The Vendor Letter
Ask your software vendor where your data goes.
Your privacy statement says where your clients' data goes. It repeats what your software vendors told you. Have you ever asked them in writing? This is the letter to send them.
From the contract to a written answer.
Before you write
Three documents to find first, so the letter only asks what they leave open.
Five questions
Each tied to a clause in the vendor's own contract: sub-processors, where data is stored and where it is processed, where the list is published, which contract applies.
Reading the answer
What a good answer looks like, and five replies that should make you ask again.
The Swiss test
How to check a country against Annex 1 of the Data Protection Ordinance, US vendors included.
I sent these questions to the vendors my own business runs on. One took 41 days to answer, and its second written answer contradicted the first. The letter is what I'd send next time.
This template gets you facts from your vendors. What they mean for your purpose is a question for a lawyer.
Fifteen tools, fifteen letters?
If you'd rather not write them yourself, I'll map every tool your business runs on: where each one keeps your data, who else handles it, and what your privacy statement can truthfully say. You get facts, not legal advice. That's the Data Path Check.