Sub-processor Register
Version 1.15.0
Effective from
1. About this register
Go Find Part Limited (“GoFindPart”) uses a small number of specialist service providers to operate the Platform. This page lists them in one place: who they are, what they do for us, where they process data, and where their data-processing terms are published.
This register restates, in structured form, the disclosure already made in our Privacy Policy (section 4.3 “Service providers and processors” and section 5 “International Transfers”). If this page and the Privacy Policy ever disagree, the Privacy Policy prevails.
Where a provider processes personal data on our behalf, it does so under a data-processing agreement and — for transfers outside the United Kingdom — the safeguards described in section 5 of the Privacy Policy (UK IDTAs, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy decisions).
2. Service providers
| Provider | What they do for us | Processing region | Data-processing terms |
|---|---|---|---|
| Stripe | Payment processing, Stripe Connect onboarding, identity verification (for sellers, trade-account applicants and buyers on high-value orders), and self-billed-invoice payment routing. Stripe acts as an independent data controller. | United Kingdom / United States | stripe.com/legal/dpa |
| Crisp IM SAS | In-platform support chat. Server-side relay only — Crisp loads no software and sets no cookies in your browser. | European Union (France) | crisp.chat/en/privacy |
| Amazon Web Services (AWS) | File storage (S3, London region), transactional email delivery (SES), delivery of one-time verification codes to your mobile number, and of texts about an order to the mobile of a supplier a seller has named or of a person a buyer or seller has handed the order over to (SMS), and automated moderation of photographs you upload (Amazon Rekognition — the image is checked for unsafe content; no faces are identified). | United Kingdom (storage, moderation); email and SMS delivery may be processed outside the UK | aws.amazon.com/compliance/gdpr-center |
| Neon | Database of record (PostgreSQL). | United Kingdom (London) | Available on request |
| Fly.io | Application hosting (application servers). | United Kingdom (London) | Available on request |
| Upstash | Caching. | United States (provider HQ) | Available on request |
| Sentry (Functional Software, Inc.) | Error monitoring for our public website and the Platform. When something breaks in your browser or on our servers, Sentry receives the error message and the place in our code it came from, the address of the page you were on, and your browser type and version, so we can reproduce and fix the fault. No session recordings are made, no form contents are sent, and your IP address is not stored with the report. Reports are deleted after 90 days. On the console our own staff use to run the Platform, Sentry also receives performance timings, a sample of processor profiles and warning-level console messages, each attributed to the staff member signed in; those are scrubbed of credentials, e-mail addresses, phone numbers and postcodes before they leave the browser, and bug reports sent from that console carry no screenshots. | United States | sentry.io/legal/dpa |
| OpenAI | AI-assisted request parsing and matching; checking each line of a stock list a trade organisation uploads or asks us to run — sent: the line’s description, its category, part number, maker and any standard designation (never the supplier, the site, the stores code or the stock levels — a label photographed by a member, below, is the member’s own photograph and may show them); a cached answer is keyed on the line’s words, not on the organisation, so the same words from a second organisation are answered without being sent again, and the run’s own event records carry no organisation; and, for a seller who uploads a stock file, suggesting how its columns map onto ours and matching its category names to ours — sent: the column headings, a value profile per column and up to six short sample cells per column (never the cells of a notes, comments, supplier or contact column), and the file’s distinct category names; reading the label on a stock bin, or on a part, that a member of a trade organisation photographs to find the part on the organisation’s stock list, where this provider’s model reads images — sent: that photograph, with its hidden details (such as where it was taken) removed, and an instruction to transcribe only the codes, the description and the maker; it may show the organisation’s stores code, a bin location, a supplier or a stock count; it is sent once and is not kept by us; and identifying a part from a seller’s photographs of it (its data plate and, when a seller suggests a part in place of the one a buyer asked for, the whole part), the part number, maker or details a seller gives, or the maker and part number read from a link — sent: those photographs and details, and web searches by the part number and maker to find the part’s specifications, image and datasheet and to check the part number exists. | United States | openai.com/policies/data-processing-addendum |
| Anthropic | AI-assisted request parsing and matching; checking each line of a stock list a trade organisation uploads or asks us to run, where its model is chosen for that (what is sent, what is cached and what the event records carry: as for OpenAI above); automated first-line replies in the support chat (always labelled as automated, human handover available at any time); reading the label on a stock bin, or on a part, that a member of a trade organisation photographs to find the part on the organisation’s stock list, where its model reads images (what is sent: as for OpenAI above); and identifying a part from a seller’s photographs of it (its data plate and, when a seller suggests a part, the whole part) where its model reads the images — sent: those photographs and the details the seller gives. | United States | anthropic.com/legal |
| Cloudflare, Inc. | Bot and abuse protection on our forms (Cloudflare Turnstile, which receives your IP address to tell a person from a bot), plus delivery and TLS termination for the websites themselves. | United States | cloudflare.com/cloudflare-customer-dpa |
| Ideal Postcodes (IDDQD Limited) | Address lookup: when you type a full UK postcode into an address field, suggests the addresses at that postcode from Royal Mail’s Postcode Address File. Receives only the postcode typed — no name, account or other detail. | United Kingdom / European Union | terms.ideal-postcodes.co.uk/data-processing/data-processing-agreement |
| Google LLC | Delivery address validation, geocoding and distance calculation (Google Maps Platform). Receives the address entered and the coordinates derived from it. | United States | cloud.google.com/terms/data-processing-addendum |
| Aikido Security BV | Security scanning of our source code, the configuration of our cloud accounts and our public websites; protection of our application servers against attacks — software that runs inside them and, for a request that looks like an attack, sends Aikido the address requested, the IP address it came from, the browser type and the part of the request that looked like an attack, together with counts of requests and the names of the outside services our servers contact (no name, email address or account); and the form on which you can ask for our security report (Privacy Policy section 2.7) — receives the full name, company name and email address you enter there, and emails you the report if we approve your request. Does not read our database. Aikido publishes no fixed period for keeping what it receives: it keeps it while we use Aikido, and its customer agreement requires our data to be purged from its systems within 200 days after that agreement ends. | European Union (Belgium); some of its own providers may process data in the United States | aikido.dev/legal/dpa |
| Plausible Insights OÜ | Cookieless analytics on the public marketing site only — never inside the signed-in Platform. Receives your IP address and browser type to derive the country and device class of a visit and to count one person once, then discards them. Sets no cookies and builds no profile. Not used when your browser sends the Global Privacy Control signal or you have turned analytics off for your device (see the Cookies Policy). | European Union (Estonia) | plausible.io/dpa |
Where a data-processing agreement is marked “available on request”, we hold one with the provider but they do not publish a stable public URL for it — email us and we will share the relevant terms.
3. Delivery partners
Where a courier service is engaged to move physical goods, we share the details needed to fulfil the delivery — the collection and delivery names, addresses and contact telephone numbers (including, where goods are collected from a seller’s supplier, the name and telephone number of the supplier’s contact, and, where an order has been handed over to someone, that person’s name and mobile number), the parcel’s dimensions and weight, a short description of the goods and their declared value — with our delivery partners. We pass them no e-mail address and we do not ask them to contact you. None of them is our processor: each uses these details for the delivery as its own privacy notice describes.
- Same-day couriers — Gophr and Stuart receive those details from us directly and act as independent controllers of them for the delivery.
- Parcel collections and deliveries through our carrier broker — since 25 September 2026 we book parcel collections and deliveries through Interparcel Limited (company number 05243074; Platinum House, Gatwick Manor Business Park, Gatwick Road, Crawley, RH10 9NH; registered with the Information Commissioner’s Office as a data controller, reference Z2812857; Data Protection Officer: data@interparcel.com). Interparcel’s privacy policy (uk.interparcel.com/privacy) names Interparcel as the data controller of the information it receives, so it acts as an independent controller, not as our processor. Its terms of use (uk.interparcel.com/terms, section 17) say it shares delivery details only with the carrier selected for the parcel; its privacy policy also names, as kinds of recipient, its hosting providers, the systems it sends e-mails and text messages with, and the other companies in its group. Its published documents do not say where it stores the information or whether it transfers it outside the United Kingdom. It says it keeps order information, including the sender’s and recipient’s addresses, for up to six years from its customer’s last transaction, to meet its legal obligations. Interparcel sends its own delivery e-mails or texts only when a booking asks for them; ours never do.
- The carriers — Interparcel passes each parcel’s details to the carrier selected for it: APC, CitySprint, DHL, DPD, DPD Local, DX (including DX Freight), Evri, FedEx, InPost, Parcelforce, Proovia, UPS or Zippd. Each carrier’s own privacy notice says how it uses the details and where it processes them. DX says it stores them in data centres in the United Kingdom and keeps them within the United Kingdom and the European Economic Area. DPD, DPD Local, Evri, FedEx, InPost, Parcelforce, Proovia, UPS and DHL’s express business say they may transfer them to other countries, under the safeguards the law requires. APC, CitySprint, Zippd and DHL’s parcel business do not say where they process delivery details. Several carriers, DPD Local, Parcelforce and DHL’s parcel business among them, say they send delivery updates to the telephone number given for a parcel.
See Privacy Policy section 4.3.
4. Other recipients
As set out in the Privacy Policy, we may also share personal data with professional advisers (legal, accounting, audit, and insurance) where necessary, and with law enforcement or regulatory bodies where required by law. These are not sub-processors and are not listed in the table above.
5. Changes to this register
When we engage, replace, or retire a provider we update this page and the Privacy Policy together, and record the change in the version history of both documents. The Privacy Policy names the version of this register it was last reviewed against.
Changes recorded here: on 22 September 2026 Yodel was retired as a courier partner (its integration was never used for a live delivery); since 25 September 2026 CitySprint and DPD are reached through our carrier broker Interparcel Limited rather than directly (section 3, version 1.14.0).
6. Questions
Questions about this register or any provider on it: privacy@gofindpart.com.