Compliance · Data protection
Subprocessors
This page lists the subprocessors Vermont Solutions S.L. uses to operate its public website. It supports enterprise due diligence prior to signing the Data Processing Agreement (DPA).
Service delivery: 100% in-house
Vermont Solutions delivers its consulting and engineering services with its own teams, without subcontracting. For client project data processed under a service agreement, Vermont does not rely on subprocessors except those expressly agreed in writing with the client. Where a client engagement runs on the client's own cloud or on infrastructure designated by the client, those providers act under the client's instructions, not Vermont's.
Website subprocessors
| Subprocessor | Purpose | Data | Location | Transfer mechanism (GDPR Ch. V) |
|---|---|---|---|---|
| Vercel Inc. | Website hosting and content delivery (CDN) | IP, technical logs and browsing data | EE. UU. / edge global | SCCs — Commission Implementing Decision (EU) 2021/914, Module 2 (GDPR Art. 46(2)(c)); the provider also declares EU-US DPF participation |
| Web3Forms (Web3Forms Inc.) | Processing of contact and assessment forms | Form data (name, email, message) | EE. UU. | SCCs — Commission Implementing Decision (EU) 2021/914, Module 2 (GDPR Art. 46(2)(c)) |
| Google Ireland Ltd. / Google LLC | Web analytics (GA4) and tag management (GTM) | Cookie identifiers and usage events (with consent) | UE / EE. UU. | SCCs — Commission Implementing Decision (EU) 2021/914, Module 2 (GDPR Art. 46(2)(c)); the provider also declares EU-US DPF participation |
| Microsoft Ireland Operations Ltd. / Microsoft Corp. | Behavioural analytics (Clarity) | Page interaction and heatmaps (with consent) | UE / EE. UU. | SCCs — Commission Implementing Decision (EU) 2021/914, Module 2 (GDPR Art. 46(2)(c)); the provider also declares EU-US DPF participation |
| LinkedIn Ireland Unlimited Co. / LinkedIn Corp. | Professional campaign measurement (LinkedIn Insight Tag) | Cookie identifiers and campaign events (marketing consent only) | UE / EE. UU. | SCCs — Commission Implementing Decision (EU) 2021/914, Module 2 (GDPR Art. 46(2)(c)) |
| IPinfo.io (IPinfo Inc.) | Organisation identification by IP (B2B firmographics) | Connection IP (transient, server-side, not stored by Vermont) | EE. UU. | Pending verification — the provider publishes neither SCCs nor EU-US DPF participation; the DPA must be requested from support@ipinfo.io. No Chapter V mechanism is on record until it is signed. |
SCCs = EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), the safeguard under GDPR Art. 46(2)(c). EU-US DPF = EU-US Data Privacy Framework, as declared by the provider. Rows marked “pending verification” have no Chapter V mechanism on record yet: we state that instead of claiming a safeguard that has not been signed. Analytics and marketing subprocessors only process data after consent is granted in the cookie banner.
DPA and notice of changes
The Data Processing Agreement (GDPR Art. 28) governs the processing relationship and incorporates this subprocessor list. Download it from the Trust Center.
To be notified of changes to this list before they take effect, write to .
Last updated: 2026-09-10. This list reflects subprocessors of the public website; it is not legal advice.