Sub-processors
We use carefully selected third-party service providers (“sub-processors”) to support the delivery of our services. Where these providers process personal data on our behalf, they do so under written agreements that include appropriate data protection obligations, including confidentiality, security measures, and restrictions on further processing.
Where personal data is transferred outside the United Kingdom or European Economic Area, we ensure that appropriate safeguards are in place, such as the use of Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or reliance on adequacy regulations such as the EU-US Data Privacy Framework where applicable.
We conduct due diligence on all sub-processors and monitor their compliance with applicable data protection laws.
| Sub-processor | Purpose | Nature of Processing | Duration / Retention | Data Categories | Data Location | Safeguards |
|---|---|---|---|---|---|---|
| Amazon Web Services | Cloud hosting, storage, database services | Hosting and infrastructure management | Duration of service provision | Customer data (identifiers, account data), usage data, logs | UK / EU (regional data centres) | Data Processing Agreement (DPA), SCCs in place for international transfers |
| DigitalOcean | Storage, database services | Hosting and infrastructure management | Duration of service provision | Customer data, usage data, logs | EU (regional data centres) | DPA, SCCs in place for international transfers |
| Microsoft (Microsoft Ireland Operations Ltd.) | Storage, client communications | Cloud services, email, collaboration tools | Until deletion per contract terms | Customer data, account data, communications data, logs | UK / EU (regional data centres) | DPA, SCCs in place for international transfers, may participate in EU-US Data Privacy Framework |
| Google Ireland Limited | Analytics software | Website usage monitoring | In line with backup retention policies | Usage data (page views, interactions), device/browser data, IP address (where collected), cookies | USA | SCCs in place for international transfers, UK IDTA/Addendum |
| Convene IT | IT service provider and infrastructure management | IT support and system administration | Until deletion per contract terms | Account data, technical data, support data | UK | DPA, UK data residency |
| Convene Cyber | Cyber security services | Security monitoring and incident response | Until deletion per contract terms | Account data, technical data, logs | UK | DPA, UK data residency |
| Sage | Financial services | Accounting and financial processing | Until deletion per contract terms | Account data, customer data, financial/payment data | UK | DPA, UK data residency |
| Smartsheet | Work management and storage | Collaboration and data organisation | Duration of service provision | Customer data, usage data, logs | EU (primary storage), USA (data transfers for support) | DPA, SCCs in place for international transfers, Data Privacy Framework |
| Mailchimp (Intuit Inc.) | Customer and promotional email | Email delivery and marketing automation | Duration of service provision | Customer data (name, email), usage data, logs | USA | SCCs in place for international transfers, UK IDTA/Addendum, Data Privacy Framework |
| Pipedrive | Customer relationship management | CRM and sales pipeline management | Duration of service provision | Customer data, communications data, usage data | EU | DPA, SCCs in place for international transfers |
| Advantage Software | Sage support | Technical support services | Duration of service provision | Customer data, usage data, logs | UK | DPA, UK data residency |
| SurveyMonkey (Momentive Inc.) | Customer feedback and surveys | Survey distribution and response collection | Duration of service provision | Customer data, survey responses, usage data | USA | SCCs in place for international transfers, UK IDTA/Addendum, Data Privacy Framework |
| Teamup | Calendar services | Scheduling and calendar management | Duration of service provision | Customer data (names, scheduling information) | Ireland (EU) and United States (Oregon) – hosting locations as disclosed by provider | SCCs in place for international transfers, UK IDTA/Addendum |
| SJ Software | Sage support | Technical support services | Duration of service provision | Customer data, usage data, logs | UK | DPA, UK data residency |
| EMS | Sage pay | Payment provider | Until deletion per contract terms | Account data, financial/payment data | UK | DPA, UK data residency |
| Creditsafe | Credit checking | Financial services | Until deletion per contract terms | Account data, financial/payment data | UK / EU | DPA, SCCs in place for international transfers |
| Squarebird | Website developer | Website development and maintenance (limited access) | Duration of service provision | Customer data | UK (primary), with potential remote access from other locations | SCCs in place for international transfers, UK IDTA/Addendum |
| Opayo | Sage pay | Payment provider | Until deletion per contract terms | Account data, financial/payment data | UK | DPA, UK data residency |
* Certain providers (e.g. payment processors) may act as independent controllers.
Sub-processor data protection compliance
Sub-processor data protection compliance
All sub-processors are subject to appropriate security and confidentiality obligations, and we conduct periodic reviews of their compliance.
Updates to this list
Updates to this list
We may update this list from time to time as our use of sub-processors evolves. Where required by applicable law, we will provide notice of any significant changes.
Find out how we can help
If you’d like to learn more about our hygiene training or book a site hygiene audit, please contact us!
Fill in the form below, give us a call or email us!
