Last updated September 2026
At Virtuoso QA, we use sub-processors to assist us in providing our services, and we ensure that they meet our high standards of privacy and security.
We conduct appropriate due diligence on all Sub-processors and service providers and implement contractual, technical, and organisational safeguards to ensure personal data is protected in accordance with applicable data protection laws.
Virtuoso QA relies on a combination of infrastructure and services from third-party vendors to offer its products and services to our customers. Below is an up-to-date list of the names and purposes of Virtuoso QA's sub-processors and third-party vendors:
Infrastructure & Services Sub-processors:
We engage the following sub-processors to process Customer Data on behalf of our customers in connection with the provision of our services. Each sub-processor is contractually bound to process personal data only in accordance with our instructions and applicable data protection laws. By entering into an agreement with us or using our services, you agree all of these sub-processors may have access to your Customer Data.
| Vendor | Purpose | Data Centre Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services | Cloud infrastructure and hosting | EEA (Ireland), US or UK (dependent on region selected by customer) | EEA - Adequacy Decision |
| US - Adequacy Decision: UK extension to the EU-US Data Privacy Framework (DPF) | |||
| Algolia | Search and discovery services within the platform | United States and EEA (France) (dependent on region selected by customer) | EEA - Adequacy Decision |
| US - Adequacy Decision: UK extension to the EU-US Data Privacy Framework (DPF) | |||
| Cloudflare | Content delivery, security, and traffic management | EEA (Ireland) | Adequacy Decision |
| Datadog Inc. | Monitoring, logging, and performance analytics | EEA (Germany) | Adequacy Decision |
| Functional Software, Inc. (Sentry) | Error monitoring and debugging | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| Segment | Customer data routing and event tracking | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| Optimizely | Product experimentation and feature optimisation | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| UserPilot | In-app user onboarding and product experience | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| BrowserStack Limited | Testing services (where customer data is used in testing environments) | EEA (Ireland) | Adequacy Decision |
| OpenAI | AI assistance and API services | United States | SCCs |
| Google VertexAI | AI assistance and API services | EEA, US, UK (dependent on region selected by customer) | EEA: Adequacy Decision |
| US: Adequacy Decision UK extension to the EU-US Data Privacy Framework |
We may engage affiliated companies within our corporate group to provide services such as customer support, engineering, and operations.
| Entity | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| SpotQA Portugal, Unipessoal LDA | Support and service delivery | Portugal | EEA: Adequacy Decision |
| SpotQA India Private Limited | Support and service delivery | India | SCCs |
All affiliated companies are subject to the same contractual and data protection obligations as third-party sub-processors.
We also use third-party service providers in our capacity as a data controller for our own business operations (for example, providing support, managing customer relationships, marketing, recruitment, and internal communications) as set out in our Privacy Policy. These providers do not act as sub-processors on behalf of our customers.
| Vendor | Purpose | Data Centre Location | Transfer Mechanism |
|---|---|---|---|
| Google Workspace | Email, document management, and internal collaboration | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| HubSpot | CRM, sales, and marketing platform | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| Zendesk | Customer support and ticketing | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| Google Analytics | Website analytics and performance tracking | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
| Google Tag Manager | Website tag and script management | United States | Adequacy Decision: UK extension to the EU-US Data Privacy Framework |
Virtuoso QA will provide at least thirty (30) days’ notice of any addition of a new sub-processor to this list, or of the replacement of an existing sub-processor with another, where used to process Personal Data in delivering the Virtuoso platform. Virtuoso QA undertakes to keep this list updated regularly so you can stay informed of the scope of sub-processing associated with the Virtuoso platform.
Pursuant to Virtuoso QA’s Data Processing Agreement, a customer may object in writing (to [email protected]) to the processing of its Personal Data by a new sub-processor within ten (10) business days following notification by Virtuos QA of an update to this page, and such objection shall describe customer's legitimate reason(s) for objection. If customers do not object during such time period the new sub-processor(s) shall be deemed accepted.
For questions or objections regarding sub-processors, please contact us at [email protected]
For more information, visit our Trust Centre at https://trust.spotqa.com/