Data processing & sub-processors
Last updated: 2026
A note on scope: a traditional Data Processing Agreement is a contract between a data controller and a data processor acting on its behalf. CompareHQ's own sub-processors (below) fit that model, but providers receiving a buyer's enquiry don't: once a provider has your details to respond to your enquiry, they become an independent controller of that data, not a processor for CompareHQ. This page explains both relationships honestly rather than forcing a DPA structure onto one that isn't.
Our sub-processors
CompareHQ uses a small number of specialist providers to run the platform. Each processes personal data on our behalf, under their own standard data processing terms, which we've reviewed and rely on:
- Supabase, our database and authentication provider. Stores account data, listing data, and enquiry records.
- Resend, our transactional email provider. Sends enquiry notifications and account-related emails on our behalf; doesn't retain your data beyond what's needed to deliver those emails.
- Vercel, our hosting provider. Serves the website and runs our server-side code; doesn't have standing access to our database.
- Microsoft (Clarity) and Google (Analytics), our on-site analytics providers. Only run if you agree to analytics cookies in our cookie banner; record anonymised usage behaviour (page views, clicks, scrolling, mouse movement, traffic sources) to help us improve the site. See our Cookie policy for detail.
We don't use any other third party to process personal data on our behalf. If that changes, we'll update this page.
When you contact a provider
When you submit an enquiry, your details are sent directly to the provider you contacted so they can respond to you. At that point, the provider is handling your data in their own right, to provide their own service to you, they aren't processing it on CompareHQ's behalf, and CompareHQ isn't responsible for how they subsequently handle it. Check a provider's own privacy practices if you have concerns before enquiring.
International transfers
Where any of our sub-processors process data outside the UK, they do so under their own published safeguards, such as the UK International Data Transfer Agreement (IDTA) or the ICO's UK Addendum to the EU Standard Contractual Clauses. We haven't independently audited each safeguard beyond reviewing their public documentation.
Contact us
Questions about this page, or about a specific sub-processor? Get in touch.