This is the register of sub-processors referred to in clause 4 and Annex III of the RRMS Data Processing Agreement. It lists every provider that processes our customers’ personal data for the RRMS web application at portal.rrmsgroup.com, with its contracting entity, published address, what it does, where the data is held, the transfer basis and its privacy contact.
When we intend to add or replace a sub-processor we notify our customers first; a customer may object on reasonable data-protection grounds within thirty (30) days of the notice (Data Processing Agreement, clause 4). Questions: admin@rrmsgroup.com.
| Sub-processor (contracting entity and published address) | What it does | Where the data is | Transfer basis | Privacy contact |
|---|---|---|---|---|
| Render Services, Inc. 525 Brannan Street, San Francisco, California, USA |
Application hosting (API) and the managed PostgreSQL database, which holds all customer data; delivery of the web application’s static files through a content-delivery network | EU region, Frankfurt, Germany. The static files (no customer data) are served from a global network whose edge may log request metadata such as IP addresses | Render DPA (part of Render’s terms); EU-US Data Privacy Framework and/or 2021 Standard Contractual Clauses for any access from the US | privacy@render.com; EU representative: Osano International Compliance Services Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland |
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxembourg (parent: Amazon Web Services, Inc., Seattle, USA) |
Amazon S3 object storage: uploaded files, the nightly encrypted database backups (30 days) and the write-once audit-log archive (six years) | EU region eu-north-1, Stockholm, Sweden; encrypted at rest | AWS Data Processing Addendum (part of the AWS service terms, incl. the 2021 Standard Contractual Clauses); Data Privacy Framework for any access from the US | aws-EU-privacy@amazon.com (data protection officer) |
| Google Cloud EMEA Limited — Google Workspace (Gmail) 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (parent: Google LLC, Mountain View, USA) |
Sending system e-mail from RRMS: invitations, one-time sign-in codes, password-reset and service messages (recipient name, address and message content) | Google’s data centres. Our Workspace edition has no EU data-region setting, so messages may be stored outside the EEA | Google Cloud Data Processing Addendum (accepted 15 October 2026); Google LLC is certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback | Google Workspace data-protection form: support.google.com/a/contact/googlecloud_dpr |
| Functional Software, Inc. (Sentry) 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA |
Error monitoring for the API and the web application (diagnostic events can include user identifiers and request metadata; IP addresses are not stored and data scrubbing is on) | Sentry EU data region, Frankfurt, Germany; events kept 30 days | Sentry DPA v5.1.0 (signed 15 June 2026); EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback | compliance@sentry.io; EU representative: Sentry Software Netherlands B.V., Schiphol Boulevard 359, 1118 BJ Amsterdam Schiphol, Netherlands |
| Cloudflare, Inc. 101 Townsend Street, San Francisco, CA 94107, USA |
Web-application firewall and reverse proxy in front of the web application and the API. It terminates the encrypted (TLS) connection, so request and response content, which can contain personal data, passes through it in transit; DDoS and firewall filtering; IP-level security logs | Cloudflare’s global network: traffic is handled at the edge location nearest the user, which can be outside the EEA | Cloudflare Customer DPA v6.4 (part of Cloudflare’s terms); EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback | dpo@cloudflare.com (data protection officer) |
| Google Cloud EMEA Limited — VirusTotal (part of Google Threat Intelligence; optional) 70 Sir John Rogerson’s Quay, Dublin 2, Ireland |
Malware screening of uploaded files by their fingerprint (SHA-256 hash) only, where the antivirus feature is enabled | Receives file hashes only, never file content; a hash does not identify a person in the ordinary course | No customer personal data is transferred in the ordinary course | Google Cloud data-protection form (as above) |
Privacy Policy · Data Act information