Subprocessor List
This Subprocessor List forms part of, and is incorporated by reference into, the Data Processing Agreement (the “DPA”) between Kinset Limited (“Kinset”) and its customers.
Kinset Limited is a private company limited by shares incorporated in Ireland under company number 745880, with registered office at 15 Sandymount Road, Dublin 4, D04 X9K4, Ireland.
Capitalised terms not defined in this document have the meanings given in the applicable DPA or in Kinset’s Commercial Terms of Service.
1. PURPOSE
1.1 This document identifies the third-party subprocessors engaged by Kinset to Process Personal Data on behalf of customers in connection with the provision of the Services.
1.2 Kinset engages subprocessors solely for the purpose of supporting the delivery, hosting, security, monitoring, support and operation of its connected product platform, comprising digital link, digital product passport, life cycle assessment, impact reporting, supply chain traceability and supplier portal modules.
1.3 Each subprocessor is engaged under a written agreement that imposes data protection obligations no less protective than those set out in the DPA, in accordance with Article 28(4) GDPR.
2. CURRENT SUBPROCESSORS
2.1 Infrastructure and Hosting
| Subprocessor | Service Provided | Location of Processing | Transfer Mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting infrastructure and data storage | EU (Ireland — eu-west-1) | EU SCCs / adequacy where applicable |
| Cloudflare, Inc. | Content delivery network, DDoS protection, traffic optimisation | EU and global edge network | EU SCCs |
2.2 Communications and Customer Support
| Subprocessor | Service Provided | Location of Processing | Transfer Mechanism |
|---|---|---|---|
| Google Ireland Limited | Email, productivity and collaboration services | European Union | EU SCCs where required |
| HubSpot Ireland Limited | Customer relationship management and customer communications | EU and United States | EU SCCs |
| Tidio LLC | In-app messaging and customer support | European Union | EU SCCs where required |
2.3 Analytics and Monitoring
| Subprocessor | Service Provided | Location of Processing | Transfer Mechanism |
|---|---|---|---|
| Google Ireland Limited | Website analytics and performance monitoring | European Union | EU SCCs where required |
| Posthog Inc | Website analytics and performance monitoring | European Union | EU SCCs where required |
2.4 Identity and Authentication
| Subprocessor | Service Provided | Location of Processing | Transfer Mechanism |
|---|---|---|---|
2.5 Payment Processing
| Subprocessor | Service Provided | Location of Processing | Transfer Mechanism |
|---|---|---|---|
| Stripe Payments Europe, Limited | Subscription billing and payment processing | European Union | EU SCCs where required |
Kinset may, in addition, engage Affiliates of the above entities to assist with the provision of the Services, subject to equivalent contractual data protection obligations.
3. INTERNATIONAL DATA TRANSFERS
3.1 Where a subprocessor processes Personal Data outside the European Economic Area or the United Kingdom, Kinset ensures that appropriate safeguards are implemented in accordance with Applicable Data Protection Law.
3.2 Such safeguards may include reliance on an adequacy decision adopted by the European Commission or the UK government, the EU Standard Contractual Clauses (supplemented by the UK Addendum where required), or another lawful transfer mechanism.
3.3 Where required, Kinset performs and documents transfer impact assessments to evaluate whether the laws of the destination country provide an essentially equivalent level of protection.
4. DUE DILIGENCE AND OVERSIGHT
4.1 Kinset conducts appropriate due diligence prior to engaging any subprocessor, including assessment of the subprocessor’s technical and organisational measures and data protection practices.
4.2 Each subprocessor is required to implement appropriate technical and organisational measures to protect Personal Data.
4.3 Kinset remains responsible for the performance of its subprocessors’ data protection obligations in accordance with the DPA, and remains the customer’s sole point of contact in respect of Processing carried out under the DPA.
5. UPDATES TO THIS LIST
5.1 Kinset may update this Subprocessor List from time to time, including to add or replace subprocessors.
5.2 Customers will be notified of material changes (in particular, the addition or replacement of subprocessors) in accordance with the notification provisions set out in the DPA, and customers may object to a new subprocessor on reasonable data protection grounds in accordance with the DPA.
5.3 The most recent version of this Subprocessor List will be available on Kinset’s website at https://kinset.com/legal/subprocessors. Customers may subscribe to email notifications of changes by writing to privacy@kinset.com.
6. CONTACT
Questions regarding this Subprocessor List may be directed to:
Kinset Limited
15 Sandymount Road, Dublin 4, D04 X9K4, Ireland
Email: privacy@kinset.com
7. CHANGES TO THIS DOCUMENT
Kinset may update this document from time to time. The most recent version will always be available on Kinset’s website with an updated “Last Updated” date.
Last Updated: May 2026