Sub-processors

How changes work

Before we engage a new sub-processor or replace an existing one, we list the change under Upcoming changes below, with the date it takes effect, at least fourteen (14) days beforehand. A client may object on reasonable data-protection grounds within that period, as set out in clause 8 of the Data Processing Agreement. Each sub-processor is bound by a written contract with data protection obligations no less protective than ours.

Upcoming changes

None planned.

Used for every client

20i Limited (United Kingdom, company number 09775671) — provides web hosting, DNS, hosted mailboxes, SMTP email delivery, and related infrastructure for websites and email systems managed by the Processor. Data processed: any content stored on hosted websites and mailboxes, including Personal Data uploaded by the Controller or its Data Subjects, plus server access logs. Transfer mechanism: not applicable (UK-based).

FreeAgent Central Ltd (United Kingdom) — provides accounting, invoicing, and payment reconciliation. Data processed: Controller contact details, billing addresses, invoice line items, and payment records. Transfer mechanism: not applicable (UK-based).

Stripe Payments UK Ltd (United Kingdom, with parent processing in the United States) — processes card payments, Bacs Direct Debit collections and bank transfers. Data processed: Controller name, contact details, bank account details where a Direct Debit mandate or bank transfer is used, and payment amounts (Stripe holds the card and bank details directly as a controller for that data). Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs for any transfer to the United States.

Microsoft Corporation — OneDrive (United States, with UK/EU regional storage) — provides encrypted backup storage for files and configurations related to the Services. Data processed: any Personal Data contained in files the Processor backs up on the Controller’s behalf. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs; Microsoft’s EU Data Boundary applies where selected.

Cloudflare, Inc. (United States, with UK/EU edge nodes) — provides the Turnstile anti-abuse check that guards the public forms on the Processor’s website and portal (contact form, free site check, support request, project brief, and administrator sign-in). Data processed: the visitor’s IP address, browser user-agent, interaction signals (mouse/keyboard activity timings), and a short-lived cookie set only on domains that render the widget. No form data is sent to Cloudflare. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs.

Support tickets and client records are held on infrastructure operated by the Processor itself and are not passed to a third-party helpdesk provider.

Used only for the service you take

These apply only where the client takes the service named.

AI Receptionist

Vapi, Inc. (United States) — where the Controller takes the AI Receptionist, runs the voice assistant that answers the calls and co-ordinates the services below. Data processed: caller telephone numbers and caller ID, call audio for the duration of the call, the transcript and summary produced from it, and call metadata such as time and duration. Where the Controller has asked for call recording to be enabled, the recordings themselves. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs.

Twilio Inc. (United States, with UK and EU points of presence) — where the Controller takes the AI Receptionist, provides the UK telephone number and carries the calls. Data processed: caller telephone numbers, call routing data and call metadata. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs.

OpenAI, L.L.C., Deepgram, Inc. and Cartesia AI, Inc. (United States) — where the Controller takes the AI Receptionist, provide the language model that forms the assistant’s replies, the speech-to-text transcription of the caller, and the synthesised voice respectively. Data processed: the words spoken on the call and the transcript produced from them, for the duration of the call. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs.

Business VoIP

Gamma Telecom Holdings Limited (United Kingdom, company number 04287779), which provides the CircleLoop phone system — where the Controller takes Business VoIP, provides the telephone numbers, carries the calls and text messages, and runs the CircleLoop apps and administration portal. Data processed: users’ names, email addresses and telephone numbers, the numbers of the people they call and text, call and message logs with times and durations, text message content, voicemails and their transcriptions, and, where the Controller enables call recording, the recordings themselves, plus any contacts the Controller’s users choose to upload. Transfer mechanism: not applicable (UK-based).

AI website chatbot

tawk.to, Inc. (United States) — where the Controller takes the AI website chatbot, provides the chat window, the automated assistant that answers in it, and storage of the conversations. Data processed: the messages a visitor types, any name, email address or telephone number they give, and visit information such as pages viewed, approximate location from the IP address, and browser and device. Transfer mechanism: UK International Data Transfer Agreement / UK Addendum to the EU SCCs.

Managed backup, server and storage backup, Microsoft 365 backup

Acronis International GmbH (Switzerland, with UK and EU data centres) — where the Controller takes managed backup, server and storage backup, or Microsoft 365 backup, provides the backup platform and storage. Data processed: any Personal Data contained in the files, folders and system data backed up from the Controller’s devices and servers, and in the mailboxes, OneDrive, SharePoint and Teams data backed up from its Microsoft 365 account, plus device identifiers and backup job logs. Transfer mechanism: UK adequacy regulations for Switzerland; UK International Data Transfer Agreement / UK Addendum to the EU SCCs for any transfer outside adequate jurisdictions.

Managed anti-virus

Bitdefender S.R.L. (Romania, EU) — where the Controller takes managed anti-virus, provides the anti-virus software and its management console. Data processed: device identifiers, user account names on covered devices, file and process telemetry, and details of detected threats. Transfer mechanism: UK adequacy regulations for the EU.

Email filtering for Microsoft 365

Vade SASU, part of Hornetsecurity (France, EU; hosted on Microsoft Azure) — where the Controller takes email filtering for Microsoft 365, checks incoming email for phishing, spam and harmful attachments. Data processed: the content, attachments and metadata of email received into the Controller’s Microsoft 365 mailboxes, including senders’ and recipients’ names and email addresses. Transfer mechanism: UK adequacy regulations for the EU.

Email encryption

DeliverySlip, provided by OpenText (United States and Canada) — where the Controller takes email encryption, encrypts and delivers the email and attachments the Controller chooses to send securely, and records when they are opened. Data processed: the content and attachments of those emails, senders’ and recipients’ names and email addresses, and delivery and read tracking data. Transfer mechanism: UK adequacy regulations for Canada; UK International Data Transfer Agreement / UK Addendum to the EU SCCs for the United States.

---

Questions about our sub-processors? Call us on 01722 568 062 or email hello@ashburnstone.co.uk.