Planday’s sub-processors are located in the EU (Paris and Dublin).
The only processing of data outside of the EU is related to ancillary services, for example marketing, which is transferred to the US. It is possible to opt out of these services by emailing firstname.lastname@example.org or managing your preferences on any marketing emails received. Any processing of data outside of the EU is carefully reviewed and monitored. Planday only transfers data to systems that have a data privacy shield in place, and can demonstrate compliance to EU data privacy rules.
The details can be found in Appendix A in the DPA: https://www.planday.com/legal/data-processing-agreement/