Sub-processors
Who else touches your data, what they do, and where they do it
Last updated: 4 September 2026
1. What this page is
When your charity uses Alder CRM, we process personal data on your instructions — you are the controller, we are the processor. To run the service we rely on a small number of specialist providers, and where those providers process personal data on our behalf they are sub-processors.
UK GDPR requires us to tell you who they are. This page is that list. It is referenced by our Terms of Service and Data Processing Agreement, and it sits alongside our Privacy Policy and our Security & Data Protection page.
2. Current sub-processors
Every provider we engage is listed here, with what it does and where it does it. The providers that handle the CRM data you hold about your supporters and beneficiaries come first, followed by those that touch only our own billing, our own marketing, and our website — and never your workspace.
| Sub-processor | Purpose | Location and transfer mechanism |
|---|---|---|
| Hostinger UK Limited | Primary hosting of the application and database | United Kingdom (London region). A UK-established entity hosting in the UK, so no international transfer arises |
| BunnyWay d.o.o. (Bunny.net) | Object storage for uploaded files and backups, delivery of those files, and hosting of some application workloads | UK regions for storage, delivery and application workloads; entity established in Slovenia (an adequate country) |
| Mailgun Technologies, Inc. (a Sinch company) | All email sent by the platform — account, security and notification email, and the newsletters and campaign email your charity sends from Alder CRM | EU region; UK Addendum to the EU SCCs / IDTA |
| Twilio Ireland Limited | Phone number verification for authorised users. Text and WhatsApp messages your charity sends run through your own provider account, not ours — see section 3 | Message content and phone numbers are processed and stored in Twilio’s Ireland (IE1) region (an adequate country) up to the point they reach the mobile networks, who complete delivery under their own terms. Support access from the United States is covered by the UK Addendum to the EU SCCs |
| New Relic, Inc. | Application performance and error monitoring. Error reports may incidentally include fragments of customer data | EU region (Frankfurt, Germany — an adequate country). Support access from the United States is covered by the UK Addendum to the EU SCCs |
| Stripe Payments UK Ltd | Payment processing for our fees. Billing contact data only — Stripe does not receive your CRM data | United Kingdom |
| ActiveCampaign, LLC (Postmark) | Delivery of Alder’s own marketing and outreach email, where we are the controller. It does not carry your CRM data, and nothing your charity sends from Alder CRM goes through it | United States (Chicago, and Amazon Web Services). Postmark has no EU region; UK Addendum to the EU SCCs |
| Plausible Insights OÜ | Website analytics for the aldercrm.com marketing site only. Cookieless, with no personal data and no cross-site tracking. It does not touch the CRM — see our Cookie Policy | Data stored in Germany on European-owned infrastructure; entity established in Estonia (an adequate country) |
| Google, Microsoft and Apple | Authentication of authorised users, where they choose to sign in with one of these accounts. Identity assertions only | Each provider acts as an independent controller under its own terms. Listed here for transparency rather than as a sub-processor |
3. What is not on this list
Services you connect under your own account. If your charity connects a third-party service to Alder using your own credentials — an AI assistant such as Claude or ChatGPT, your own SMS or WhatsApp provider, your own payment tools — that service is not our sub-processor. You have chosen it, you hold the contract with it, and the data you send to it is governed by your agreement with them, not ours.
Our own suppliers who never see your data. Accountants, our own office software, and similar business services do not process the personal data you entrust to Alder, so they are not sub-processors of it and are not listed here.
Anyone we have not engaged. We do not sell, rent, or share personal data with advertising networks or data brokers. We may disclose data where the law requires it, as described in our Privacy Policy.
4. How we choose and manage sub-processors
- We carry out due diligence on each provider before engaging them, and we review them periodically
- Each is bound by a written contract imposing data protection obligations no less protective than those we owe you
- We give each one access only to the data it needs to perform its function, and nothing more
- Where a provider processes personal data outside the UK, we rely on an appropriate transfer safeguard — adequacy, the UK Addendum to the EU standard contractual clauses, or an International Data Transfer Agreement — as noted in the table
- We remain responsible to you for the acts and omissions of our sub-processors
5. Changes to this list
We notify workspace administrators of any addition to, or replacement of, a sub-processor at least 30 days in advance, in accordance with paragraph 5.2 of our Data Processing Agreement. That gives you time to object before the change takes effect.
If you have a reasonable objection on data protection grounds, tell us and we will work with you to find a resolution. If we cannot, you may terminate the affected part of the service without penalty, as set out in the Data Processing Agreement.
Contact us
If you have questions about any provider on this list, or you need a copy of our Data Processing Agreement, please get in touch:
Alder CRM Limited
Email: hello@aldercrm.com
Registered office: The Brew, 1st Floor, Eagle House, 163 City Road, London, EC1V 1NR
Company registration: England and Wales, No. 17116559