Version 1.4 · Last updated 02 November 2026
DYNOMATIK SUB-PROCESSOR LIST
This is the list of sub-processors engaged by Dynomatik Limited (company number 13602267) as required by the Dynomatik Data Processing Agreement. It is referred to in clause 7 of the DPA and forms part of it.
1. How this list works
1.1 General authorisation. Customers give Dynomatik general written authorisation to engage the sub-processors on this list, in accordance with Article 28(2) and (4) of the UK GDPR.
1.2 Notice of changes. Dynomatik will give at least thirty (30) days’ notice before adding or replacing a sub-processor.
1.3 Objecting. A customer that has reasonable grounds relating to data protection to object to a new sub-processor must notify Dynomatik in writing, setting out those grounds, within fourteen (14) days of Dynomatik’s notice under clause 1.2. Dynomatik will consider the objection in good faith and may, in its discretion, address it, including by not using the new sub-processor for that customer. If Dynomatik proceeds with the new sub-processor, the customer may terminate the Service that uses it in accordance with the termination provisions of the Dynomatik Terms of Service. Dynomatik is not required to refund any fees paid before termination takes effect, and termination in accordance with this clause is the customer’s sole and exclusive remedy in respect of the objection. A customer that does not object within the fourteen (14) day period is treated as having authorised the new sub-processor.
2. Table 1: Sub-processors (Customer Personal Data)
These suppliers process personal data within customer Organisations, including Organisation Membership records, Organisation Content and Guest Data.
Infrastructure, hosting and database
Sub-processor | Entity and country | Purpose / service provided | Categories of personal data | Where processed | Transfer mechanism |
|---|---|---|---|---|---|
Supabase Pte. Ltd | Singapore | Managed database, authentication and backend platform hosting the Service | Customer Personal Data, including Organisation Membership records, Organisation Content and Guest Data as defined in Annex 1 of the Data Processing Agreement | Frankfurt, Germany | UK IDTA / UK Addendum to the EU SCCs |
Cloudflare, Inc. | United States | Content delivery, DNS, DDoS protection and web application firewall for the Service | IP addresses, request metadata and any personal data in transit | Global edge network | UK Extension to the EU-US Data Privacy Framework, and the UK Addendum to the EU SCCs |
Google Ireland Ltd | Google Workspace/ Google Cloud Platform | Customer Personal Data processed including email addresses, names, job titles as defined in Annex 1 of the Data Processing Agreement | Ireland (Google data centres); locations listed at cloud.google.com/about/locations | SCCs (Controller-to-Processor / Processor-to-Processor) under Section 10.2 (Restricted European Transfers) of the Google Cloud DPA |
Email and message delivery
Sub-processor | Entity and country | Purpose / service provided | Categories of personal data | Where processed | Transfer mechanism |
|---|---|---|---|---|---|
AC PM LLC (d/b/a Postmark) | United States | Transactional and bulk email delivery, including e-tickets and Organisation CRM Tool communications | Recipient name and email address, message content, delivery and engagement metadata | United States | EU SCCs (Modules Two/Three) and the UK IDTA, incorporated by reference into the Postmark DPA; Brazil SCCs apply where relevant |
Monitoring, logging and error reporting
Sub-processor | Entity and country | Purpose / service provided | Categories of personal data | Where processed | Transfer mechanism |
|---|---|---|---|---|---|
Functional Software, Inc. (d/b/a Sentry) | United States | Application error monitoring and performance tracing | User identifiers, IP addresses, request payloads and stack traces captured at the point of error | United States | EU-US Data Privacy Framework (Sentry self-certifies as primary mechanism); EU Standard Contractual Clauses (Modules Two/Three) and the UK Addendum apply if the DPF is unavailable |
PostHog Inc. | United States | Product analytics and feature usage measurement within the Service | User identifiers, session and event data, device and IP information | United States | EU-US, UK Extension and Swiss-US Data Privacy Framework (self-certified) and, cumulatively, EU/UK/Swiss Standard Contractual Clauses per Section 10 of the executed PostHog DPA |
Payment processing
Sub-processor | Entity and country | Purpose / service provided | Categories of personal data | Where processed | Transfer mechanism |
|---|---|---|---|---|---|
Stripe Payments Europe, Limited (SPEL) | Ireland | Payment processing for Organisation ticket sales, guest fees and platform billing | Customer Personal Data, including payment card details, bank account details, billing/shipping address, name and order details, as defined in Annex 1 of the Data Processing Agreement | United States (Stripe, LLC), and other jurisdictions via Stripe's Affiliates and Sub-processors | EU-US Data Privacy Framework, EEA SCCs (Modules One/Two) and the UK International Data Transfer Addendum, incorporated by reference into Stripe's Data Transfers Addendum |