The third-party providers we use to deliver the Andromeda platform, and what each one handles on our behalf.
When you use the Andromeda platform, we act as a data processor on your behalf under Article 28 of the UK GDPR. To deliver the service we engage a limited number of third parties — our "sub-processors" — who process personal data under our instructions, bound by written contracts that mirror the obligations in our Master Services Agreement (Schedule 4 — Data Processing Agreement).
This page lists every sub-processor that may handle personal data you entrust to us. We keep it up to date and will notify you by email at least 30 days before adding, changing or replacing a sub-processor, so that you can object or end the agreement if you reasonably object on data-protection grounds.
These sub-processors are used for every Andromeda customer.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Azure azure.microsoft.com |
Cloud hosting, databases, storage, backups, application insights for the Andromeda Portal, AndroWeb ordering website, kiosk, mobile apps and related services. | All customer and diner data processed by the platform — 订单, 菜单s, customer records, loyalty data, payment card tokens, employee records. | United Kingdom (UK South / UK West regions). | Data stored at rest in the UK. No international transfer required for standard processing. |
| Cloudflare, Inc. cloudflare.com |
DNS, CDN, DDoS protection and edge compute (Workers) for the Andromeda marketing site and branded customer ordering domains. | IP address, user-agent, request metadata, limited diner data in transit through the CDN. | United Kingdom, European Union and United States (global edge network). | UK International Data Transfer Agreement ("IDTA") / UK Addendum to the EU Standard Contractual Clauses. |
| Stripe 支付 UK, Ltd. stripe.com |
Card processing (in-store, kiosk, online), Stripe Terminal for card-present 支付, Stripe Connect for settlement, Stripe Billing for Andromeda 订阅 自提, Pay by Link for 设置 fees. | Payment card token, amount, currency, billing name, billing email and address, transaction metadata. We do not store raw PAN or CVV data. | United Kingdom and Republic of Ireland (Stripe's EEA operations). | UK IDTA where transfer to Stripe's US parent is in scope. |
| GoCardless Ltd gocardless.com |
Bacs Direct Debit 自提 for 每月 Andromeda 订阅 fees (where you choose direct debit on your Order Form). | Customer business name, contact name, email address, UK bank account details, mandate reference. | United Kingdom. | No international transfer — data held in the UK. |
| Twilio Inc. twilio.com |
SMS carrier for transactional order messages, marketing SMS campaigns (where enabled), and two-factor authentication. | Diner mobile number, message content, timestamp, 外送 status. | United Kingdom / European Union routing with US control plane. | UK IDTA / UK Addendum to EU Standard Contractual Clauses. |
| 发送Grid (Twilio) sendgrid.com |
Transactional and marketing email 外送 — order confirmations, receipts, password resets, newsletter campaigns (where enabled). | Diner name, email address, email content, open/click metadata. | United States. | UK IDTA / UK Addendum to EU Standard Contractual Clauses. |
| Freshworks Inc. (Freshdesk / Freshcaller) freshworks.com |
Helpdesk ticketing and inbound phone support for Andromeda Customer Success. | Customer contact name, email, phone number, ticket content, call recordings (where consented). | European Union. | UK IDTA where US control-plane access occurs. |
| Google Ireland Ltd (Maps Platform) mapsplatform.google.com |
地址 auto-complete, geocoding and 外送-zone mapping on the ordering website and Portal. | Diner 外送 address, IP address (for initial look-up). | European Union with US control plane. | UK IDTA / UK Addendum to EU Standard Contractual Clauses. |
These sub-processors only process data if you choose to enable the relevant feature in your Andromeda tenant. If the feature is off, no data flows to them.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Uber Direct (Uber B.V.) uber.com/gb/en/deliver/uber-direct |
On-demand courier booking where you don't have in-house 骑手 (or need overflow capacity). | Diner name, phone number, 外送 address, order reference, basket summary. | Netherlands (EEA) with US control plane. | UK IDTA / UK Addendum to EU Standard Contractual Clauses. |
| Uber Eats uber.com/gb/en/餐厅 |
Aggregator order ingestion and 菜单 sync where you enable the Uber Eats channel. | Diner name, 外送 address, order items, special instructions. | Netherlands (EEA) with US control plane. | UK IDTA / UK Addendum to EU Standard Contractual Clauses. |
| Deliveroo 餐厅.deliveroo.com |
Aggregator order ingestion and 菜单 sync where you enable the Deliveroo channel. | Diner name, 外送 address, order items, special instructions. | United Kingdom. | No international transfer required for UK operations. |
| Just Eat 餐厅.just-eat.co.uk |
Aggregator order ingestion and 菜单 sync where you enable the Just Eat channel. | Diner name, 外送 address, order items, special instructions. | United Kingdom and Netherlands (EEA). | UK IDTA where transfer outside the UK is in scope. |
| Deliverect deliverect.com |
Middleware order and 菜单 routing — used by specific enterprise 客户 (e.g. Papa Johns franchisees) where the customer's commercial arrangement requires Deliverect as the aggregator broker. | Diner name, 外送 address, order items, special instructions, 菜单 content. | Belgium (EEA). | No international transfer outside the EEA for standard processing. |
| Bolt Food food.bolt.eu |
Aggregator order ingestion and 菜单 sync where you enable the Bolt Food channel (selected international markets). | Diner name, 外送 address, order items, special instructions. | Estonia (EEA). | No international transfer outside the EEA for standard processing. |
| Wolt (DoorDash) wolt.com |
Aggregator order ingestion and 菜单 sync where you enable the Wolt channel (selected international markets). | Diner name, 外送 address, order items, special instructions. | Finland (EEA) with US control plane. | UK IDTA / EU Standard Contractual Clauses. |
| Stuart 外送 Ltd stuart.com |
On-demand courier booking where you choose Stuart as your courier provider. | Diner name, phone number, 外送 address, order reference. | United Kingdom / France (EEA). | No international transfer outside the UK/EEA for standard processing. |
Where you use a card-processing provider other than Stripe, that provider becomes an additional sub-processor. We currently support:
The data processed is limited to payment card tokens and transaction metadata — we do not store raw PAN or CVV data in any case.
The following providers support Andromeda's internal operations and do not routinely process diner personal data, but may hold Andromeda customer (business) contact details:
Before we add a new sub-processor or replace an existing one, we will:
Changes to country of operation for an existing sub-processor are treated as a change and notified on the same terms.
Where personal data is transferred outside the United Kingdom, we rely on one of the following lawful mechanisms:
You retain all your rights as a data controller. You can request:
Requests should go to privacy@androtech.com. See the Master Services Agreement Schedule 4 for the full DPA wording.
Andromeda UK Services Ltd
Victory House, Business Park
400 Pavilion Drive
Northampton NN4 7PA
privacy@androtech.com