Legal
Sub-processors
Last updated: 2026-05-09
Innkept engages the third parties listed below to help us provide our service. Some are required for the platform to function (always-on); others only become relevant when an operator switches an integration on in their analytics settings.
We act as a processor under UK GDPR and the Data Protection Act 2018. The operator (the venue or caterer running our widget) is the controller. Each sub-processor below is engaged under a written contract that includes the data-protection clauses required by Article 28 UK GDPR.
Always-on
Required for the platform to function.
| Name | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting + database | Germany | N/A (EU) |
| Cloudflare, Inc. | CDN, WAF, DNS | Global edge | UK Data Bridge |
| Postmark (ActiveCampaign LLC) | Transactional email | United States | UK Data Bridge |
| Sentry (Functional Software) | Error monitoring | United States | UK Data Bridge |
| Stripe Payments UK Ltd | Subscription billing | United Kingdom | N/A |
Operator opt-in
Only engaged when an operator switches the corresponding integration on in Settings → Analytics & tracking. Disabled by default for new accounts.
| Name | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC (GA4) | Server-side conversion replay | United States | UK Data Bridge |
| Meta Platforms Ireland Ltd | Conversions API (Lead event) | Ireland / US | UK Data Bridge |
| TikTok Information Tech UK Ltd | Events API | UK / Ireland / SG | UK Addendum |
International transfer mechanisms
UK Data Bridge: the UK Extension to the EU-US Data Privacy Framework (in force October 2023). Used for US-based sub-processors that have self-certified, currently including Google LLC and Meta Platforms.
UK Addendum: the ICO's International Data Transfer Addendum to the EU SCCs. Used where a sub-processor has not self-certified to the DPF.
IDTA: the UK International Data Transfer Agreement. Stand-alone equivalent to the EU SCCs, used where the EU SCCs aren't already in place.
Copies of the executed transfer mechanisms with each sub-processor are available on request to operators with a signed DPA, in accordance with Clause 8.9(b) of the UK Addendum.
Get notified when this changes
We'll email you whenever a sub-processor is added, removed, or replaced. No marketing — only sub-processor change notifications and significant DPA revisions.
Confirm via the link we'll send you. Unsubscribe any time from the link in any notification email.
Operators with a signed DPA may object to a new sub-processor within 30 days of notification by writing to legal@innkept.com. Reasonable objections will be addressed by either replacing the sub-processor or by allowing the operator to terminate the affected portion of the service without penalty.