In short. We use the companies below to host and run Rekro. Each one processes personal data only to provide its service to us, under a contract that requires it to protect that data. We tell our customers before we add or replace one.
1. About this list
When a recruitment agency uses Rekro, VirtuPay Limited processes personal data on the agency’s behalf. A “sub-processor” is another company that we engage to carry out part of that processing. This list forms part of our Data Processing Addendum, and our Privacy Policy refers to it.
2. Current sub-processors
| Provider | What it does for Rekro | Personal data involved | Where it is processed |
|---|---|---|---|
| Supabase Supabase Pte. Ltd., Singapore | The database, the storage of documents, and the signals that keep open screens up to date | All the information held in a workspace, including documents | United Kingdom (London) |
| Railway Railway Corporation, United States | Runs the application’s back end and the service that reads CVs | Information passing through the application while it is being processed | Netherlands (Amsterdam) |
| Vercel Vercel Inc., United States | Delivers the website and the web application, and provides page-visit and loading-time statistics | Information shown on a page while it is being prepared and delivered; the address and technical details of page visits | United States |
| Clerk Clerk, Inc., United States | Sign-in and account security | Names, email addresses, passwords in a protected form, passkeys, profile pictures and sign-in records | United States |
| Resend Plus Five Five, Inc. (trading as Resend), United States | Sends the emails the service generates | Recipients’ email addresses and the content of the emails, including any invoice attached | Sent from Ireland; records of what was sent are stored in the United States |
| Sentry Functional Software, Inc. (trading as Sentry), United States | Error monitoring | Technical error reports, with the internal identifiers of the account and workspace involved | Germany (Frankfurt) |
| Anthropic Anthropic Ireland, Limited, Ireland | The AI language model behind the assistant and the reading of CVs | Conversations with the assistant and the record content used to answer them; CVs submitted to be read | United States and other countries in which the provider runs its models |
| Google Google LLC, United States (Firebase Cloud Messaging) | Delivers notifications to the mobile app | An identifier for the app installation, basic device details and the text of the notification | United States and other countries in which Google operates |
| Expo 650 Industries, Inc. (trading as Expo), United States | Delivers updates to the mobile app | The phone’s operating system and a random token for the app installation | United States |
Where a provider processes personal data outside the United Kingdom in a country that is not covered by UK adequacy regulations, the transfer is made under the safeguards described in section 8 of the Data Processing Addendum.
3. Other services information can pass to
These are not our sub-processors, but we list them so that the picture is complete.
- Public registers. If an agency uses the company or VAT number checks, the number being checked is sent to Companies House, HM Revenue and Customs or the European Commission’s VAT Information Exchange System to look it up.
- Apple. A notification to an iPhone is passed by Google to Apple’s push notification service for delivery.
- Google sign-in. A member of an agency’s team who chooses to sign in with a Google account is authenticated by Google.
- Google Analytics. On our public website only, and only for visitors who have agreed to it, measurements of how the site is used are processed by Google. This concerns visitors to our website, never the records an agency holds, and it is not used inside the application.
- Services an agency connects. An agency can configure its workspace to send information to a web address of its choosing, or authorise an AI tool of its own to read its workspace. Those recipients are chosen by the agency, act for the agency, and are not engaged by us.
4. Changes to this list
We will give at least 30 days’ notice before a new or replacement sub-processor starts to process personal data, by updating this page and emailing the owners of each customer’s workspace. A customer that has a reasonable data protection concern about a change can object within that period by writing to privacy@virtupay.co.uk, and section 7 of the Data Processing Addendum sets out what happens next.