Where we process data, and service providers
This page gives the full detail for section 7 of our Privacy Policy. It lists the small number of providers we rely on to run the service and the data each one receives. It is provided for transparency and is not legal advice.
We rely on a small number of providers to operate: our web host (Namecheap, Inc., which stores the site, its database and, on the same hosting account, the mailboxes and email software that send and receive our service email), the optional conference-verification providers described on the Conference verification page, and country and flag reference data loaded from a public source. Our web host necessarily has technical access to the data stored on its servers, including email content, as any host does; it processes that data on our instructions under its terms. We maintain a written inventory of these providers that records, for each one, its legal entity, country, the service it provides, the data categories involved, its role, its own sub-processors, the applicable data-processing agreement, the transfer mechanism and the deletion terms. That inventory is available on request from info@nordicdiplomacy.org. Where a provider necessarily processes data outside the EEA, we rely on an appropriate transfer safeguard recognised under the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses. We share data with providers only as needed to deliver the service, never for marketing, and we may disclose data where required by law or to protect someone's safety.
| Provider | What it does for us | Data it receives | Where |
|---|---|---|---|
| Namecheap, Inc. (web hosting, database and email on the same account) | Stores the website, its database and backups, and runs the mailboxes and mail server that send and receive our service email | All data stored server-side: account details, date of birth and country, guardian contact, applications, logs and backups, and the content of service emails | United States (Phoenix, Arizona). Because this is outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses. |
| Tavily Inc. | Performs the web-search step of the optional conference verification, only if you allow it | Only the conference name, its date and, if provided, a public link. No applicant personal data. | USA |
| Google LLC (Gemini API) | Evaluates the public search results in the optional conference verification | Only the conference name, date and public link, same as Tavily. No applicant personal data. | USA |
| Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | Serves the web fonts used for the site's appearance | Your IP address and basic browser information, as with any externally loaded font or file | Google servers |
| flagcdn.com | Supplies country flag images and country reference data for the country selectors | Your IP address and basic browser information when flag images are loaded. No account data. | Provider's CDN |
We keep a fuller written inventory of these providers (legal entity, role, data-processing agreement, transfer safeguard and deletion terms) that is available on request from info@nordicdiplomacy.org. Providers may change; this table is kept up to date.
Nordic Diplomacy Initiative. Guided by the North.