> The third-party providers we use to run this site, and the data-protection safeguards in place.

Source: https://granddraws.co.uk/sub-processors

---

# Sub-processors

Last updated: 29 October 2026

We believe in being open about who helps us run Grand Draws. As the **data controller**, we use a small number of trusted third-party providers (“sub-processors”) to operate the site. Each is bound by a written data-processing agreement requiring it to protect your data to a standard no lower than we owe you, and we remain responsible for their performance.

## Current sub-processors

| Provider | Purpose | Location | Transfer safeguard |
| --- | --- | --- | --- |
| **Supabase** | Database, authentication and realtime for entrant accounts, entries, orders and winners | EU (AWS-backed) | DPA + UK IDTA / SCC Addendum |
| **Cloudflare** | Hosting, CDN, DNS, edge security (WAF/DDoS/bot mitigation) | Global edge (US-headquartered) | Cloudflare DPA + UK Addendum to the EU SCCs |
| **Brevo** | Transactional email. Today that is a new-signup alert to us; at launch it adds entry confirmations, winner notifications and, with your consent, marketing email. | EU (France) | Brevo DPA + EU SCCs / UK Addendum |
| **Google (Analytics 4 and Tag Manager)** | Aggregate site analytics and tag management. Loads only after you accept analytics cookies. | US | Google DPA + EU-US DPF / UK Extension |
| **Microsoft Clarity** | Anonymised session analytics (how pages are used). Loads only after you accept analytics cookies. | US | Microsoft DPA + EU-US DPF / UK Extension |
| **Meta** | Ad measurement: the Meta Pixel (only after you accept marketing cookies) and a server-side signup event carrying a hashed email so ad reports can be de-duplicated. | US | Meta DPA + EU-US DPF / UK Extension |
| **Airtable** | Our customer records: a mirror of account sign-ups so we can manage enquiries and, with consent, marketing. | US | Airtable DPA + EU SCCs / UK Addendum |
| **Zapier (when lead-form automation is enabled)** | Passes details you submit on a Meta lead form to us so we can create the account you asked for. | US | Zapier DPA + EU SCCs / UK Addendum |
| **Nochex (card processing via PAYSTRAX on the OPPWA platform)** | Taking entry payments. Nochex and its card processors receive the card details you enter, the amount, your email address and an order reference. We get back only a payment reference that matches the payment to your entry, never card details. | UK / EEA | Nochex DPA; PCI DSS held by the payment processors |

## Payments

Entry payments are taken by **Nochex**, with card processing carried out through PAYSTRAX on the OPPWA platform, under their own PCI DSS compliance. We never receive or store full card details, only a payment reference that lets us match a payment to an entry.

## How we notify changes

We'll update this page before we add or replace a sub-processor that handles personal data. Please check back periodically. For anything about this page, contact [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk).

*Locations and transfer safeguards are stated from each provider's own published terms. The Nochex row is being checked against the signed agreement, and this page is reviewed alongside the privacy policy whenever either changes.*