But what about the company that delivers the cat house? They might use Jane’s personal data, but they’re not in charge of it.

It’s more like they’re processing her data rather than controlling it.

In situations like this, when a data controller gets someone else to help on their behalf, that someone is called a data processor.

Data processors aren’t in charge of collecting the data like controllers are, but they’re still responsible.