Sub-processors
Last updated: 26 July 2026
We deliberately keep the number of companies that touch school data small. This page lists every provider involved in running ExamDisplay, what each one does, and where it processes data. It forms Annex III of our Data Processing Agreement.
Sub-processors of school data
These providers may process personal data that schools upload to ExamDisplay (candidate and staff data), always under a data processing agreement with us:
| Provider | Service | Data involved | Processing location |
|---|---|---|---|
| Supabase | Application database, authentication, file storage, and APIs | Shared school workspace and staff account data; candidate data only after assisted hosted-data setup | European Union (Ireland) |
| Cloudflare | Web hosting, content delivery, media hosting, and bot protection (Turnstile) | Encrypted application traffic; IP addresses in security logs | Global network; EU/UK traffic served regionally |
Note: candidate data stays on-device by default and never reaches our servers, so no sub-processor processes it. Candidate data is included only for schools that complete the assisted hosted-data setup. On the Display plan, no candidate data is collected at all.
Other service providers
These providers support the business but never handle candidate data:
| Provider | Service | Data involved | Processing location |
|---|---|---|---|
| Paddle | Payment processing and subscription billing, as merchant of record | Billing contact and payment details, processed under Paddle’s own policies; never candidate data | United Kingdom / European Union |
| Resend | Transactional email delivery: account emails and public enquiry forms | Name, email address, and message content of an enquiry, or the recipient address of an account email; never candidate data | United States (standard contractual clauses) |
| YouTube (Google) | Embedded help and tutorial videos | Standard YouTube embed data if and when a video is played; never candidate data | Global (Google infrastructure) |
Changes to this list
We update this page at least 30 days before adding or replacing a sub-processor that processes school data, as set out in section 6 of the Data Processing Agreement. To receive change notifications by email, write to contact@lompla.com with the subject “Sub-processor notifications”.
Legal