This page lists the categories of sub-processor CartaGrid Limited currently engages to deliver the platform, as referenced in our Data Processing Agreement. Specific vendor names are available on request to Subscribers under a Data Processing Agreement. We will update this page and notify Subscribers at least 30 days before adding or replacing any sub-processor function.
Last updated: 19 June 2026| Function | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Database and data storage infrastructure | Secure storage of account, operational, and compliance data | United States | Standard Contractual Clauses (UK Addendum) |
| Application hosting platform | Delivery of the CartaGrid staff and customer-facing applications | United States | Standard Contractual Clauses (UK Addendum) |
| Payment processing | Subscription billing and payment handling | EU / United States | PCI DSS Level 1; Standard Contractual Clauses |
| AI processing | Compliance document generation, including menu ingestion and HACCP plan drafting | United States | Standard Contractual Clauses (UK Addendum) |
| Workflow automation | Connecting platform components and triggering compliance alerts | EU (Czech Republic) | Within UK adequacy decision scope |
| Staff alerting and notifications | Real-time operational alerts to designated venue staff (e.g. compliance breaches, allergen declarations, staff training expiry) | United States | Standard Contractual Clauses (UK Addendum) |
| Voice agent platform | Automated voice and customer service support | United States | Standard Contractual Clauses (UK Addendum) |
CartaGrid's public marketing website is hosted separately and does not process Subscriber or customer personal data, so is not listed above.
Questions about our sub-processors or this list? Contact us at operations@cartagrid.com. To object to a new sub-processor following notification, see Clause 5 of our Data Processing Agreement.