We believe in being open about who helps us run Grand Draws. As the data controller, we use a small number of trusted third-party providers (“sub-processors”) to operate the site. Each is bound by a written data-processing agreement requiring it to protect your data to a standard no lower than we owe you, and we remain responsible for their performance.
Current sub-processors
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication and realtime for entrant accounts, entries, orders and winners | EU (AWS-backed) | DPA + UK IDTA / SCC Addendum |
| Cloudflare | Hosting, CDN, DNS, edge security (WAF/DDoS/bot mitigation) | Global edge (US-headquartered) | Cloudflare DPA + UK Addendum to the EU SCCs |
| Brevo | Transactional email. Today that is a new-signup alert to us; at launch it adds entry confirmations, winner notifications and, with your consent, marketing email. | EU (France) | Brevo DPA + EU SCCs / UK Addendum |
| Google (Analytics 4 and Tag Manager) | Aggregate site analytics and tag management. Loads only after you accept analytics cookies. | US | Google DPA + EU-US DPF / UK Extension |
| Microsoft Clarity | Anonymised session analytics (how pages are used). Loads only after you accept analytics cookies. | US | Microsoft DPA + EU-US DPF / UK Extension |
| Meta | Ad measurement: the Meta Pixel (only after you accept marketing cookies) and a server-side signup event carrying a hashed email so ad reports can be de-duplicated. | US | Meta DPA + EU-US DPF / UK Extension |
| Airtable | Our customer records: a mirror of account sign-ups so we can manage enquiries and, with consent, marketing. | US | Airtable DPA + EU SCCs / UK Addendum |
| Zapier (when lead-form automation is enabled) | Passes details you submit on a Meta lead form to us so we can create the account you asked for. | US | Zapier DPA + EU SCCs / UK Addendum |
| Payment processor (a competition-approved provider, named here before paid entries open) | Processing entry payments once paid entries open. We store only a processor-issued token, never card details. | UK / EEA | Processor DPA; PCI DSS held by the processor |
Payments
Entry payments are captured by our payment gateway under its own PCI DSS compliance. We never receive or store full card details, only a gateway-issued token that lets us match a payment to an entry.
How we notify changes
We'll update this page before we add or replace a sub-processor that handles personal data. Please check back periodically. For anything about this page, contact [email protected].
Draft, final provider names, regions and safeguards to be confirmed once accounts (payment gateway, email) are chosen, and reviewed alongside the privacy policy before launch.