Sub-processors

1. Current sub-processors

A sub-processor is a provider that processes personal data on our behalf while we run Kept for you. Each one below works under a written contract with data protection obligations equivalent to those in our data processing agreement, and we remain responsible to you for its work.

Amazon Web Services (AWS)

• What it does: Hosting for our servers and databases, storage for uploaded documents and inbound mail (Amazon S3), sending and receiving email (Amazon SES), and time-limited document delivery (Amazon CloudFront).
• What it receives: Everything you keep in Kept, including tenant details, documents, correspondence and tenant response page records.
• Where: In the UK, in the AWS Europe (London) region. CloudFront may deliver a document from a location near the person opening it, which can be outside the UK.

TextMagic

• What it does: Sends SMS reminders, only if you turn them on.
• What it receives: Your phone number and the reminder text, which can mention the property and the duty that is due.
• Where: May be outside the UK.

Mapbox

• What it does: Draws the maps in the app and on our council pages.
• What it receives: The IP address and browser details of the person viewing a map, the area of the map being shown and a random identifier used to count map loads. It does not receive names or account details.
• Where: May be outside the UK.

postcodes.io

• What it does: A public postcode lookup service, used to find a property's location and local council.
• What it receives: A property's postcode and nothing else.
• Where: May be outside the UK.

2. Billing, sign-in and this website

For these services we are the controller rather than your processor. They handle your account, billing and website visits, not the tenant data you keep in Kept, and our privacy policy and cookie policy cover them. We list them here so you can see where they process data.

Stripe

• What it does: Payment processing and subscription billing.
• What it receives: Your payment card and the billing details you give it. We never see or store your full card number.
• Where: May be outside the UK.

Google

• What it does: Sign in with Google, if you choose to use it, and Google Analytics on the website, only if you allow analytics. The app does not run Google Analytics.
• What it receives: Your Google sign-in, if you use it. For analytics, usage data such as pages viewed, never your Kept account records or documents.
• Where: May be outside the UK. Google Analytics data may be processed in the United States, under the UK Extension to the EU-US Data Privacy Framework.

3. Services you choose to use

Some features hand information to services you pick yourself. If you send a letter by WhatsApp, it goes from your own WhatsApp account under Meta's terms and does not pass through Kept. If you subscribe to your deadline calendar in a calendar app, that app fetches the feed for you. These services are your choice rather than our sub-processors.

4. Data processed outside the UK

Where a provider processes personal data outside the UK, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for Google Analytics), the UK International Data Transfer Agreement or Addendum, or equivalent safeguards.

5. Changes and objections

Before we add or replace a sub-processor, we will tell you by email and update this page, including what the new provider will do and where. You can object on reasonable data protection grounds by emailing hello@usekept.co.uk. If we cannot resolve your objection, you can export your data and close your account before the change takes effect.