Sub-processors
Every third party that processes data on our behalf, what it does, and where it is.
1. Current sub-processors
These are the third parties that process data on our behalf or receive data from us in order to deliver the service. The list is complete as at the date above.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Microsoft Azure | Application hosting, database, identity (Microsoft Entra) | All platform data, account identities, access logs | United States (West US) |
| Google (Google Ads API) | Creating and managing your Google Ads campaigns; retrieving performance data | Campaign settings, budgets, creative, targeting, performance metrics | United States |
| Meta Platforms (Marketing API) | Creating and managing your Facebook and Instagram campaigns; retrieving performance data | Campaign settings, budgets, creative, targeting, performance metrics | United States |
| TikTok (Marketing API) | Creating and managing your TikTok campaigns; retrieving performance data | Campaign settings, budgets, creative, targeting, performance metrics | United States |
| Authorize.Net (Visa) | Payment processing | Cardholder name, card details, billing address, transaction records | United States |
The advertising networks in this list are a special case: they act as independent controllers for the platform data they hold, not purely as our processors. They are listed here anyway, because you should be able to see everywhere your data goes in one place rather than in two.
2. What we require of them
Before engaging a sub-processor we satisfy ourselves that it:
- is bound by a written agreement no less protective than the commitments in our Privacy Policy;
- processes data only on our documented instructions;
- applies appropriate technical and organisational security measures;
- imposes confidentiality obligations on its personnel; and
- provides a lawful transfer mechanism where data leaves the UK or the EEA, and assists us in responding to data subject requests.
We remain responsible to you for what our sub-processors do with your data.
3. Changes to this list
We will update this page before a new sub-processor begins processing, and we will give account holders at least 30 days’ notice by email of any addition that materially affects the processing of their data.
If you have a reasonable, data-protection-related objection to a new sub-processor, tell us at privacy@mediapoint.ai within that notice period. We will work with you to find an alternative; if we cannot, you may terminate without penalty and have your unspent balance returned.
To be notified of changes without waiting for an email, ask at privacy@mediapoint.ai to be added to the notification list.