Sub-processors

These are the companies that process data on our behalf. If you are filling in a supplier questionnaire or a due diligence pack, this is the answer to the sub-processor question and you may cite this page.

A sub-processor is a company we hand data to so that it can do a job for us. That is different from a company we simply buy something from. Everyone on this list can, in the ordinary course of doing their job, hold or transit information about people.

We update this page when a provider is added or removed. If you have a contract with us that requires notice of a change, that notice comes from the contract, not from you watching this page. Ask jack.spence@musketgoose.com to be told directly.

Each provider's data processing agreement and privacy notice, so that you can read the terms rather than take our word for what they say.

Worth saying plainly, because it is the question a South African client's legal team will ask and a vague answer wastes everybody's afternoon.

None of these providers offers a POPIA specific agreement. Every one of them contracts on the European Standard Contractual Clauses through the agreements linked above. Section 72 of POPIA permits a transfer out of South Africa where the recipient is bound by an agreement giving an adequate level of protection with onward transfer restrictions substantially similar to POPIA's, and those clauses are the instrument we rely on.

So: we do not claim any of these companies is certified under South African law, because none of them is. We rely on European standard terms, which impose substantially what POPIA asks for, and we say so rather than letting a reader assume more.

Where we process personal information for a client, section 21 of POPIA requires a written agreement between us. We sign one as a matter of course, and it flows the same obligations down to everyone on this page.

Kept here rather than deleted. If you are comparing this page against a copy you took earlier, a vendor that vanished without explanation looks like a disclosure we never made.

One company belongs in a different category, and putting it in the table above would be wrong.

A domain registrar does not process registration data on our instruction. What it collects, publishes and retains is set by ICANN's rules, which makes it an independent controller of that data rather than our operator. Listing it as a sub-processor would misdescribe the relationship to anyone relying on this page.

• Our accountants, auditors and attorneys. They receive information, but as professionals under their own duties rather than as our processors.
• Banks and payment providers, which act on their own regulatory obligations.
• SARS, the Companies and Intellectual Property Commission and other authorities, which receive information because the law requires it.
• Software we run for a client. There we are the operator and the client's own sub-processor list governs, not ours.

If a provider here is a problem for your organisation, tell us before you sign rather than after. Some are replaceable and some are not, and we would rather have that conversation early. Write to jack.spence@musketgoose.com.