This list names every company outside Web and Cloud Innovation Ltd that stores, transmits or otherwise processes personal data as part of running the Service, and states exactly what each one can see. It forms part of the Data Processing Agreement.
We will publish a change here and tell you at least thirty (30) days before a new sub-processor starts, so that you can object if you have grounds.
1Who They Are
| Sub-processor | What it processes, and why |
|---|---|
| The hosting provider | The server, the database and the uploaded files of your installation. Everything the Service holds is stored on infrastructure it operates. |
| Google Ireland Limited | Offsite backups held in a private Drive folder; automated reading of an uploaded document to copy its printed details into a record; delivery of the typefaces the pages use, which discloses the reader's network address to Google; and, only if you switch it on, sign-in with a Google account. |
| Microsoft Ireland Operations Limited | Only if you switch it on: sign-in with a Microsoft account. It sees the identity of the person signing in, and nothing else. |
| Your outgoing mail provider | The invoices, reminders, notices and portal invitations the Service sends, with the recipient's address and the content of the message. You configure this yourself, and it is usually your own mail host. |
2What Is Not A Sub-Processor
Two connections send nothing about anybody, and are named here only so that the list is complete.
The Airbnb calendar sync fetches a private calendar file that you supply the address for. It is a download. Nothing about a tenant, a guest or a member of staff is sent to Airbnb by the Service.
WhatsApp links open a conversation in the sender's own WhatsApp on their own device. The Service composes a link; it does not transmit a message or a number to Meta.
3Where The Data Is
The Service is operated from Malta. Your installation is hosted in the region agreed with you, and backups are held in the Drive account you nominate.
Where a transfer of personal data protected by the GDPR leaves the European Economic Area, it is covered as clause 10 of the Data Processing Agreement describes. Where personal information protected by RA 10173 leaves the Philippines, the same clause applies.
4The One We Are Often Asked About
An uploaded identification document may be read once by Google's Gemini service, solely to copy the printed details into the tenant's record so that nobody has to type them.
The document is sent for that single reading, is not used to train any model, and the result is written into your own database. If you would rather it never happened, the reader can be switched off in Settings, and the details are typed by hand instead.
5Questions
legal@premises.ph