Subprocessors

What a subprocessor is

A subprocessor is any company we use to help deliver Intervyo that processes our users' personal data on our behalf. We put data-processing terms in place with our providers, and each one may only process data for the purpose we have specified.

We list them here so users can see exactly who has access to their data and for what.

Status legend

• In use, actively processing user data today
• Approved, not yet in use, integration in progress
• Planned, likely to be added; not yet processing any user data

Current subprocessors

For each subprocessor we document its purpose, the location of processing, and its current status.

Infrastructure

Payment processing

AI inference

These are the AI providers that power feedback, scoring, generation, and Vyo.

Assessment infrastructure

Communications

Analytics

Identity and verification

Marketing and tracking

The analytics tools above (Google Analytics 4, Ahrefs) are the only third-party tracking we use, and neither runs until you accept analytics on the cookie banner. We also set a first-party attribution cookie (iv_attr, consent-gated) recording which campaign or link brought you here; when you arrive from a TikTok campaign it can include TikTok's click id, stored in our own database only.

We do not run any third-party advertising pixels:

• No Meta Pixel
• No LinkedIn Insight Tag
• No Twitter / X conversion tag
• No TikTok pixel script
• No ad-targeting third party

If we ever introduce any of these, they will be added here with at least 30 days' notice.

Data-processing terms

We put data-processing terms in place with our providers. For the platform providers above these are their standard data-processing agreements and addenda, which cover:

• The purpose and scope of processing
• The categories of personal data being processed
• The duration of processing
• The technical and organisational security measures
• Obligations on confidentiality, breach notification, and audit
• The terms for further sub-subprocessors
• Termination and data return / deletion

For details of the terms in place with a specific provider, contact admin@intervyo.co.uk.

International transfers

For each subprocessor located outside the UK, we rely on one of the following transfer mechanisms:

• Adequacy decisions, for transfers to countries with current adequacy:
  • UK → US under the UK-US Data Bridge, where the provider holds a current Data Privacy Framework certification
  • EEA → US under the EU-US Data Privacy Framework, on the same condition
  • UK → EEA and EEA → UK (no transfer mechanism needed)
• Standard Contractual Clauses (SCCs) or the UK IDTA / addendum, as incorporated into the provider's data-processing terms, where adequacy does not apply

Notification of changes

We will update this list when we add or remove a subprocessor. Material changes (a new subprocessor with access to a new data category) trigger:

• An update to the "Last updated" date at the top
• Email notification to active users

Sub-subprocessors

Many of our subprocessors use their own subprocessors (for example, AWS or GCP infrastructure beneath the SaaS layer). Where Article 28 GDPR applies, our providers' data-processing terms commit them to:

• Maintain a list of their own subprocessors
• Give notice of new sub-subprocessors with reasonable lead time
• Allow objection, with termination as the remedy where an objection cannot be resolved

The full sub-subprocessor map is large and changes frequently; per-subprocessor lists are linked from each subprocessor's own data-processing terms and privacy policy.

Contact

For subprocessor queries, copies of data-processing terms, or to object to a specific subprocessor, contact admin@intervyo.co.uk. See also our Privacy Policy §9 and Data Retention Policy.