This page lists the sub-processors that Atlas Merlin Ltd (“Atlas Merlin”) engages to process personal data on behalf of its customers in connection with the Software and related services.
This page should be read together with our standard terms and conditions at https://atlasmerlin.com/legal/terms (the “Conditions”) and our Data Processing Agreement at https://atlasmerlin.com/legal/dpa (the “DPA”). Capitalised terms used on this page have the meanings given to them in the Conditions and the DPA. Under clause 5.1 of the DPA, customers provide a general authorisation for Atlas Merlin to engage the sub-processors listed below. Under clause 5.2 of the DPA, we will give customers at least 30 days’ notice before adding or replacing a sub-processor, during which a customer may object on reasonable data protection grounds.
Where a sub-processor is located outside the United Kingdom, the relevant transfer mechanism is identified in the table. Transfers to sub-processors located in the European Economic Area are made in reliance on the UK adequacy regulations covering the EU/EEA, as referenced in clause 6.2 of the DPA.
Subscribing to updates
To be notified of changes to this list, email legal@atlasmerlin.com with the subject line “Sub-processor updates” and the name of your organisation. We will add you to the notification list and send updates at least 30 days before any addition or replacement takes effect.
Current sub-processors
| Name | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Atlas Merlin d.o.o. (in formation) — wholly-owned subsidiary of Atlas Merlin Ltd | All technical activities, including software development, support, ML operations, remote device management, and any other processing required to deliver the Software | Croatia | UK adequacy regulations (EU/EEA) |
| Amazon Web Services, Inc. (“AWS”) | Cloud hosting, infrastructure, storage, model training, and related processing for the Software and associated services | UK, EU/EEA, and other regions as required by the deployment | UK adequacy regulations (UK and EU/EEA regions); UK Addendum to the EU SCCs (other regions, where applicable) |
| Google Cloud EMEA Limited (“GCP”) | Cloud hosting, infrastructure, storage, model training, and related processing for the Software and associated services | UK, EU/EEA, and other regions as required by the deployment | UK adequacy regulations (UK and EU/EEA regions); UK Addendum to the EU SCCs (other regions, where applicable) |
| Microsoft Ireland Operations Limited (“Azure”) | Cloud hosting, infrastructure, storage, model training, and related processing for the Software and associated services | UK, EU/EEA, and other regions as required by the deployment | UK adequacy regulations (UK and EU/EEA regions); UK Addendum to the EU SCCs (other regions, where applicable) |
| Hetzner Online GmbH | Cloud hosting, infrastructure, storage, model training, and related processing for the Software and associated services | EU/EEA | UK adequacy regulations (EU/EEA) |
| Google Ireland Limited (Google Workspace) | Business email, calendar, file storage, and document collaboration used to communicate with customers and to receive content from customers in the course of support and service delivery | Global, default Google Workspace configuration | UK Addendum to the EU SCCs |
| GitHub, Inc. | Source code hosting and continuous integration (GitHub Actions) for the Software | United States | UK Addendum to the EU SCCs |
Last updated
6 May 2026