Sub-processors
Last updated: 29 June 2026
To run the Conversion Uploader, New North Digital engages the sub-processors below. This list is incorporated into our Data Processing Agreementand is the canonical version; the privacy policy summarises it. We will give reasonable prior notice of changes (see the DPA, clause 7).
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Google (Google Ireland / Google LLC) | Recipient of the uploaded conversions (Google Ads, Google Analytics 4) via the Data Manager API, for advertising measurement | United States | Google Ads Data Processing Terms + EU Standard Contractual Clauses |
| Vercel Inc. | Application hosting and serverless compute | United States (default deployment region) | Vercel DPA + EU Standard Contractual Clauses |
| Neon Inc. | Managed Postgres database (configuration, hashed references, reconciliation results, encrypted credentials) | United States (us-east-1); EU region (eu-central-1) available on request | Neon DPA + EU Standard Contractual Clauses |
| Resend | Transactional/operational email (failure, connection and match-rate alerts) | United States | Resend DPA + EU Standard Contractual Clauses |
Data location and EU residency
The application and database are currently hosted in the United States, and Google processes the conversions in the United States. Cross-border transfers are covered by the safeguards in the table above (principally the EU Standard Contractual Clauses). For controllers that require their data to stay in the EU, EU-region hosting (database and application in the EU) can be arranged before onboarding; contact hello@newnorth.nl.
Note on data minimisation
Raw email and phone are hashed in memory and never stored, so the personal data held by these sub-processors is limited to hashed identifiers, pseudonymous references and aggregate counts. Raw webhook and CSV payloads are encrypted at rest and deleted on a configurable schedule (30 days by default).