Policies
Sub-processors
Version 1.0, effective 1 November 2026
Published by Emailmovers Limited, company 05046417, registered office 33-35 Exchange Street, Driffield YO25 6LL. ICO registration Z9714386.
This version lives at emailmovers.com/trust/sub-processors/ and, once a later version replaces it, at emailmovers.com/trust/sub-processors/v1/.
This page lists the providers that process personal data for us, in two parts:
- Part A: MyDataHub and our business contact data;
- Part B: our website, emailmovers.com.
Our privacy policy at emailmovers.com/privacy/ explains how we use personal data, and lists the other services we use across the company.
In short
MyDataHub and its data are held in the UK, in Google Cloud’s London region, and our master database is hosted by a UK supplier. Email addresses are verified by Millionverifier, a New Zealand company with verification servers in the United States, Canada and Europe, and by Datyle in the UK. Telephone numbers are checked by Telnyx in the United States. Every telephone number is screened against the TPS and the CTPS each night through a licensed screening service based in the UK, which processes the numbers in the UK. Card payments are processed by Stripe.
Part A: MyDataHub and our business contact data
| Provider | Purpose | Location | Transfer mechanism | Data |
|---|---|---|---|---|
| Google Cloud | Hosts MyDataHub, its databases and files | London, United Kingdom | None: the data stays in the UK | All MyDataHub data: business contact records, accounts, orders and suppression lists |
| A UK data hosting and processing supplier | Hosts our master database server, and the copy that MyDataHub’s exports come from | United Kingdom | None | The business contact database and our suppression list |
| Millionverifier (Southern Vector Limited) | Verifies email addresses before lists and samples are sent | New Zealand, with verification servers in the United States, Canada and Europe | UK adequacy regulations for New Zealand; onward transfers under the provider’s own safeguards | Email addresses only |
| Datyle | Verifies email addresses we have no other record for | United Kingdom | None. We are awaiting Datyle’s data processing terms | Email addresses only |
| Telnyx | Checks a telephone number’s line type and network | United States | UK Extension to the EU-US Data Privacy Framework | Telephone numbers only |
| Hunter (Hunter Web Services, Inc.) | Finds and checks business email addresses | Google Cloud in Belgium, with some of Hunter’s own suppliers in the United States | UK adequacy regulations for the EU; the EU standard contractual clauses with the ICO’s Addendum for transfers to the United States | Names, company names and web domains, and the email addresses found |
| Anymailfinder | Finds a business email address from a person’s name and company | A UK company, hosting in the United States and Germany | The ICO’s Addendum to the EU standard contractual clauses, for the United States; UK adequacy regulations, for Germany | Names, company names and web domains, and the email addresses found |
| A licensed TPS and CTPS screening service | Screens every telephone number against the TPS and the CTPS each night | United Kingdom | None | Telephone numbers only |
| Stripe (Stripe Payments Europe, Limited) | Takes card payments, including Apple Pay and Google Pay, through Stripe Checkout | Dublin, Ireland, with processing by Stripe, LLC in the United States | UK adequacy regulations for the EU; the UK Extension to the EU-US Data Privacy Framework for Stripe, LLC, with the EU standard contractual clauses and the ICO’s Addendum as fallback | The buyer’s payment details, name, email address and billing address |
| Resend | Sends emails from mydatahub.emailmovers.com, such as sign-in links and receipts | Sends from its Ireland region; Resend’s main processing is in the United States | The ICO’s Addendum to the EU standard contractual clauses. Resend is also certified under the UK Extension to the EU-US Data Privacy Framework | The recipient’s email address and the message |
| Brevo | Receives our suppression list each night, so that our marketing emails are never sent to anyone on it | European Union | UK adequacy regulations for the EU | Email addresses on our suppression list |
| A UK hosting provider | Hosts our own email servers, which send verification emails and our notice to the people in our data | United Kingdom | None | The recipient’s email address and the message |
Tools our staff use with contact data files
Our staff use these company-wide services, which can process files and emails that contain business contact data.
| Provider | Purpose | Location | Transfer mechanism | Data |
|---|---|---|---|---|
| Google Workspace | Email and file storage | Google’s data centres, including the European Union and the United States | UK Extension to the EU-US Data Privacy Framework (Google LLC); the EU standard contractual clauses with the ICO’s Addendum for other countries | Files and emails, which may contain business contact data |
| xAI (Grok), SpaceX Super Intelligence LLC | An AI assistant with access to our managing director’s email and files | United States | We are awaiting xAI’s written confirmation and data processing terms | Email and files, which may contain business contact data |
| Anthropic | AI assistants for our staff | United States | The ICO’s Addendum to the EU standard contractual clauses | What staff share with it, which may contain business contact data |
Part B: our website
| Provider | Purpose | Location | Transfer mechanism | Data |
|---|---|---|---|---|
| Cloudflare | Hosts emailmovers.com and passes on what visitors send through its forms | Cloudflare’s global network, so requests may be handled outside the UK | UK Extension to the EU-US Data Privacy Framework; the EU standard contractual clauses with the ICO’s Addendum | Website requests, including IP addresses and browser details, and the details sent through forms |
| Google Cloud | Runs our chat service and our team’s live chat inbox | London, United Kingdom | None | Chat messages, held in memory for 30 minutes |
| Anthropic | Provides the AI that writes replies in our chat | United States | The ICO’s Addendum to the EU standard contractual clauses | Chat messages. Anthropic deletes them within 30 days, unless they are flagged for breaking its usage policy, when it may keep them for up to 2 years |
Organisations that are not our sub-processors
Some organisations receive personal data from us, or about MyDataHub users, but decide for themselves how to use it. They are controllers, under their own privacy notices.
- Our customers license business contact records and become controllers of their copies, under our Data Licence and Sharing Agreement.
- Stripe uses payment information for its own purposes too, such as preventing fraud and meeting its legal duties.
- Anymailfinder keeps email addresses it finds or confirms for its own service.
- RampedUp Inc, in the United States, supplies business contact data that we buy outright. We send it the email addresses on our suppression list, so that it does not supply them to us again.
Who is the controller, and who is the processor
We control our business contact database. When you order records, you accept a controller-to-controller Data Licence and Sharing Agreement, because you become a controller of the records you receive.
When you upload a suppression list or connect a CRM, we process that data for you. Before we first do, you accept our Article 28 Data Processing Agreement. Of the providers above, only Google Cloud processes that data.
How we tell you about changes
We give at least 30 days’ notice before we add or replace a provider in Part A, by email to MyDataHub account holders and by webhook. When a provider changes its own sub-processors, we pass its notice on as soon as we receive it; some providers give us only 14 days.
We update Part B when our website’s providers change.
Every entry gives the provider’s name, purpose, location and transfer mechanism. The change log records each change and its date.
| Date | Change |
|---|---|
| 1 November 2026 | Version 1.0 published |
Machine-readable list
The same list for Part A is available as JSON at https://mydatahub.emailmovers.com/trust.json, from GET https://mydatahub.emailmovers.com/v1/trust, and as the MCP resource mydatahub://compliance.