Sub-processors

1.What this page is

1.1A sub-processor is a company that processes personal data on Admarket's behalf, under our instructions, so that the platform can work. This page names all of them.

1.2It is part of the data processing addendum. Section 6 of that addendum is what gives you the right to be told before this list changes, and the right to object.

1.3Every provider here is engaged under written terms imposing data protection obligations no less protective than the ones we owe you, and Admarket stays fully liable for what each of them does.

1.4This list is short, and we intend to keep it that way. Every name on it is a company that can see something about you, and the honest way to run the list is to add to it as rarely as possible.

2.Current sub-processors

2.1Google Analytics is the only entry on this list that depends on your answer to the cookie banner. Decline and nothing is requested from it — its script is not loaded at all. Every other provider here is needed for the platform to function and cannot be switched off while you use it.

Where the data actually lives — Compute, the database and uploaded media are in Frankfurt. The two entries that leave that footprint by design are the translation and content-review provider, which we cannot pin to a region, and the payment partner, which operates where it operates. Those are the transfers section 8 of the addendum is about.

3.Services that receive no personal data

3.1We use a few other things that are not on the list above, because nothing personal reaches them. They are named here so that the absence is a statement rather than an omission.

3.2There are no advertising networks, no social media pixels, no tag managers, no session recorders, no heat-mapping tools and no data brokers. We sell advertising space and we do not track people across the internet.

4.Recipients that are not sub-processors

4.1Some people receive your data without processing it for us. They are not sub-processors and this page does not cover them.

• The other party to your transaction, who is an independent controller of what the trade shows them — section 2 of the privacy policy;
• an AdBroker, for the listings and orders inside their scope, read-only and under the programme terms;
• our professional advisers, and authorities, courts and regulators where we are required to disclose or need to defend a claim;
• a buyer of the business, on a merger or reorganisation, under confidentiality and on the same commitments.

4.2Stripe appears on both lists in a sense: it processes on our instructions for the payment we ask it to take, and it is also a controller in its own right for its fraud prevention and regulatory obligations. Its own terms govern that part, and we cannot instruct it about it.

5.How this list changes

5.1We give at least 30 days' notice before adding or replacing a sub-processor. The notice is this page being updated, together with a message to the account owner of every workspace.

5.2You can object on reasonable data protection grounds within those 30 days, through the support system, saying what the ground is. Section 6 of the data processing addendum sets out what happens then.

5.3We may add a provider without notice where it is needed urgently to protect the platform or its users from a security threat, and we will say so here as soon as we reasonably can.

5.4When a provider is removed, it stays listed here with the date it was removed until the next version of this page, so that the change is visible rather than silent.

5.5This page is maintained by hand. A provider added to the platform without being added here would make this page untrue, so adding one is part of the change that introduces it, not a task afterwards.

6.Contact

6.1Questions about a provider on this list, requests for the safeguards behind a particular transfer, and objections to a new one all reach us through the support system on the platform. If you do not have an account, use the public contact page.