Know every vendor that touches personal data.
Privacyboard keeps a list of the vendors and subprocessors that handle personal data for you. For more than 100 common tools it prefills the purpose, the data involved, a suggested data role and a link to the vendor's agreement, and you confirm each one.
Free to set up · No credit card · About 5 minutes
In short
- Catalog
- 100+ common tools prefilled and growing
- Detection
- Suggests tools from your website and its public records
- Each vendor
- Purpose, data, data role, region and agreement
- Transfers
- Flags vendors that process data outside the EEA
Prefilled, so you only confirm
For common tools, the purpose, data, role and region are already filled in. You can change any of them.
Tools found on your website
Privacyboard reads your page code and your privacy policy, and suggests the tools it finds.
Transfers outside the EEA, handled
When a vendor is outside the EEA, you say how the transfer is protected and the policy reflects it.
What is a vendor or subprocessor list?
A vendor list records every tool or service provider that handles personal data on your behalf, such as your hosting, payments, email, analytics and support tools. When you process data for clients, the same providers are your subprocessors, and clients commonly ask for the list.
It feeds other documents: the privacy policy names the recipients of data, the processing register links activities to tools, and transfer rules depend on where each vendor stores data. Keeping it in one place avoids contradictions between those documents.
How it works
- 1
Start from your website
Tools such as your hosting, analytics and email provider are suggested from your public pages and domain records.
- 2
Check what we prefilled
Pick tools from the catalog. Purpose, data and a suggested role are filled in, and you confirm what is right.
- 3
Add the region and validate
Say where each tool stores data. Your vendor list is then ready to download or to show in your privacy center.
What you get
A catalog of 100+ tools
Hosting, payments, email, analytics, support, HR and more, each with a prefilled purpose, data and agreement link.
Detection from your site
We suggest tools by reading your public pages and domain records. You decide which ones to add.
The data role, explained
For each vendor you confirm whether it acts as a processor or in another role. Tools whose role depends on your use ask you to choose.
Standard regions filled in
Where a tool keeps data in one place for every customer, the region is filled in for you and you can still change it.
Transfers outside the EEA
Vendors processing data outside the EEA are flagged, and the policy asks how the transfer is protected.
One list, many documents
The same vendors appear in your policy, your register and your privacy center, so they never disagree.
Where the GDPR touches your vendors
Suggested roles and regions are starting points to verify in your own account and agreements.
- Article 28
- Processors act on your documented instructions under a contract. A processor can use a subprocessor only with your authorization and under the same obligations.
- Articles 13 and 14
- Your privacy policy must name the recipients or categories of recipients of the data.
- Articles 44 to 49
- Transfers outside the EEA need a basis, such as an adequacy decision, standard contractual clauses or the EU-US Data Privacy Framework.
Questions, answered.
What is a subprocessor?
A subprocessor is a provider that a processor uses to handle personal data. If you process data for your clients, the tools you rely on to do it are your subprocessors, and your clients may ask for the list and for notice when it changes.
Do I need a list of vendors under the GDPR?
The GDPR does not name a standalone vendor list, but you must know who processes data for you, have the right contracts in place and tell people about the recipients of their data. A maintained list is the practical way to do all three.
How does Privacyboard know my tools?
It reads your public pages and the public records of your domain to suggest tools, and it offers a catalog of more than 100 common ones. Nothing is added unless you choose it.
Is the suggested data role always correct?
No. It is a starting point. A tool such as a payment provider can act in different roles depending on the agreement, so those ask you to choose and you confirm every role.
Where does the region come from?
You enter where each tool stores your data. For tools that keep data in a single place for all customers, the standard region is prefilled and you can change it if your setup differs.
Can I show the list publicly?
Yes. You can show the vendor list in your privacy center with each vendor's name, purpose and region. Other details stay private.
Works with
Looking for one tool? Browse the GDPR guide to common vendors.