Our use of sub-processors

YouGov engages different types of service providers to help us create and deliver our products and services to our clients, including businesses that have access to personal data.

  • If any of the service providers we use process or otherwise have access to YouGov’s personal data, these service providers are considered to be “data processors”.
  • If any of the service providers we use process or otherwise have access to personal data that we are processing on behalf of our clients, these service providers are considered to be “sub-processors”.

Our service providers are often both data processors for YouGov and sub-processors for client data. Whenever we engage data processors or sub-processors, we assess their privacy and security practices and require them to satisfy certain obligations by signing appropriate agreements (for example, a data processing agreement) that, among other things, ensures that they have adequate security controls in place and only use personal data as instructed.

This page outlines the types of sub-processors that we work with and explains the services that they provide to us. You can contact our Data Privacy team at dataprivacy@yougov.com if you have any questions or would like more information.

Sub-processing provided within the YouGov Group

We are a global organisation, so some of the personal data that we collect may be transferred within the YouGov Group of companies to enable us to provide our services.

There are three reasons that data may be shared with other YouGov Group companies:
  • 1
    Data processing
    Our Centres of Excellence in Romania, India and Mexico provide survey scripting and data processing services to other YouGov Group companies. Our Operations teams require access to personal data to create the research insights that we provide to our clients.
  • 2
    Storage
    YouGov Services Limited is a UK company that holds the contracts with our third-party data storage providers that are used by the YouGov Group to store personal data. Our data storage providers are listed below.
  • 3
    Multi-country research
    When our client’s ask us to carry out research across multiple countries, we may need to share information between our teams in different countries to coordinate the project and ensure it is being run as efficiently as possible.

Third party sub-processors

Data storage and security

We use a combination of co-located, cloud and offline data storage providers to hold the data that we use to provide our services. These providers are in the United Kingdom, European Union (EU) and the United States, and we ensure that any data originating from the United Kingdom or EU is only stored in those regions. The table below provides more information about the sub-processors that we use engage to store and secure personal data.

Sub-processor
Category
Storage location
Description of services provided
Sub-processor
Amazon Web Services (AWS)
Category
Data storage
Storage location
EU, US
Description of services provided
Cloud data storage. Data sourced in the United States is stored on AWS US, and all other data is stored on AWS Ireland.
Sub-processor
Digital Realty
Category
Data storage
Storage location
EU
Description of services provided
Co-located data centre storage. Digital Realty’s London data centre hosts the infrastructure that stores data collected globally (acting as a backup for US-sourced data stored on Equinix). Data stored in Digital Realty’s infrastructure is replicated to AWS Ireland.
Sub-processor
Equinix, Inc.
Category
Data storage
Storage location
US
Description of services provided
Co-located data centre storage. Equinix’s Silicon Valley data centre hosts the infrastructure that stores data collected in the United States. Data stored in Equinix’s hosted infrastructure is replicated to Digital Realty’s co-located data centre.
Sub-processor
Iron Mountain
Category
Data storage
Storage location
EU, US
Description of services provided
Offline data storage back-ups. Data stored in Digital Realty’s London Data Centre is backed up and stored in Iron Mountain’s storage vault in the United Kingdom. Data stored in Equinix’s US data centre is backed up and stored in Iron Mountain’s US storage vault.
Sub-processor
Imperva Incapsula
Category
Web Application Firewall
Storage location
EU, US
Description of services provided
A web application firewall that filters all HTTP and HTTPS based traffic to certain YouGov websites. The storage location is set on each website, so US-specific web applications are stored in the US and all other web applications are stored in EU.
Sub-processor
Microsoft
Category
Data storage & communication technology
Storage location
UK
Description of services provided
Microsoft 365 subscription (including email and OneDrive storage).