Data sub-processors for all Impact Stack clients
Hetzner Online GmbH
Hetzner is a hosting company based in Germany (with data centres in Germany) that offers a range of IT services.
This is the provider for the main hosting environment for the Impact Stack service. All supporter data records are processed on these servers.
Services provided
- Virtual server hosting for all Impact Stack clients.
Data held
application data, Personal Data of customer and end-users (supporters), including contact data.
Certifications
- ISO 27001 for the data centre
Netcup GmbH
Netcup is a hosting company in Germany (with data centres in Germany) that provides a range of IT services. More Onion uses their virtual servers for encrypted backups of supporter data as well as backups of files. Typically the supporter data is stored and processed on these servers but the data is saved in an encrypted state.
This hosting environment can also be used as a recovery set-up to bring our services back online in the case of an incident at the main hosting provider. In such an event all supporter data will be processed on the Netcup servers.
Services provided
- Virtual backup server
- Fallback hosting environment in case of issues with Hetzner
Data held
- backups of application data
- images and files uploaded to IST
- encrypted supporter data
- supporter data (in case of emergency)
Certifications
- ISO 27001
Volentio JSD Limited
JSdelivr is a Content Delivery Network (CDN) for open source libraries. More Onion uses this service to speed up loading times and to streamline deployment of Java Scripts for Impact Stack. When users load a page on Impact Stack, some Java Script libraries will load from the CDN. Therefore the user’s IP address as well as the time of access is processed by this service.
Since the purpose of a a CDN is to make the data available around the world, the user data is also processed globally, but typically close to the user’s location.
Services provided
- Fast and distributed delivery (CDN) of JavaScript libraries
Data held
- IP-addresses, date and origin of access for all page visitors. The data is usually aggregated after a few hours.
There is no strict limitation of which CDN and from which location the files are served. However the purpose of a CDN is to serve them from close to the user. This means requests from within the EU will typically be served from a server within the EU. See the page about the jsDelivr network.
Stackhero
Stackhero is a “Platform as a Service” provider based in France (the data centres used are located in the EU). More Onion uses Stackhero to host a database that contains pseudonymised Impact Stack supporter data for the purpose of data analysis and data visualisation.
The objective is that only pseudonymised supporter data is processed by Stackhero.
Services provided
- Hosting for the analytics database (Insights DB)
Data held
- Pseudonymised data of the form submissions: Email-addresses in these form submissions are replaced with a hash value. Our objective is to filter out other identifiable parts of the form submission.
Certifications
- ISO/IEC 27001:2022
Sentry
Sentry is an application monitoring software (with data centres in EU). More Onion uses Sentry to collect, process and monitor error data. The objective is to only share anonymised supporter data with their service and to avoid sharing data that is not required.
Services provided
- Error reporting and alerting
- Performance analysis
Data held
The data includes:
- Logged-in user account (if any)
- State of the session and permissions
- Information about the client and operating system in use
- Data and metadata of the request that caused the error.
- Additional messages entered by the user when filing an error report.
Limitations:
- Sentry only receives a scrubbed version of the data. This means names and email addresses will usually be obscured before sending. The information we send might still be sufficient to identify an individual.
- Data is held for a period of up 90 days in order to allow analysis and debugging. After this period the data is deleted.
Configuration:
- We make use of strict data scrubbing and privacy settings.
- We disabled storing of IP addresses.
- We make use of the EU-only storage option of Sentry.
Certifications
- ISO 27001
- SOC 2
Metabase, Inc.
Metabase is a business intelligence tool (EU hosting option chosen). More Onion uses Metabase to accesses data from Insights DB (stackhero) to visualise and analyse how supporters are interacting with the Impact Stack platform.
Some of the dashbaords created in Metabase may be embedded on the Impact Stack service. The data is pseudonymised and clients only have access to their own data via this service.
Services provided
- This service provides the UI for Insights DB.
Data held
- Pseudonymised form submissions: The application has access to the Insights DB connection. It can access all the data in this database.
Certifications
- SOC 2
more onion Ltd (UK)
Acting as sub-processors for all Impact Stack clients when the client directly contracts with more onion e-campaigning GmbH as their primary Processor.
Data held and accessed: application data, Personal Data of customer and end-users (supporters), including contact data.
Impact Hub, King’s Cross, 34B York Way, London, N1 9AB, UK.
more onion e-campaigning GmbH (Austria)
Acting as sub-processors for all Impact Stack clients when the client directly contracts with more onion Ltd as their primary Processor.
Data held and accessed: application data, Personal Data of customer and end-users (supporters), including contact data.
Lange Gasse 8/2, A-1080 Wien
Data sub-processors applicable to individual Impact Stack clients
Adobe Fonts (Typekit)
Does not apply to all Impact Stack clients.
Adobe fonts is a service designed to serve licensed fonts for the purpose of displaying them on a website. Currently Adobe fonts does not allow self-hosting of the fonts so using the built in CDN is mandatory.
If a client requests the usage of a font provided by Adobe typekit More Onion will embed the font on the Impact Stack landing pages of the client.
The user data processed in such a case is the user IP address and the time of access.
Services provided
- Hosting and licensing of fonts
Data held
- IP-addresses, date and origin of access for all page visitors.
Certifications
Uploadcare
Does not apply to all Impact Stack clients.
Uploadcare is a Content Delivery Network (CDN). More Onion uses Uploadcare for specific clients only, this service is currently not included for all Impact Stack clients.
Uploadcare is used to allow supporters to upload images as part of Impact Stack actions. Our intention is that the images uploaded only allow Uploadcare to process the user’s IP address and the time of the request. However, users may upload images with additional personal information to this service, such as an image of themselves with meta data revealing their name.
Since Uploadcare is a CDN the data is processed globally. Since this is the core function of a CDN, EU data is typically processed inside of the EU.
Services provided
- Image hosting and manipulation
Data held
- Images uploaded by editors and supporters
Certifications
- Infrastructure is outsourced (and their partners are ISO 27001 certified)
Data sub-processors applicable to individual agency clients of More Onion
Rhiannon Roberts
Content production and support, only applicable for specific projects which involve both agency work and Impact Stack. You will be notified if this applies to a project you have commissioned.
Data accessed: Personal Data of customer and end-users (supporters), including contact data.
Located in the UK.
Glyn Thomas
Consultancy and development work: only applicable for specific projects. You will be notified if this applies to a project you have commissioned.
Data accessed: Personal Data of customer and end-users (supporters), including contact data.
Located primarily in Germany.
Rebecca Turner
Content production and content performance review. Only applicable for specific projects, you will be notified if this applies to a project you have commissioned.
Data accessed: Personal Data of customer and end-users (supporters), including contact data.
Located in the UK
Shae Corvidae
Content production and advert set up in Meta advertising interface plus analysis of data in Impact Stack. Only applicable for specific projects, you will be notified if this applies to a project you have commissioned.
Data accessed: Personal Data of customer and end-users (supporters), including contact data.
Located in the UK