Orchard Reach Ltd.
Sub-Processor List
Effective: May 1, 2026
Draft — for legal review
1. Overview
This page lists the sub-processors engaged by Orchard Reach Ltd. to process personal data on behalf of our customers. This list is maintained in accordance with our Data Processing Agreement and GDPR requirements. Customers are notified at least 30 days in advance of any changes to this list.
For questions about our sub-processors, please contact info@orchardreach.com.
2. Current Sub-Processors
The following sub-processors are currently engaged by Orchard Reach:
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, data storage, compute infrastructure | EU (Frankfurt, Germany) | All Platform data including account data, prospect data, and campaign analytics |
| Stripe, Inc. | Payment processing and subscription billing | USA (EU-US DPF certified) | Customer billing information, transaction records |
| HubSpot, Inc. | Customer relationship management and marketing automation | USA (EU-US DPF certified) | Customer contact details, website visitor tracking data |
| Mailreef | Email sending infrastructure and deliverability management | See current documentation | Prospect email addresses, email content, delivery metadata |
| Sanity.io | Content management system for website | EU/USA | No personal data (website content only) |
| Google LLC (GA4) | Website analytics | USA (EU-US DPF certified) | Anonymised website usage data, IP addresses (anonymised) |
| Microsoft Corporation (Clarity) | Website analytics and behaviour mapping | USA (EU-US DPF certified) | Website interaction data, session recordings |
| Meta Platforms, Inc. | Advertising conversion tracking | USA (EU-US DPF certified) | Website visitor data (with cookie consent) |
| LinkedIn Corporation | Advertising conversion tracking | USA (EU-US DPF certified) | Website visitor data (with cookie consent) |
| TikTok / ByteDance Ltd. | Advertising conversion tracking | Singapore / USA | Website visitor data (with cookie consent) |
3. International Transfer Safeguards
For sub-processors located outside the European Economic Area, Orchard Reach relies on the following transfer mechanisms:
- EU-US Data Privacy Framework (DPF): For sub-processors certified under the DPF, as indicated in the table above.
- Standard Contractual Clauses (SCCs): For sub-processors not certified under the DPF, we execute Standard Contractual Clauses approved by the European Commission.
4. Changes to This List
Orchard Reach will notify customers via email at least 30 days before engaging a new sub-processor or making material changes to existing sub-processor arrangements. Customers may object to changes in accordance with the procedures described in our Data Processing Agreement.
5. Version History
This sub-processor list was last updated on May 1, 2026. Previous versions are available upon request by contacting info@orchardreach.com.