Effective September 29, 2026
This page lists every third party that processes Personal Data on behalf of Devence Lab in connection with devencelab.com. We publish it so that you can see precisely who receives your data, what they receive, why, and where it is processed.
Each provider listed here acts on our documented instructions under a written contract meeting the requirements of Article 28 GDPR. We assess each provider before engaging it and review the list when we add, remove, or change a service.
1. Providers
Hosting and content delivery
| Provider | Our hosting provider |
| Service | Virtual private server hosting; serves every page, asset, and file on the Site |
| Personal Data processed | IP address, date and time of request, resource requested, HTTP status, referring URL, user-agent string; and the content of any form submission in transit |
| Purpose | Delivering the Site to your browser; fault diagnosis; abuse detection |
| Processing location | Outside the European Economic Area |
| Transfer mechanism | Standard Contractual Clauses |
| Retention | Access and error logs rotate after 10 days; compressed archives deleted within 12 months |
Form submission and storage
| Provider | Fillout, Inc. |
| Service | Receives and stores submissions from our contact form, waitlist, home-page email capture, and brochure request |
| Personal Data processed | First name, last name, email address, organisation, company website, industry, and the message you write |
| Purpose | Recording and managing enquiries so that we can respond to them |
| Processing location | United States |
| Transfer mechanism | Standard Contractual Clauses |
| Retention | 24 months from the last substantive contact |
| Notes | Our server holds the API credential; it is never transmitted to your browser. Submissions reach Fillout through our server, not directly from your device. |
Transactional email — job applications
| Provider | Resend, Inc. |
| Service | Delivers job applications, with the attached curriculum vitae, to our recruitment mailbox |
| Personal Data processed | First name, last name, email address, current role, the statements you write, and the contents of your curriculum vitae |
| Purpose | Transmitting an application to the people who assess it |
| Processing location | United States |
| Transfer mechanism | Standard Contractual Clauses |
| Retention | Message metadata retained by the provider per its own policy; application content is retained by us per Section 11 of our Privacy Policy |
Recruitment mailbox
| Provider | Google LLC |
| Service | Business email, including the mailbox that receives job applications |
| Personal Data processed | The full contents of an application, including the curriculum vitae attachment |
| Purpose | Receipt, review, and assessment of applications |
| Processing location | United States and global Google infrastructure |
| Transfer mechanism | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Retention | Unsuccessful applications deleted 6 months after the conclusion of the process, or 24 months where you have consented to us keeping your details on file |
Analytics
| Provider | Google Ireland Limited / Google LLC (Google Analytics 4) |
| Service | Measures page views and which articles are read |
| Personal Data processed | IP address, pseudonymous cookie identifier, pages viewed, approximate location derived from IP, device and browser metadata |
| Purpose | Understanding which published research is read |
| Processing location | European Union and United States |
| Transfer mechanism | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Retention | 14 months — the shortest period the product permits |
| Consent | Loaded only after you consent. Google Signals, advertising features, and remarketing are disabled. |
Typography
| Provider | Google Ireland Limited / Google LLC (Google Fonts) |
| Service | Serves the typefaces the Site uses |
| Personal Data processed | IP address and standard request headers, disclosed to Google by your browser when it requests a font file |
| Purpose | Rendering the Site in its intended typefaces |
| Processing location | Global Google infrastructure |
| Transfer mechanism | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Notes | Google states that Google Fonts sets no cookies and does not use the request for advertising. The request nonetheless discloses your IP address. |
Assistant / support chat
| Provider | Crisp IM SARL |
| Service | Conversational assistant, where offered on the Site |
| Personal Data processed | The content of your conversation, IP address, session identifiers, and any contact details you choose to give the assistant |
| Purpose | Answering questions about our work and services |
| Processing location | European Union |
| Transfer mechanism | Not applicable; processed within the EEA |
| Consent | Loaded for every visitor, not gated behind the cookie banner, so that support is available to anyone who needs it. Relied on as storage necessary for a service you have requested, under Art. 5(3) ePrivacy. See our Cookie Policy. |
| Notes | Do not enter confidential or sensitive information into the assistant. See Section 4.2 of our Terms of Use. |
Image libraries
Certain illustrations are served from third-party image libraries, including Unsplash, Pexels, and Wikimedia Commons. Where an image is loaded from one of those domains, your browser discloses your IP address to that provider. These providers do not receive any other Personal Data from us and do not act as our processors.
2. Providers we do not use
We publish this list for completeness, because their absence is a meaningful statement about how the Site is built:
- No advertising network, demand-side platform, or data management platform.
- No Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, or equivalent advertising tag.
- No session recording or heatmapping provider.
- No data broker, enrichment, or intent-data provider.
- No customer data platform, and no cross-site identity graph.
- No payment processor. The Site takes no payments.
3. Onward subprocessors
The providers listed above engage their own subprocessors — principally cloud infrastructure providers. Each is contractually required to impose data protection obligations on its subprocessors no less protective than those it owes to us, and to remain liable to us for their performance. The current subprocessor list for each provider is published by that provider.
4. Changes to this list
We update this page when we add, remove, or replace a provider. The effective date at the top records when the current version took effect.
Where a customer has a written agreement with us that includes a right to advance notice of a change of subprocessor, we give that notice in accordance with the agreement. For visitors to the Site, a material change affecting how Personal Data is handled is notified through the mechanism in Section 15 of our Privacy Policy.
5. Questions
Write to privacy@devencelab.com. You may request a copy of the transfer safeguards we rely on for any provider listed above.