Sub-processors

1What this page is

In plain EnglishA sub-processor list names the other companies that can touch your data. Troy’s has four on it — the company that hosts this site, the group company whose systems the data sits on, and two AI vendors — and this page explains what goes on the list, and the rules for putting it there.

This is the sub-processor list the data processing addendum refers to, together with the commitments Troy binds itself to when it adds to it. Read the two documents together. Where this page and a signed addendum disagree, the signed addendum governs, because that is the document with signatures on it.

Today the list has four companies on it: Vercel Inc., which runs troy-agency.com; Lunari Group, which runs the systems client data is stored on; and OpenAI and Anthropic, whose models Troy drafts with. That is a fact about Troy, not a gap in the page. Troy sells work done by people, inside accounts its clients own, and it has no platform of its own in service, so there is not yet a long stack behind it. What a short list does not mean — and the work still owed before it can be called complete — is at clause 5.1.

2Words used on this page

In plain EnglishEight terms, defined once. They are used in their legal senses throughout, and nowhere else on this page is a word doing quiet work.

Personal data

Information about an identified or identifiable person. A subscriber’s name and email address in a client’s list is personal data. So is a record of who clicked an advertisement, wherever it can be tied back to a person.

Controller and processor

The controller decides why and how personal data is used. The processor does the work on the controller’s documented instructions. For the marketing data Troy handles, the client is the controller and Troy is the processor.

Sub-processor

A company Troy brings in to do part of the work a client asked Troy to do, where that work involves the client’s personal data. Troy chooses it, Troy pays it, and the client did not pick it.

Client data

Personal data Troy processes for a client under the data processing addendum, including what Troy reads from the accounts a client connects.

Your own platforms

Accounts a client holds in its own name with companies such as Meta, Google Ads, Shopify and Klaviyo. Troy is granted access to them. They are dealt with at clause 4.

Model vendor

A company whose artificial intelligence model produces or analyses text, images or figures. Troy’s are OpenAI and Anthropic, and they are dealt with at clause 8.

Group company

Lunari Group and Louin, the companies Troy shares an owner with. Sharing an owner is not an exemption from this page: Lunari Group is on the list at clause 5, and what the group shares is at clause 9.

The list

The table at clause 5, written in the format described at clause 6. It has four companies on it today.

3What a sub-processor is, in plain English

In plain EnglishSomeone Troy hires to help do your work, who can reach your data while doing it — and who you never chose.

Troy’s own site runs on somebody else’s computers, and anything Troy builds will too. The company that owns those computers can reach whatever sits on them. It is doing part of Troy’s job, for Troy, under a contract the client has never read. That company is a sub-processor, and a client is entitled to know its name before its data arrives there.

Three questions decide it. All three have to be answered yes.

1. Did Troy choose it, and could Troy replace it? If the choice is Troy’s, the declaration is Troy’s.
2. Does Troy hold the contract and pay the bill? Money follows control, and control is what makes something Troy’s to answer for.
3. Does it process personal data that Troy processes for a client? A tool that never touches client personal data is not a sub-processor of it.

A company Troy shares an owner with is answered the same way, and the answers come out the same. Lunari Group holds client data because Troy put it on systems Lunari Group runs, so Lunari Group is on the list. The test does not have an exception for family.

Where Troy uses a tool for its own purposes rather than for a client’s work — billing its own clients, keeping its own records — Troy is the controller of that data, not a processor of it. The privacy policy covers those uses. This page does not, and it will not be padded with them to look longer.

4The platforms you already use are not Troy’s sub-processors

In plain EnglishMeta, Google Ads, Shopify and Klaviyo are your accounts, on your contracts, paid by you. Troy is a guest in them, and it cannot appoint a company you appointed first.

Troy’s work begins by being added to accounts a client already owns. For a Troy Score that is read-only access — a viewer seat, the lowest tier those platforms offer, which changes nothing in the account. The client signed up with those companies, the client pays them, and the client can remove Troy’s access from its own settings without asking Troy or waiting for it.

So Troy does not appoint them, and cannot. Appointing a sub-processor means choosing a company to handle data on someone’s behalf. The client chose Meta, usually years before Troy arrived. A list that named those platforms would be describing a client’s own suppliers back to it, and would bury the companies Troy actually chose somewhere in the middle of them.

Who sends matters as much as who holds the contract. Where a client emails or texts its own list from its own platform, the client is the sender of those messages, and Canada’s Anti-Spam Legislation puts the obligations on the sender: consent to send, the sender clearly identified in the message, and an unsubscribe that works and is acted on. Troy drafts; a named person at the client approves; nothing goes to an audience without that approval. Whether a particular message is a commercial electronic message, and whether the consent behind a particular list is good enough, turns on facts Troy does not hold and is a question for the client’s own advisers. Troy states no conclusion on it.

5The current list

In plain EnglishFour companies: the one that runs this website, the group company whose systems client data sits on, and the two AI vendors Troy drafts with. One more is chosen but not installed, and it is listed separately, below the real ones.

There are four rows in the table below, and every one of them is a real appointment rather than an illustration. One of them, Lunari Group, is on the list because Troy, Louin and Lunari Group share systems and data. That is the most consequential thing on this page and it is dealt with in full at clause 9.

Four things about those rows should be said out loud. First, what the Vercel Inc. row covers today is Troy’s own website, where Troy is the controller and the privacy policy — not this page — describes what is collected; it is listed anyway, because it is the company that would run anything Troy builds, and a host named late is a host named badly. Second, the Lunari Group row is not a plan or a risk to manage later: it is the arrangement in place now. Third, the two model vendors are named, but the plan each is used under is not written down, and that is the question a client will ask first. Fourth, no client engagement has run yet, so nothing of any client’s has actually passed through the last three rows — which is a fact about how new Troy is, not a safeguard.

One company is chosen but not yet in service, and it is deliberately kept out of the table above. Troy intends to use Vercel Analytics, which is cookieless and does not track anyone across sites (a proposed default, not yet approved)?. Nothing is installed on the site today, the cookie policy says the same, and it moves up into the table of appointments on the day it is switched on rather than in advance of it. A planned appointment is not an appointment, and this page does not let the two share a table.

Everything Troy sells today is work done by people, inside accounts the client owns and can take the access back from. A Troy Score is prepared from read-only access. Retainer work uses whatever access the client grants, and anything that reaches an audience or spends money waits for a named person to approve it. There is no Troy platform in service. What Troy keeps of a client’s work — briefs, reports, the figures it reads — sits on the shared systems in the Lunari Group row, not in a product of Troy’s own.

The commitment is the plain one. A company is published on this page before any client data is processed by it — before, not afterwards, and never as a line in a change log nobody is reading.

6What the list will look like

In plain EnglishFive columns, one row per company, in words you can check against reality.

This is the shape every row takes, including the ones already on the list. Each column answers a question a client has to be able to ask, and each answer is specific enough to be wrong — which is the point of writing it down.

The last column has a starting point, because Troy knows where it will be established. Troy Agency Inc. is incorporating federally, under the Canada Business Corporations Act, with its registered office in Ontario. That incorporation has not completed and there is no corporation number yet — To be completed: There is no corporation number yet, which means the federal incorporation has not completed. Until it has, Troy Agency Inc. is an intended name rather than a company: it cannot sign a contract, and calling itself “Inc.” in one would be wrong. This is the first thing to finish.[companyNumber] — so this describes the company Troy is becoming rather than a registration anyone can look up today. It puts Troy under Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act — PIPEDA — and within reach of the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority.

Where Troy sells decides which other regimes are in play. Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. The European and UK rules are therefore context on this page rather than regimes Troy is currently answering to, and Troy has not met their representative requirement: on an EU representative, none appointed. Troy does not offer its services to people in the European Union, and will appoint a representative there before it does; on a UK one, none appointed. Troy does not offer its services to people in the United Kingdom, and will appoint a representative there before it does. A representative has to be in place before Troy takes customers in either, and this page will say when one is.

Personal data crosses a border here immediately. This site runs in Vercel's Washington, D.C. region (iad1), in the United States, so a Canadian visitor’s request data is processed in the United States before anything else happens, and a Canadian client should read the Lunari Group row knowing Troy cannot yet say which country that data sits in either. Where data crosses a border Troy expects to rely on the Standard Contractual Clauses, with the UK Addendum where the United Kingdom is involved, entered into through each supplier's own data processing agreement (a proposed default, not yet approved)?. Whether that reliance actually holds has to be checked supplier by supplier rather than asserted on a web page: it turns on where the supplier is established, what it does with the data, and whether Troy is inside the scope of the terms it is relying on. Troy states no finding either way, and nothing here is a claim that Troy complies with any of these regimes.

Quebec is worth naming separately. Where a client, or a client’s own customers, are in Quebec, the province’s Law 25 may apply on top of the federal rules, and among other things it expects an organisation to assess the risks before personal information is communicated outside the province. Troy has not carried out that assessment, because there has been no engagement to carry it out for. It is written down here so a Quebec client raises it early rather than after the work starts.

None of that fills the column in for a particular company. That still needs the country a company actually holds the data in, and for the Lunari Group row that has not been written down.

7Changing the list, and how to object

In plain EnglishYou are told before a new company starts work, and you can object in writing. If Troy cannot resolve the objection, you can leave over it.

Adding a sub-processor, or replacing one with another, changes the arrangement a client agreed to. So it is announced in advance rather than discovered. Troy gives 30 days' notice before a new sub-processor starts, with a right to object in that period (a proposed default, not yet approved)?.

1. Troy updates this page with the new row and the date of the change.
2. Troy writes to the contact each client names for notices. Clients are not expected to watch a web page.
3. The client has that period to object, in writing, with its reason.
4. Troy answers the objection. Where there is a workable alternative, Troy offers it.
5. Where the objection cannot be resolved, the client may end the affected engagement for that reason without penalty, and get its data out first.

A change inside Troy’s own group counts as a change. If what the companies in Lunari Group share changes, or another group company starts holding client data, that is a change to this list and it is notified in the same way as any other.

The notice and the objection window are the same period, and it runs before the new company starts rather than after. It is a different decision from the notice period for ending a retainer, which is 30 days' written notice, on either side (a proposed default, not yet approved)? and lives in the services agreement. A client ending an engagement because Troy could not answer its objection is not also required to serve that ordinary notice, because the objection is the reason and the remedy would be worth little if it were.

8AI vendors, specifically

In plain EnglishTroy drafts with models made by other companies. They are on the list like any other sub-processor — and what is still missing is the plan each is used under, and whether that plan lets the provider train on what is sent.

Troy builds no models of its own. It drafts with OpenAI and Anthropic, and both are rows on the list at clause 5, with the same five columns as a hosting company and the same notice if either changes. Troy’s agents are not available to buy yet; when they are, they will call the same kind of models, and any other vendor that processes personal data for a client joins the list too. So does a model a strategist uses on a client’s data before any agent exists.

• The row states whether the vendor may train on the data. Troy’s rule is that no vendor trains on client content, and a vendor whose terms cannot be made to match it does not get used. Neither vendor has been held to that rule yet, because the plan each is used under is not written down.
• The row states what is actually sent — a client’s own text and figures, or only material Troy wrote — because those are different exposures and a client should not have to guess which one applies. Today that is decided piece by piece by the person doing the work, not by a written rule.
• The row states whether a human at the vendor may read the content, for example to review it for abuse, and how long the vendor keeps it. Troy has confirmed neither for the vendors it uses.
• A vendor changing its training or retention terms is a change to this list, notified like any other change, whether or not the vendor calls it one.

One thing sits above any vendor’s terms. Agents draft, build and propose; a named person approves anything that reaches an audience or spends money. What a model produces is work waiting for approval, not an action taken.

9Troy’s own group, and the data the group shares

In plain EnglishTroy is not a separate island. Troy, Louin and Lunari Group share systems and data, client data is held on systems Lunari Group runs, and the companies in the group can see each other’s data. What makes that lawful is not in place yet.

Troy is part of Lunari Group, alongside Louin. This is the part of the page a client should read twice. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. Help with the work — engineering, for example — may come from inside the group as well.

That is why Lunari Group is a row on the list at clause 5 rather than a footnote. It processes client personal data for Troy, so it is a sub-processor, and it is named like any other company. Sharing an owner did not exempt it, and a company does not become invisible because it shares a shareholder.

This is a change of position, and it is better named than buried. Earlier drafts of this page promised that a company in Troy’s group reaches nothing of a client’s unless that client grants it. The promise was wrong about how Troy is set up. It has been removed rather than reworded, nothing has been put in its place that limits what the group can see, and a client evaluating Troy is evaluating the group’s systems.

The reverse direction matters as much as the storage. Where a client is also a Louin customer, Troy reading that client’s orders, stock or margins in order to do marketing is a new purpose in law. Under PIPEDA, using someone’s personal information for a purpose they were not told about needs their meaningful consent: notice in words they can understand, a real way to say no, and a record of what they agreed to. Being in the same group is not consent, and the systems being shared is not consent either.

What is missing is written down rather than implied. There is no data-sharing agreement inside Lunari Group, no notice to the people whose data the sharing reaches, and no consent record. Troy states no conclusion about whether the present arrangement is lawful — it is not in a position to, and a page Troy wrote about itself would be the wrong place to find one. It is a question for a lawyer, and it is the first one to ask.

10What is not on this list, and where it lives instead

In plain EnglishFour things people expect to find here, one they expect not to, the document that actually covers each one, and one case that has nowhere to live yet.

Your own platforms

Your accounts with Meta, Google Ads, Shopify, Klaviyo and anyone else you contract with directly. Covered at clause 4, and by your terms with those companies.

Your own suppliers

An agency, a freelancer or a developer you engage. Troy may work alongside them. Troy did not appoint them and does not answer for them.

Troy’s own people

Employees and individual contractors are Troy, bound by confidentiality and working on your instructions. Covered by the data processing addendum. A business Troy subcontracts to is not, and is on the list — see clause 4.2.

Anything Troy does as a controller

Troy’s records of who enquired, who its clients are and who it invoices. Those are Troy’s own purposes, and the privacy policy covers them.

Troy’s own group

Not an exception, and the one people expect to find missing. Lunari Group is on the list at clause 5, because client data is held on systems it runs. What the group shares is at clause 9.

One case has no home yet. Troy will take payment for its own invoices somehow, and whichever company handles that will see a client’s billing details. Whether it is Troy’s sub-processor or a separate controller in its own right depends on which company it is and what it does with the data. It has not been chosen, so this page does not guess. It is written into this clause because there is nowhere else it is recorded, and an unanswered question is easier to answer when it is visible.

11What Troy requires before appointing anyone

In plain EnglishThe conditions a company on this list has to meet. None of the four on it today has been measured against all of them, and the page says which fall short.

• A written contract in place before any data is sent, with data protection terms no weaker than the ones Troy gives its own clients.
• The work defined and limited: the company processes what that work needs, on Troy’s documented instructions, and for nothing else — including nothing of its own.
• Confidentiality that binds the people who actually do the work, not only the company that employs them.
• A transfer safeguard agreed before the first transfer rather than papered afterwards, named in the row, and checked against where that company actually holds the data rather than where its head office is — see clause 6.
• A commitment to tell Troy about a personal data breach fast enough that Troy can meet what it owes its own clients, which is notice without undue delay and in any event within 48 hours of becoming aware of it (a proposed default, not yet approved)?.
• The company’s own sub-processors declared to Troy, and passed through to this list.
• A way to get the data back or have it deleted at the end, on terms Troy can actually enforce.

One thing is not a condition on the other company but on Troy. Appointing a sub-processor moves the work, not the responsibility: Troy stays answerable to its clients for what that company does with their data. What that responsibility amounts to in money is set by the data processing addendum and the agreement a client signs, not by this page — and behind it stands Troy itself and nothing else, because Troy holds no professional indemnity and no cyber insurance. A client weighing this page should price that in rather than assume a policy is there.

That is not only Troy’s preference, it is how Canadian law frames the same problem. PIPEDA makes an organisation accountable for personal information it transfers to another company for processing, and expects it to use contractual or other means to give that information protection comparable to its own. The conditions above are Troy’s attempt to write that down before there is any pressure to soften it. Whether they go far enough in a particular case depends on the facts of that engagement and is a question for a lawyer; Troy states no conclusion on it and claims no compliance finding here.

Troy makes no claim to hold a certification, to have passed an audit, or to meet a named standard or framework. It holds none. If that ever changes, it will be named here and on the security page, with the date it was granted and by whom.

12Being told when this page changes

In plain EnglishThere is no subscribe button yet. Ask by email and you go on the list of people who get told.

Until there is a mechanism, the mechanism is a person. Write to privacy@louin.io and ask to be told when this page changes, and Troy records the request. A working email address and a kept promise are better than a form that posts nowhere.

Asking is the consent, and it is the only thing that puts you on that list — writing to Troy about something else does not. Anything Troy sends says who it is from and how to stop it, and Troy stops when asked. Where a message Troy sends counts as a commercial electronic message, Canada’s Anti-Spam Legislation requires exactly that: consent, the sender identified, and an unsubscribe that works and is acted on.

Clients do not need to subscribe. Notice of a change goes to the contact named for notices in their agreement, whether or not they ever asked for it.

Questions about this page go to troy@louin.io. Data protection requests, including a request to be told when the list changes, go to privacy@louin.io. Formal notices, including an objection to a sub-processor under clause 7, go to troy@louin.io. All three are monitored by the same small company, so an objection that arrives at any of them counts as given, and Troy will not argue otherwise on a document it wrote itself.