A list of sub-processors is maintained and accessible

GDPR Art. 13(1)(e) requires controllers to name the recipients or categories of recipients of personal data at the point of collection. Art. 28(3) requires that processor contracts specify which subprocessors are authorized. A privacy policy that says 'we share data with trusted third-party service providers' names nobody and satisfies neither requirement. Users cannot exercise their rights intelligently — including objecting to specific processing — if they do not know which companies receive their data. Regulators have issued guidance specifically requiring named subprocessors, not category descriptions, for transparency obligations to be met.

Add a named subprocessor table to your privacy policy, listing every service that receives personal data with its purpose, data shared, location, and transfer mechanism.

## Our Subprocessors

| Service          | Purpose                  | Data Shared                  | Location    |
|------------------|--------------------------|------------------------------|-------------|
| Stripe           | Payment processing       | Billing address, email       | US (SCCs)   |
| Resend           | Transactional email      | Email address, name          | US (SCCs)   |
| Google Analytics | Usage analytics          | Pseudonymous ID, events      | US (SCCs)   |
| Sentry           | Error monitoring         | Error context, user ID       | US (SCCs)   |
| Vercel           | Application hosting      | Request logs, IP (ephemeral) | US/EU (SCCs)|
| Supabase         | Database hosting         | All stored personal data     | EU region   |

Update this table within 30 days of adding or removing a subprocessor. Notify existing customers of material changes in advance. Cross-reference the list against your codebase integrations quarterly to catch drift.