Subprocessors
Version 1.4 · Last updated: 23 October 2026
MadyHR is operated by MAKZEE LTD. To provide the service we use a small number of suppliers who process personal data on our behalf. This page lists all of them.
Each supplier is engaged under a written data processing agreement that imposes obligations no less protective than those in our own Data Processing Agreement. We remain fully responsible to our customers for their performance.
Current subprocessors
| Supplier | What they do for us | Data they may process | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Railway Corporation | Application hosting, database, cache, backups | All customer and employee data held in MadyHR | European Union (Amsterdam, Netherlands) | Not required — UK adequacy covers the EEA |
| Anthropic PBC | AI features: Ask Mady assistant, document and letter drafting, compliance reminder wording, the chat on madyhr.ai | Employee data included in a user's question or document, excluding National Insurance numbers and bank details | United States | See note below |
| Cloudflare, Inc. | DNS, TLS termination, content delivery, protection against attacks | IP addresses and request metadata for traffic to madyhr.ai | Global edge network | Standard Contractual Clauses with UK Addendum |
| Cloudflare, Inc. (R2 storage) | Storage of the files uploaded to or created in MadyHR, such as employee documents, Right to Work evidence, payslips, signed policies, candidates' CVs and company logos | The content of those files, which may include identity documents and other employee or candidate personal data | European Union (storage restricted to the EU jurisdiction) | Not required for storage — UK adequacy covers the EEA; Standard Contractual Clauses with UK Addendum for any access from outside the EEA |
| Resend, Inc. | Sending transactional and service emails | Recipient name and email address, message content, delivery logs | Email dispatched from Ireland (eu-west-1); account data, email metadata, logs and API records stored in the United States | Standard Contractual Clauses with UK Addendum |
| Microsoft Corporation | Microsoft 365 email for our support mailbox | Anything a customer includes in an email to support@madyhr.ai | European Union | Standard Contractual Clauses where applicable |
Note on Anthropic
Anthropic provides the AI features in MadyHR under Anthropic's Commercial Terms of Service and a data processing agreement. Under those terms Anthropic does not train its models on customer content submitted through the API, and API inputs and outputs are deleted from Anthropic's systems within 30 days by default.
Anthropic processes data in the United States. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses for this transfer.
Note on Cloudflare R2
Files uploaded to MadyHR are kept separately from the database, in Cloudflare's R2 storage, in a bucket restricted to the European Union jurisdiction, so the files themselves stay in the EU. The storage is not publicly accessible: files are reached only through MadyHR, which opens a file only for someone allowed to see it.
Note on Resend
Resend routes MadyHR's outgoing email through its Ireland region. Resend's own documentation states that selecting a sending region controls where mail is dispatched from, not where data is stored, and that account data, email metadata, logs and API records are held in the United States regardless of sending region. We therefore treat Resend as a transfer to the United States and rely on the UK International Data Transfer Addendum.
The personal data involved is limited: recipient name, email address, the content of service and notification emails, and delivery logs. Employee records held in MadyHR are not sent to Resend.
Not a subprocessor: Stripe
Stripe Payments Europe Ltd handles card payments for MadyHR subscriptions. Stripe acts as an independent data controller for payment data, not as our subprocessor. Your payment information is governed by Stripe's privacy policy. We never receive or store full card numbers.
Not a subprocessor: Meta
Meta Platforms Ireland Limited provides the Meta Pixel, which measures our advertising on Facebook and Instagram, and only for visitors who accept marketing cookies. Meta acts as a separate controller for that information, not as our subprocessor, and it never receives employee or candidate data. With the same consent, when an account holder signs up or pays, our server tells Meta with their email address in hashed form; our Privacy Policy explains exactly what that contains. See also our Cookie Policy.
Not a subprocessor: Google (advertising)
Google Ireland Limited provides the Google Ads tag, which measures our advertising on Google Search, and only for visitors who accept marketing cookies. Google acts as a separate controller for that information, not as our subprocessor, and it never receives customer, employee or candidate data. See our Cookie Policy.
Not a subprocessor: Reddit
Reddit provides the Reddit Pixel, which measures our advertising on Reddit, and only for visitors who accept marketing cookies. Like Meta, Reddit acts as a separate controller for that information, not as our subprocessor, and it never receives customer, employee or candidate data. See our Cookie Policy.
Changes to this list
Before we add a new subprocessor or replace an existing one, we will update this page and notify subscribers at least 30 days in advance.
To be notified, email support@madyhr.ai with the subject line "Subprocessor notifications".
If you object to a new subprocessor on reasonable data protection grounds, tell us within the notice period. If we cannot find an alternative, you may terminate and receive a pro-rata refund for the unused part of your subscription.
Contact
MAKZEE LTD, 383 High Street, Cowdenbeath, KY4 9QW, United Kingdom
support@madyhr.ai · ICO registration ZC248854