GDPR Sub-Processor List
This page identifies the third-party service providers (“Sub-processors”) authorised by GetOnline Ltd trading as AuthSMTP to process limited personal data on behalf of our customers.
Each Sub-processor performs specific functions required to deliver our services. We require all Sub-processors to meet equivalent data protection and security obligations as set out in our Data Processing Addendum (DPA).
| Sub-Processor | Registered Address | Service Provided | Processing Location(s) | Categories of Data Processed | DPF Certified |
|---|---|---|---|---|---|
| Cloudflare, Inc. | 101 Townsend St, San Francisco, CA 94107, USA | Content delivery network, DDoS protection, traffic routing | Global (incl. US, EU, UK data centres) | IP addresses and limited network metadata necessary for routing and DDoS protection. Note: For the avoidance of doubt, transient message payloads may pass through Cloudflare’s infrastructure but are not stored or inspected beyond what is required for security filtering. |
Yes |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | 22–24 Boulevard Royal, L-2449 Luxembourg | Payment processing for subscription billing (including transaction receipt delivery) | EU, US (PayPal global infrastructure) | Customer identification data, payment details, transaction data, email addresses Note: For the avoidance of doubt, PayPal acts as an independent Controller with respect to payment processing and associated customer data. Vendor does not share message or SMTP traffic data with PayPal. Payment information is handled in accordance with PayPal’s own Data Processing Agreement and privacy notices. |
n/a |
DPF Certified: Indicates whether Sub-processor is certified under the EU-US Data Privacy Framework and UK Extension. Certification status verified annually. Where certified, UK transfers may rely on DPF certification; however, Standard Contractual Clauses remain in place as an alternative legal mechanism.
We will update this page before engaging any new Sub-processor. Customers may object to the addition of a new Sub-processor as permitted under Section 6.3 of our DPA by contacting [email protected] within 30 days of the update.
Last Review: 5th November 2025
Next Review: 5th November 2026