CookieYes
Consent management · cookieyes.com · last read 2026-11-09
At a glance
- Is CookieYes GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what CookieYes itself publishes, each answer linked to its source and the date we read it.
- Does CookieYes have a data processing agreement (DPA)?
- Yes. CookieYes publishes a data processing agreement at cookieyes.com. It gives 30 days' notice before a new subprocessor is added. It commits to telling you of a personal data breach within 72 hours. Source and date
- How does CookieYes transfer personal data out of the EU?
- CookieYes's agreement relies on the EU standard contractual clauses and the UK transfer addendum. Source and date
- Who are CookieYes's subprocessors?
- CookieYes lists 21 third-party subprocessors; 13 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
- How do you report a security vulnerability to CookieYes?
- CookieYes publishes a security.txt at www.cookieyes.com naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | CookieYes Limited |
|---|---|
| HQ | GB |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | cookieyes.com · 2026-11-09 |
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
CookieYes's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
21 third parties · 13 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | IE | Cloud Service provider and Data Storage |
| Brevo | US | Email delivery and marketing services |
| Calendly | US | Appointment scheduling services |
| Clickhouse | IE | Pageview calculations, billing |
| Cloudflare Inc. | US | DNS services, Captcha Service, CDN provider |
| Cloudways Ltd. | MT | Cloud Service provider and Data Storage |
| Digital Ocean | GB | Core data storage |
| Fivetran Inc. | US | Managed data pipeline / data ingestion (moving anonymised data from sources into Snowflake) |
| G Joseph & Associates | IN | Accounts and tax |
| Google Analytics | IE | Web and application analytics |
| Gsuite (Google Workspace) | US | Business productivity tools |
| Hotjar | IE | Customer support chat services |
| Intercom | US | Customer Support |
| Lemlist | FR | Email delivery and marketing services |
| Microsoft Clarity | US | Behavioural analytics |
| Mixpanel | NL | Email marketing and automation |
| Mozilor Technologies Pvt Ltd | IN | Customer Support |
| Oakleaf Analytics Ltd | GB | Data analytics and advisory services |
| Sendgrid | US | Email delivery services |
| Zendesk Inc. | DE | Website user behavior analytics |
| Zoom | US | Video conferencing services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-11-09 · cookieyes.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | 30 days (Clause 9(a) general authorisation, Modules 2 and 3 under the UK Addendum); method not stated |
| Notice of new subprocessors | 30 days prior notice, by email, of changes to the List of Sub-Processors |
| Notice of new subprocessors | 30 days prior notification, via email, of changes to the List of Sub-Processors |
| If you object to one | Object in writing within 10 Business Days of notice; if it objects, the customer may terminate the affected Services and receive a refund of prepaid fees |
| Breach notification | without undue delay, and in any event within 72 hours of discovery |
| Audit | Copy of most recent third-party certification/attestation reports (ISO 27001, SOC) on written request, no more than once per 12 months; treated as Confidential Information |
| Audit | Review of the latest independent auditor reports/certificates; if the Controller reasonably finds these insufficient, a more extensive audit at the Controller's expense, limited in scope and agreed in advance, during business hours, on at least 4 weeks' notice (unless an identifiable material issue has arisen), and without interfering with the Processor's business |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under CookieYes; CookieYes Limited
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-05-09; read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.