Subprocessors

1. Introduction

Uprooting Limited ("Uprooting", "we", "us") uses carefully selected third-party service providers ("subprocessors") to help us deliver our services. Some of these providers process limited personal data on our behalf, for example to send transactional emails, host our infrastructure, or provide analytics and monitoring.

This page lists our current subprocessors, the role they play, and the types of data they may process. It is intended to support estate agents and other customers in understanding how Uprooting fulfils its obligations under data protection laws and our Data Processing Agreement (DPA).

2. How we use subprocessors

We only engage subprocessors where it is necessary to operate the Uprooting platform securely and reliably. Each subprocessor is bound by a written agreement that requires them to:

• process data only on our documented instructions;
• implement appropriate technical and organisational measures;
• protect the confidentiality and integrity of any personal data;
• assist us in meeting our obligations under applicable data protection laws.

Depending on how our services are configured and used by each customer, these subprocessors may process limited personal data such as user names and email addresses, seller details (where an agent enables Uprooting to send seller-verification emails), and technical metadata related to site usage.

3. Email delivery subprocessors

We use a specialist email provider to send transactional emails, such as login codes, account notifications, and, where enabled by an estate agent, seller-verification emails.

• Postmark (Wildbit LLC / ActiveCampaign, LLC)
  Role: Transactional email delivery.
  Location: United States (with region-specific infrastructure where available).
  Data processed: Sender name and email, recipient name and email, email content and metadata (e.g. timestamps, delivery status, IP and user agent information included in email headers).
  Purpose: To send transactional messages such as seller-verification emails, login codes and other service-related notifications.

4. Hosting and infrastructure subprocessors

These providers host our application, database and networking infrastructure, and help us deliver Uprooting in a fast and secure way.

• Cloudflare, Inc.
  Role: DNS, CDN, edge compute, security and tag management (including Cloudflare Zaraz).
  Location: Global network (head office in the United States).
  Data processed: IP addresses, HTTP request metadata, security and performance logs, analytics and event data routed via Zaraz.
  Purpose: To provide DNS, content delivery, network security (including DDoS protection), edge compute and tag management for analytics scripts.
• Neon
  Role: Managed Postgres database hosting.
  Location: European Union (region-specific hosting).
  Data processed: Application data stored by Uprooting, which may include estate agent user details, account data and listing metadata.
  Purpose: To provide reliable, secure database infrastructure for the Uprooting application.

5. Analytics and monitoring subprocessors

We use analytics and monitoring tools to understand how the platform is used, improve performance and usability, and detect and diagnose issues. These tools are configured to avoid collecting more personal data than necessary.

• Google Analytics
  Role: Web and product analytics.
  Location: Global (data centres may vary by configuration).
  Data processed: Pseudonymous identifiers, device and browser information, approximate location, page views, events and usage patterns.
  Purpose: To analyse how users interact with Uprooting so we can improve performance, reliability and features.
• Smartlook
  Role: Session replay and UX analytics.
  Location: Typically European Union (subject to provider configuration).
  Data processed: Session recordings, page views, clicks and other interaction data, along with IP addresses and device information. We configure Smartlook to avoid capturing sensitive fields wherever possible.
  Purpose: To help us understand user behaviour, diagnose issues and improve the usability of Uprooting.
• Cloudflare Zaraz
  Role: Tag management and server-side analytics routing.
  Location: Global.
  Data processed: Page view and event metadata, request information and pseudonymous identifiers used for analytics.
  Purpose: To efficiently load, route and manage analytics scripts and events while improving performance and privacy.

6. Updates to this list

We may add, remove or replace subprocessors from time to time as our infrastructure and services evolve. When we make a material change to our subprocessors that affects personal data processing covered by our DPA, we will update this page and, where required, notify affected customers in advance.

Customers who rely on this list for their own records (for example, to keep their internal documentation up to date) should check this page periodically.

7. Questions and contact

If you have any questions about our use of subprocessors, or you need additional information for your own data protection documentation, please contact us at privacy@uprooting.co.uk.