Sub-processors
Last updated: 21 October 2026
SheEatsOnions is a trading name of Rabblepop Ltd (company no. 17361712). When we build, host or look after your website, we process personal data on your behalf, such as enquiries sent through your site. These are the companies that help us do that.
| Sub-processor | What for | Where | Which sites |
|---|---|---|---|
| Vercel Inc. | Hosting, server functions, content delivery, and file storage for images and files uploaded through the site's CMS | Server functions in London; content served from Vercel's global network; file storage in London, or the United States (Washington, D.C.) for sites whose store was created there | All (file storage: sites with a CMS) |
| Databricks, Inc. (Neon) | Database: CMS content, enquiries, bookings | London (AWS eu-west-2) | Sites with a CMS |
| Plus Five Five, Inc. (Resend) | Sending enquiry notifications and other site emails | United States | All with a contact form |
| Stripe Payments Europe, Limited, with processing in the US by Stripe, LLC | Taking payments on your site | European Union (Ireland) and United States | Sites that take payments |
| Functional Software, Inc. (Sentry) | Error monitoring | European Union (Germany): our Sentry organisation is on de.sentry.io | Sites that run it |
| Google (Maps Platform) | Address lookup, maps and route pricing | United States | Sites that use them. The Places API is called from our server with no visitor data where we can; a map shown in the browser contacts Google directly |
Outside the UK. For providers in the United States we rely on the UK extension to the EU–US Data Privacy Framework, or the International Data Transfer Agreement or Addendum, as each provider's data processing terms set out. The European Economic Area is covered by UK adequacy regulations. Resend: DPF and UK Extension, otherwise EU SCCs with the UK Addendum (resend.com/legal/dpa). Vercel: the Standard Contractual Clauses with the UK Addendum (vercel.com/legal/dpa). Neon: data held in the UK; any access from the United States relies on the UK Extension to the EU–US Data Privacy Framework, otherwise the Standard Contractual Clauses with the UK Addendum. Google: the Data Privacy Framework and its UK Extension (Google LLC). Stripe: transfers to Stripe, LLC in the US rely on the Data Privacy Framework and its UK Extension, otherwise the UK International Data Transfer Addendum to the EU SCCs (stripe.com/gb/legal/dpa §6.1 and its Data Transfers Addendum, stripe.com/gb/legal/dta §§2–3).
Changes. We will email the contact named in your order form at least 30 days before we add or replace a sub-processor, and update this page with the date the change takes effect. You can object on reasonable data protection grounds before then; your data processing agreement says what happens next.
A sub-processor's own role. From 20 November 2026 (its updated privacy policy) and 6 January 2027 (its updated services agreement for existing users), Stripe states that it acts as a processor when it processes payments on our instructions, and as an independent controller for its own fraud prevention, anti-money-laundering and identity checks, choice of bank and card network, and product improvement. No new sub-processor or location is added.
Questions: zeki@rabblepop.com