Legal
Data processors
These are the organisations that process personal data on our behalf. The list is generated from the register we maintain, so it is always current. We do not republish our processors' own sub-processor lists, because they change outside our control; we link to the authoritative source instead.
We give at least 30 days' notice before adding or replacing a processor that handles member data, by updating this page and emailing members who opt in to processor notices.
Cloudflare
- What it does
- CDN, DNS, security, Turnstile bot protection and cookieless analytics
- Personal data
- IP addresses and all traffic passing through to the site, including form submissions
- Role
- Processor
- Where
- Global network; see the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Data processing terms for Cloudflare · Sub-processors of Cloudflare
GoDaddy
- What it does
- Website hosting, form handling, storage of submitted manuscripts, domain registration
- Personal data
- Form submissions, uploaded manuscripts, server logs including IP addresses
- Role
- Processor
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
GitHub
- What it does
- Source code and published content
- Personal data
- Author names and biographies already published on the site
- Role
- Processor
- Where
- United States
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Data processing terms for GitHub · Sub-processors of GitHub
Email provider
- What it does
- The contact@iioet.org mailbox and IIoET's internal email
- Personal data
- Anything sent to contact@iioet.org or by web forms
- Role
- Processor
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Membership platform
- What it does
- Accounts, grades, renewals, CPD log, member area
- Personal data
- Member profile, membership and CPD records
- Role
- Processor
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Stripe
- What it does
- Card payments, invoices, receipts
- Personal data
- Name, email, billing address, payment details
- Role
- Processor, and an independent controller for its own fraud and regulatory duties
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Data processing terms for Stripe · Sub-processors of Stripe
GoCardless
- What it does
- Direct Debit and bank debit collection
- Personal data
- Name, email, bank account details
- Role
- Processor, and an independent controller for its own regulatory duties
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Credly
- What it does
- Digital badges for individual members
- Personal data
- Name, email, grade, badge status
- Role
- Processor for issuing; independent controller for the member's own Credly account
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Events and webinar platform
- What it does
- Event registration and recordings
- Personal data
- Name, email, attendance
- Role
- Processor
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Accounting system
- What it does
- Invoicing and bookkeeping
- Personal data
- Billing contact details
- Role
- Processor
- Where
- As set out in the data processing terms
- Transfer safeguard
- As set out in the data processing terms
- Terms
- Available on request · Available on request
Change log
- 8 October 2026: Entries completed; providers not yet selected are listed by function and will be named before they process any personal data.
- 7 October 2026: Register published with the processors in place or planned at launch.