# Sub-processors

> The third-party providers we use to run this site, and the data-protection safeguards in place.

Source: https://granddraws.co.uk/sub-processors

---

# Sub-processors

Last updated: 25 September 2026

We believe in being open about who helps us run Grand Draws. As the **data controller**, we use a small number of trusted third-party providers (“sub-processors”) to operate the site. Each is bound by a written data-processing agreement requiring it to protect your data to a standard no lower than we owe you, and we remain responsible for their performance.

## Current sub-processors

| Provider | Purpose | Location | Transfer safeguard |
| --- | --- | --- | --- |
| **Supabase** | Database, authentication and realtime for entrant accounts, entries, orders and winners | EU (AWS-backed) | DPA + UK IDTA / SCC Addendum |
| **Cloudflare** | Hosting, CDN, DNS, edge security (WAF/DDoS/bot mitigation) | Global edge (US-headquartered) | Cloudflare DPA + UK Addendum to the EU SCCs |
| **Brevo** | Transactional email. Today that is a new-signup alert to us; at launch it adds entry confirmations, winner notifications and, with your consent, marketing email. | EU (France) | Brevo DPA + EU SCCs / UK Addendum |
| **Google (Analytics 4 and Tag Manager)** | Aggregate site analytics and tag management. Loads only after you accept analytics cookies. | US | Google DPA + EU-US DPF / UK Extension |
| **Microsoft Clarity** | Anonymised session analytics (how pages are used). Loads only after you accept analytics cookies. | US | Microsoft DPA + EU-US DPF / UK Extension |
| **Meta** | Ad measurement: the Meta Pixel (only after you accept marketing cookies) and a server-side signup event carrying a hashed email so ad reports can be de-duplicated. | US | Meta DPA + EU-US DPF / UK Extension |
| **Airtable** | Our customer records: a mirror of account sign-ups so we can manage enquiries and, with consent, marketing. | US | Airtable DPA + EU SCCs / UK Addendum |
| **Zapier (when lead-form automation is enabled)** | Passes details you submit on a Meta lead form to us so we can create the account you asked for. | US | Zapier DPA + EU SCCs / UK Addendum |
| **Payment processor (a competition-approved provider, named here before paid entries open)** | Processing entry payments once paid entries open. We store only a processor-issued token, never card details. | UK / EEA | Processor DPA; PCI DSS held by the processor |

## Payments

Entry payments are captured by our payment gateway under its own PCI DSS compliance. We never receive or store full card details, only a gateway-issued token that lets us match a payment to an entry.

## How we notify changes

We'll update this page before we add or replace a sub-processor that handles personal data. Please check back periodically. For anything about this page, contact [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk).

*Draft, final provider names, regions and safeguards to be confirmed once accounts (payment gateway, email) are chosen, and reviewed alongside the privacy policy before launch.*