This page is the single source of truth for the third parties that process data on LevyBoard's behalf. Schedule 3 of the Data Processing Agreement incorporates it by reference.
If you are a residents management company or right to manage company using LevyBoard, you are the controller of your leaseholders' personal data and we are your processor. These are our sub-processors, and clause 5 of the DPA sets out your right to object to a new one.
How you are told about changes
We give at least 30 days' notice before adding or replacing a sub-processor. Notice goes by email to your registered billing contact, and this page is updated at the same time. If you have a reasonable, data-protection-based objection, tell us within 14 days and we will work with you to resolve it; if we cannot, you may terminate without penalty and we will refund the unused part of your subscription.
The list
| Sub-processor | Legal entity | What it does | Where it processes | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd. (Singapore) | Database, authentication, and storage of the demand and notice files LevyBoard generates | United Kingdom — eu-west-2 (London) |
UK Addendum to the EU SCCs (Supabase DPA Schedule 2 §2). The transfer risk assessment it requires (Art 46(1A) UK GDPR) will be completed by 30 November 2026 (see DPA clause 6.3). |
| Stripe | Stripe Payments Europe, Limited (Dublin) | Subscription payments. Card details go to Stripe directly and never reach our systems — we store only a customer and subscription reference. | EU (Ireland) primary; US for group support operations | UK adequacy regulations (EEA) for Stripe Payments Europe, Limited; UK Extension to the EU-US Data Privacy Framework for Stripe, LLC (Stripe Data Transfers Addendum §2–3). |
| Resend | Plus Five Five, Inc. (US) | Sends the product's own email — welcome, payment, deadline digest — from mail.levyboard.co.uk |
United States (account data, email content and metadata, delivery logs); sending region Ireland (eu-west-1) |
UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Plus Five Five, Inc.'s certification is active and covers non-HR data. Resend DPA §11 (Data Privacy Framework), with the UK Addendum for any transfer it does not cover (§6.4). |
| Microsoft 365 | Microsoft Ireland Operations Limited | The support mailbox at support@levyboard.co.uk, and the inbox that receives data-subject requests |
United Kingdom | UK adequacy regulations (EEA). |
| Sentry | Functional Software, Inc. (US) | Error monitoring, so a fault is noticed before you have to report it. Before an error report is sent, our code removes the values of a fixed list of fields that hold personal data (such as leaseholder names, correspondence addresses and email addresses) and keeps no details of the signed-in user except an internal ID. It does not search free text, such as the wording of an error message, for personal data: there it removes only sign-in codes and tokens carried in web addresses, so a name or email address written into an error message could still be sent. Sentry removes IP addresses and location data on receipt and does not store them. | EU (de.sentry.io) |
UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Functional Software, Inc.'s certification is active and covers non-HR data. The Sentry DPA (Schedule 3, Cross-Border Transfer Mechanisms) applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover. |
| Upstash | Upstash, Inc. (US) | Rate limiting on most of the product's API routes, counted per organisation. Holds the organisation's internal account ID and a request counter — no customer records. | EU | UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Upstash, Inc.'s certification is active and covers HR and non-HR data. Upstash DPA §3.2(B)(1) applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover (§3.2(B)(2)). |
| Netlify | Netlify, Inc. (US) | Hosting, edge functions, content delivery, and DNS | US, with global edge | UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Netlify, Inc.'s certification is active and covers non-HR data. Netlify DPA §14.2 applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover (§14.4). |
Support access to Supabase data. The data Supabase holds is stored in London, but Supabase personnel may access it remotely to operate and support the service, and Supabase's own sub-processors include Supabase, Inc. (United States), which provides support services; Supabase is bound by the onward-transfer conditions of the Standard Contractual Clauses in the Supabase DPA.
Website analytics
GoatCounter provides the website analytics. It sets no cookies, collects no personal data, and never sees anything inside your account — it counts page views on the public pages, which is why it is not a sub-processor of your leaseholders' data and is not in the table above. See the Cookie Policy.
Scope of this list
Only the services in the table above, and the sub-processors they engage in turn (such as Supabase, Inc., described above), receive account data. LevyBoard uses no advertising or marketing platform, no data broker or enrichment service, and no AI or machine-learning provider: there are no ad pixels or retargeting tags, nothing about your leaseholders is sent anywhere to be matched or scored, your records are not sent to any model, and nothing in your account is used as training data. The statutory wording the product emits is transcribed verbatim from legislation.gov.uk and byte-compared against the hash recorded when it was transcribed.
Questions
Email privacy@levyboard.co.uk. LevyBoard is a product of Crocker Digital Ltd, company number 17008789, registered in England and Wales.