Legal
Sub-processor register
This is Annex 3 to the data processing addendum. It lists every party that processes client personal data on our behalf. A controller who has signed the addendum is authorising the engaged list by name, and is entitled to 30 days' notice before anything is added to it.
Engaged on every engagement
These process client personal data now. Signing the addendum authorises them.
| HostPinnacle Cloud Limited | |
|---|---|
| Role | Infrastructure and communications provider |
| Service provided | Application hosting, database storage, electronic mail, DNS and release backups for this website, the administration console and the delivery system. |
| Entity | Incorporated in the Republic of Kenya. Registered office at 1st Floor, Studio House, Marcus Garvey Road, off Argwings Kodhek Road, Kilimani, Nairobi. |
| Processing location | Kenya — written confirmation of the serving facility outstanding |
| How that is known | Jurisdiction of incorporation and registered office taken from the provider's own published corporate details. The physical location of the facility serving this account has been requested from the provider in writing and is not yet confirmed, so it is not asserted here as fact. |
| Transfer safeguard | None relied upon. If the provider confirms that the serving facility sits outside Kenya, clause 8 applies and the controller is notified under clause 7.4 before any further processing. |
| Engaged since | 6 September 2026 |
One entry is not an omission. Our own web properties, the administration console and the delivery system load no third-party analytics, advertising, content-delivery or error-tracking service, and all fonts and assets are served from our own domain. The register is short because the estate is.
May be proposed for a specific engagement
Listing here is disclosure, not authorisation. None of these processes a controller's personal data unless that controller authorises it in writing and the authorisation is recorded in Annex 1 of their addendum.
| GitHub, Inc. | |
|---|---|
| Role | Source control, where the engagement places its repository there |
| Service provided | Hosting of the engagement's source repository, issues and build history. Engaged only where the controller asks for the repository to be held on GitHub rather than on infrastructure we or they operate. |
| Entity | Incorporated in the United States of America. |
| Processing location | United States and other regions operated by the provider |
| How that is known | The provider publishes a data protection agreement incorporating standard contractual clauses. Its current terms are read and the transfer mechanism confirmed at the point of engagement rather than assumed from this entry. |
| Transfer safeguard | Standard contractual clauses under the provider's data protection agreement, plus the controller's written authorisation under clause 7.2. A repository holding personal data is not placed here without both. |
| Currently engaged | No. Authorisation is per engagement. |
Change log
Every change to the lists above, newest first. This is the record the notice period in clause 7.4 is measured against.
| Date | Change |
|---|---|
| 9 Sep 2026 | Register first published at version 1.0. HostPinnacle Cloud Limited recorded as the sole engaged sub-processor. No change notice arises: no engagement predates this entry. |