Prism and third-party data processors
Learn more about the external companies we work with in order to deliver our statistical support services to clients.
We use a number of external, third-party companies to provide us with the project management tools, office infrastructure software and data storage required to successfully deliver our statistical support services. In certain cases, it may be necessary to process client's personal data with these third-party companies.
These companies - and their related Privacy Policies which we adhere to - are as follows:
Microsoft Office 365 - click here for their privacy policy.
Google Drive - click here for their privacy policy.
Basecamp - click here for their privacy policy.
Trello - click here for their privacy policy.
Campaign Monitor - click here for their privacy policy.
Box.net - click here for their privacy policy.
Stat-Ease, Inc. - click here for their privacy policy.
Formagrid Inc ("Airtable") - click here for their privacy policy.
Umbraco A/S - click here for their privacy policies.
The third-party service providers we use process or store personal data in countries both within and outside the European Economic Area (EEA) and the United Kingdom. Where personal data is transferred outside the EEA or the UK, we ensure that an appropriate legal transfer mechanism and safeguards are in place in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Act 2018 and UK GDPR. The table below sets out the relevant third-party providers, the countries to which data may be transferred, and the safeguards we rely on for those transfers.
Description of processing | Recipient | Destination to which data is transferred | Safeguards |
|---|---|---|---|
Storage of data using a third-party platform | 37Signals LLC (Basecamp) | USA | We have a Data Processing Addendum (DPA) in place with 37signals which incorporates the European Commission's Standard Contractual Clauses (SCCs), together with the UK International Data Transfer Addendum where applicable. 37signals' current DPA provides for these safeguards for transfers of personal data from the EEA and the UK to countries that do not provide an adequate level of data protection. Details here. |
Storage of data using a third-party platform | Microsoft Corporation | USA | Microsoft is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. Microsoft also provides Standard Contractual Clauses and other appropriate safeguards for international transfers. |
Storage of data using a third-party platform | Trello, Inc. | USA | Atlassian, including Trello, Inc., complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. Atlassian's DPA also incorporates the European Commission's Standard Contractual Clauses where applicable. |
Storage of data using a third-party platform | Campaign Monitor Pty Limited | USA | Campaign Monitor Pty Limited have implemented the European Commission's Standard Contractual Clauses for transfers of personal information between their group companies and have implemented similar safeguards with their third party service providers and partners. Prism has entered into a Data Protection Addendum (EU Standard Contractual Clauses) with Campaign Monitor Pty Limited. |
Storage of data using a third-party platform | Box, Inc. | USA | Box provides multiple transfer mechanisms, including Standard Contractual Clauses, EU and UK Binding Corporate Rules and the EU-U.S. Data Privacy Framework and its relevant extensions. Box states that it complies with the EU-U.S. Data Privacy Framework for personal data processed on behalf of organisations using business accounts. |
Storage of data using a third-party platform | Google LLC | USA | Google complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. Google also relies on Standard Contractual Clauses for transfers where required and where an adequacy decision does not apply. |
Sharing and storage of data to allow management & delivery of statistical software | Stat-Ease, Inc. | USA | Prism and Stat-Ease have entered into a Distribution Agreement containing a GDPR Addendum to ensure compliance relevant data protection law requirements. |
Storage of data using a third-party platform | Formagrid Inc. | USA | We have a Data Processing Addendum in place with Formagrid, Inc (doing business as Airtable) which incorporates the EU Standard Contractual Clauses and UK Standard Contractual Clauses as appropriate safeguards for international transfers. |
Storage of data using a third-party platform | Umbraco A/S | UK | Umbraco uses Data Protection Agreements incorporating Standard Contractual Clauses and, where applicable, the Data Privacy Framework. Its current supplier information identifies hosting locations including the EU, UK and USA and confirms that SCCs and the Data Privacy Framework are used as transfer mechanisms where applicable. Details here. |