Subprocessors

1.What a subprocessor is

Under GDPR Article 28, a subprocessor is a company we hire that handles personal data on our instructions and for our purposes, under a written contract, and is not permitted to use that data for its own ends. We are the controller. The company behind the web host is the processor. A further company the processor engages, such as a delivery network, is a subprocessor.

Muhammad Shadab Shams, trading as GoPickStack, is the controller for every purpose described in our Privacy Policy. The individuals below are the only third parties that process personal data on our instructions.

This page exists so the list can be checked without reading the full privacy policy. Every entry says what the company does, what it actually receives, where it runs, and what allows the transfer.

2.The register

6 companies currently process personal data for this site. Where a value is shown as to be confirmed, the underlying fact is not yet settled and we would rather show you the gap than print something we cannot verify.

3.How transfers work

Muhammad Shadab Shams is established in Pakistan. Nothing about that lets us assume a non-EU or non-UK processor is inside a privacy jurisdiction, so every entry above that runs outside the European Economic Area or the United Kingdom rests on a lawful transfer mechanism rather than on hope.

Those mechanisms are, in order of preference: an adequacy decision where one exists for the destination country; the Standard Contractual Clauses adopted by the European Commission; and the UK International Data Transfer Addendum for transfers out of the United Kingdom. Where a transfer also depends on your consent, such as the AI Copilot and the affiliate networks, the consent is stated in the entry itself rather than assumed.

We do not routinely rely on the Article 49 derogations, such as explicit consent given for one specific transfer. Using an exception as the default mechanism is exactly the shortcut that produces unlawful transfers, so we use the standard mechanisms instead.

Plausible receives no personal data at all, so no transfer applies to it. Our host's datacenter region is not yet confirmed, which is why its location above reads as to be confirmed rather than naming a country we have not verified.

If you think a particular transfer affects you badly, tell us and we will explain which mechanism covers it. You can also complain to your national supervisory authority, as set out in the Privacy Policy.

4.When this list changes

We will post a material change to this page and record it in our changelog before the change takes effect, not after. If we add a subprocessor that will receive personal data, we will give at least 30 days notice first, on this page and through the contact address below.

Removing a subprocessor also gets an entry here, with the date it stopped. A list that only ever grows is not a record of anything.

We will not quietly widen what a listed company receives. If the data an existing subprocessor holds changes materially, that is a change to this list and it gets the same notice.

5.Questions about this register

If you want to know which subprocessor touches a particular feature, or you want the contract terms we hold with one of them, email hi@gopickstack.com and ask. We are one person, and answering takes less time than most vendors need to return a support ticket.

Privacy requests, including a request to delete your data, go to the same address and are answered within the deadlines stated in the Privacy Policy. We do not charge for them.