Subprocessors
Draft of 3 October 2026
Draft for legal review, not yet in force.
Points still to be completed by counsel before launch:
- Transfer mechanisms (standard contractual clauses or equivalent) for each provider outside the EU.
- The notice period and channel for changes to this list.
These companies process personal data on Gatwyn’s behalf to provide the service. Each is bound by a data processing agreement. The last column says when a provider is involved: several only take part once a workspace switches the related feature on.
| Provider | Purpose | Data | Location | When |
|---|---|---|---|---|
| DigitalOcean | Runs the Gatwyn application and its database; stores attachments and encrypted backups (Spaces). | All workspace data. | United Kingdom (London); files and backups in the United States (New York) | Always |
| Brevo (Sendinblue SAS) | Sends and receives email, and reports whether sent email was delivered. | Emails, attachments, senders’ and recipients’ addresses. | European Union (France) | Always |
| Meta Platforms (WhatsApp Business Platform) | Delivers WhatsApp messages between a business and its customers. | WhatsApp messages, phone numbers, media. | Meta’s data centres | Only for workspaces that connect a WhatsApp number |
| Meta Platforms (Messenger and Instagram) | Delivers direct messages between a business’s Facebook Page or Instagram account and its customers. | Messenger and Instagram messages, the customer’s page-scoped id and the name Meta shares. | Meta’s data centres | Only for workspaces that connect a Facebook Page or an Instagram account |
| Anthropic | Runs the AI model behind Pilot (drafts, answers, summaries). | The public messages of a conversation and the workspace’s published articles; the customer’s recent orders (status, items, tracking, without addresses, payments or prices) when the workspace lets Pilot read them; never internal notes or customer notes. | United States | Only for workspaces that switch Pilot on |
| Paddle | Sells subscriptions as merchant of record: checkout, payment, tax and invoices. | Billing contact, payment details (held by Paddle, never by Gatwyn), plan and seats. | United Kingdom and payment networks | Only for workspaces that pay online |
| Shopify | Shows a store’s orders beside a conversation. Orders are read when shown and not stored. | Customer email and phone used to find orders; order details shown to the team. | Shopify’s data centres | Only for workspaces that connect their store |