Subprocessors

Introduction

To provide the Vastyn platform, we engage third-party service providers ("subprocessors") who may process personal data on our behalf. This page lists our current subprocessors in accordance with GDPR Article 28.

We carefully select subprocessors that maintain high security and privacy standards. All subprocessors are contractually bound to protect your data.

What is a Subprocessor?

A subprocessor is a third-party company that processes personal data on behalf of Vastyn to help us deliver our services. They only process data according to our instructions and are subject to strict contractual obligations.

Current Subprocessors

Infrastructure & Hosting

AWS Certifications: ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, PCI DSS Level 1

Payment Processing

Stripe Certifications: PCI DSS Level 1

Note: Payment card details are processed directly by Stripe. Vastyn does not store your full card number.

Email Services

Transactional emails include: account notifications, order alerts, password resets, and system notifications.

Analytics

Note: We use IP anonymisation. No personal information from your Vastyn account is sent to Google Analytics.

Marketplace Integrations

When you connect marketplace accounts, data flows between Vastyn and those platforms. These are not subprocessors — they are third-party services you authorise directly.

You control which marketplaces you connect. Vastyn accesses marketplace data via official APIs with your authorisation.

Data Location Summary

We ensure your data stays in your region:

International transfers: Where subprocessors are based outside your region (e.g., Google Analytics), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs).

Subprocessor Requirements

All our subprocessors must:

• Sign a Data Processing Agreement (DPA)
• Implement appropriate technical and organisational security measures
• Only process data according to our documented instructions
• Ensure personnel are bound by confidentiality
• Assist with data subject rights requests
• Delete or return data upon termination
• Allow for audits and inspections
• Notify us of any security incidents

Changes to Subprocessors

Notification of Changes

We may update our subprocessors from time to time. When we add or change a subprocessor:

• We will update this page
• We will update the "Last Updated" date
• For material changes, we will notify customers via email at least 30 days in advance

Subscribe to Updates

To be notified of subprocessor changes, contact us at hello@vastyn.com to join our notification list.

Objection Rights

Under GDPR, you may object to a new subprocessor. If you have concerns about a subprocessor change:

• Contact us at hello@vastyn.com within 30 days of notification
• We will discuss your concerns and explore alternatives
• If we cannot resolve the objection, you may terminate your account

Previous Subprocessors

We maintain records of previous subprocessors for transparency:

Data Processing Agreement

Business customers may require a formal Data Processing Agreement (DPA) for their compliance records.

To request a DPA:

• Email: hello@vastyn.com
• Subject: "DPA Request"
• Include: Your company name and Vastyn account email

We will provide a signed DPA within 5 business days. You can also view our DPA template.

Frequently Asked Questions

Contact Us

If you have questions about our subprocessors or data processing:

Document Information