to you for what each of them does.

Sub-processor	What it does, and where	Transfer basis
Google Ireland Limited Google Cloud and Firebase	Hosting, database, file storage, authentication and server-side functions. Data stored in European Union regions (europe-west1).	Data stored in the EU. Support and engineering access from outside the EEA is governed by the Standard Contractual Clauses incorporated in the Google Cloud Data Processing Addendum.
Google Ireland Limited Firebase Crashlytics	Crash and error diagnostics from the application. Disabled by default and collected only with the individual user's consent. Carries no record entered into the service, no user identifier and no organisation identifier. Crashlytics offers no data location selection; reports may be processed and stored anywhere Google maintains facilities, including the United States. Retained by Google for 90 days.	Standard Contractual Clauses incorporated in the Google Cloud Data Processing Addendum.
Stadia Maps	Map tiles displayed when an individual clocks in or out. Receives the device's IP address and the tile coordinates requested. Does not receive any record entered into the service, and does not receive the clock-in location as a location: it receives the map area being viewed.	Standard Contractual Clauses in Stadia Maps' own terms.
Apple Distribution International Ltd	Distribution of the iOS application. Does not process records entered into the service.	Established in Ireland. No transfer of customer records.
Stripe Payments Europe, Limited	Subscription billing and payment processing. Processes the billing contact and payment details of the customer. Does not process the records entered into the service.	Established in Ireland. Where Stripe transfers data outside the EEA, that transfer is governed by the Standard Contractual Clauses in Stripe's own data processing terms.

For this website

This one counts visits to doorinspect.ie. It never sees the records in the service.

Sub-processor	What it does
Cloudflare	Web analytics: counts visits to this website. Receives visitors' IP addresses. Sets no cookies and does not track visitors across sites.

To be added before it is switched on: Google Play distribution, when the Android application ships. It will be notified under clause 4.2 before it goes live.

Who else sees data, and why they are not on the list above

The privacy notice also names three recipients of the small amount of data we hold as a controller in our own right, meaning account contacts, billing records and correspondence. They are recipients, not sub-processors, because they never process the records you create in the service.

Recipient	What they see
Our accountant	Billing and accounting records, under professional confidentiality obligations.
Our solicitor, if needed	Whatever a particular matter requires, under professional confidentiality obligations.
Revenue	What tax law requires.

Questions

Anything about this list, or an objection to a new sub-processor, goes to support@doorinspect.ie.