Vendors
Vendors
List every tool that handles personal data, prefilled from a catalog of 550+ common tools and detected from your website. Learn the fields of a vendor and how to review them.
Vendors are the tools and providers that handle personal data for you: hosting, payments, email, analytics, support, HR and more. The vendor list feeds your privacy policy, your vendor list document, your data processing agreement, your cookie declaration and your privacy center, so each vendor is recorded once.
#Add vendors
- From the catalog. Search 550+ common tools. Purpose, data and a suggested role are prefilled, with a link to the vendor's data processing agreement where one is published.
- From your website. The website import suggests tools it recognises. You decide which to add.
- By hand. Add any tool that is not in the catalog.
#The fields of a vendor
| Field | What it records |
|---|---|
| Name and category | What the tool is. |
| Used for | Client services, Internal operations, Both or Not sure. Client services means you use the tool to serve clients, which makes it a subprocessor candidate. |
| Provider's data role | Processor, Independent controller, Joint controller, Depends on activity or Not sure. See Vendor roles. |
| Purpose | Why you use it. |
| Data | The kinds of personal data it handles. |
| Region | Where it processes the data. See Data location. |
| Agreement | A link to the vendor's data processing agreement, when known. |
| Notes | Anything worth remembering, for example a mixed relationship. |
#Review what was suggested
Prefilled values are suggestions. A vendor needing review shows what is still unconfirmed: the role, a suggested purpose or data, or a missing region. The overview walks you through them one at a time.
#What the catalog is
A reference list of common tools with the purpose, data and agreement link prepared in plain words. Entries come from the vendors' own public documentation and are reviewed in batches. A vendor can change its terms at any time, so always confirm in your own account. The same catalog powers the public vendor guide.
#FAQ
#What is a subprocessor?
A provider that a processor uses to handle personal data. If you process data for clients, the tools you rely on to do it are your subprocessors.
#Do I need a list of vendors under the GDPR?
The GDPR does not name a standalone vendor list. You must know who processes data for you, have the right contracts and tell people about the recipients of their data. A maintained list is the practical way to do all three.
#How does Privacyboard know my tools?
It reads your public pages and the public records of your domain to suggest tools, and offers a catalog of common ones. Nothing is added unless you choose it.
#My tool is not in the catalog. What now?
Add it by hand. Name, purpose, data and region are enough for your documents.
Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.