Planday’s sub-processors are located in the EU.
The only processing of data outside of the EU is related to ancillary services, for example, marketing, which is transferred to the US. It is possible to opt-out of these services by emailing email@example.com or managing your preferences on any marketing emails received. Any processing of data outside of the EU is carefully reviewed and monitored. Planday only transfers data to systems that have a data privacy shield in place and can demonstrate compliance with EU data privacy rules.
The details can be found in Appendix A in the DPA: https://www.planday.com/legal/data-processing-agreement/