Legal
Sub-processors
Version 1.0 — last updated 23 September 2026
This page lists the Sub-processors that RSM Software engages to process personal data on behalf of company customers under our Data Processing Addendum, and it forms part of that addendum. It also lists, separately, the other providers whose services Tideward uses where RSM Software is itself the controller, so that you can see every third party that handles personal data for Tideward.
RSM Software means Rogue Star Marine Software Ltd, trading as RSM Software, registered in the Republic of Cyprus under number HE496769. Terms such as Sub-processor, Customer Personal Data, Tenant, Pool and Administrators have the meanings given in the Data Processing Addendum.
1. How this list works
1.1 What we run ourselves
We operate the Tideward application, its database and our identity service (the sign-in service at auth.tideward.net) ourselves, on infrastructure rented from Amazon Web Services. They are not separate Sub-processors; the Amazon Web Services entries below cover them.
1.2 Optional Sub-processors
Entries marked optional are used only when they are switched on. By default, Tideward reads the text of an uploaded document inside the Service itself, using the text the document already contains, and sends it to no one. We switch an optional Sub-processor on for a customer's data only at that customer's request or after giving the notice described below.
1.3 Changes to this list
At least 30 days before a new Sub-processor begins to process Customer Personal Data, we update this page and email the customer's Administrators. A customer may object on reasonable data protection grounds, as section 7 of the Data Processing Addendum explains. If a Sub-processor has to be replaced urgently, for example after a security incident, we tell customers as soon as we can.
2. Sub-processors for Customer Personal Data
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting of the Tideward application, its database, file storage, identity service, queues, logs, monitoring and backups | All categories of Customer Personal Data described in Annex 1 of the Data Processing Addendum | Ireland (AWS Europe region eu-west-1) | Data is stored in the EU. AWS's data processing addendum includes the EU Standard Contractual Clauses for any access from outside the European Economic Area. |
| Amazon Web Services EMEA SARL — Amazon Simple Email Service | Sending the Service's email: notifications, invitations, and sign-in and password emails | Names and email addresses of recipients, and the content of each email | Ireland (AWS Europe region eu-west-1) | As for Amazon Web Services above. Once sent, an email is delivered by the recipient's own email provider, wherever that provider is. |
| Amazon Web Services EMEA SARL — Amazon Textract (optional, used only when enabled) | Reading text from uploaded documents to fill in their details | The images and text of the documents sent for reading, such as identity documents and certificates | Ireland (AWS Europe region eu-west-1) | As for Amazon Web Services above. |
| Microsoft Ireland Operations Limited — Azure AI Document Intelligence (optional, used only when enabled) | Reading text from uploaded documents to fill in their details | The images and text of the documents sent for reading, such as identity documents and certificates | Not in use. The Azure region will be stated here before this Sub-processor is switched on. | Microsoft's data protection addendum, which includes the EU Standard Contractual Clauses. |
No external artificial intelligence model provider receives Customer Personal Data.
3. Other providers where RSM Software is the controller
These providers do not process Customer Personal Data on a customer's behalf, so they are not Sub-processors under the Data Processing Addendum. They handle personal data for purposes that are RSM Software's own, which our Privacy Policy and Cookie Policy describe.
| Provider | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States) | Payments for paid plans: checkout, subscriptions, invoices, the billing portal where customers manage cards, invoices and cancellation, and calculating VAT and other taxes on each payment from the billing address and any VAT number given at checkout | Billing name, email address and billing address, VAT number where given, payment card details entered on Stripe's own checkout page, and payment history. RSM Software does not receive full card numbers. | European Union and the United States | Stripe's data processing terms, which include the EU Standard Contractual Clauses, and the EU-U.S. Data Privacy Framework certification of Stripe, Inc. Stripe also acts as a controller for its own purposes, such as fraud prevention, under its own privacy policy. |
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting of the data RSM Software holds as controller, such as account, billing and security records | Account, billing and security data | Ireland (AWS Europe region eu-west-1) | As in section 2. |
| Google (Google Fonts) | Delivering the fonts that Tideward's web pages, including the portals, load in the browser | The visitor's IP address and the browser details sent with each request | United States and Google's worldwide network | The EU-U.S. Data Privacy Framework certification of Google LLC. |
| Plausible Insights OÜ (Estonia) — optional, used only when enabled and only after the visitor consents | Visitor analytics for the public website | Pages visited, referring page, browser, device type and country, which Plausible works out from the IP address | European Union | Not needed: the data stays in the European Union. |
If we use a different analytics script on the public website instead of Plausible, we will name its provider here before it is used. Like Plausible, it loads only after the visitor consents.
4. Sign-in providers that users choose
Where we have switched them on, users can sign in to Tideward with an account they already hold at Google, Facebook or X (formerly Twitter). These providers are not our Sub-processors and we do not send them Customer Personal Data. A user who chooses one of them signs in with that provider directly, under the provider's own terms and privacy policy, and the provider then shares details such as the user's name and email address with Tideward to create or open the Tideward account. Each provider is a separate controller, and any transfer of the user's data outside the European Economic Area is made by that provider under its own safeguards.
5. Who is not on this list
- Other Tenants with whom a customer shares data through the Service, such as the companies in a Pool, an appointed port agent or a seafarer, are recipients chosen by the customer, not Sub-processors.
- Email providers that receive the emails Tideward sends are the recipients' own providers.
6. Contact
Questions about this list, or an objection to a new Sub-processor: dpo@rsm-software.com.