Sub-processors
Version 1.4
Last updated: 22 July 2026
Next review: 22 October 2026
This page lists the third-party sub-processors I use to deliver services to clients under my Data Processing Agreement (DPA). Not every sub-processor is engaged on every project — the relevant set depends on the agreed Services and the tools the Data Controller already operates.
Change notification
I review this list quarterly and update it whenever sub-processors change. Existing clients will be notified by email at least 30 days before any new sub-processor is engaged or an existing one is replaced. Clients may object on reasonable data-protection grounds within 30 days of notification. If a reasonable objection cannot be resolved, the affected Services may be terminated without penalty (see §8 of the DPA).
To receive change notifications, email info@nathanoconnor.co.uk with the subject “Sub-processor notifications”.
International transfers
Where Personal Data is transferred outside the United Kingdom, transfers are governed by the applicable transfer mechanism in each sub-processor's own Data Processing Agreement, typically one of:
- An Adequacy decision by the UK government (covers the EEA and a limited list of other countries)
- The UK International Data Transfer Agreement (UK IDTA)
- The European Commission's Standard Contractual Clauses (SCCs) with the UK Addendum issued by the ICO
Copies of the applicable transfer mechanism for any individual sub-processor are available on reasonable request.
Current sub-processors
Vendors are grouped by function. Headquarters and data location reflect the vendor's public disclosures at the time this page was last reviewed.
Where a field reads NEEDS VERIFICATION, that detail has not yet been confirmed against the vendor's own published terms. It is shown as an open gap rather than filled with an assumption, and is resolved at the next review. Ask me if you need a specific one confirmed sooner.
CRM and contact management
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| Twenty CRM | CRM and contact management | NEEDS VERIFICATION | EU / UK (self-hosted) | Adequacy (EU/UK hosted) | NEEDS VERIFICATION |
| CallTrackingMetrics | Call attribution (where deployed on client sites) | CallTrackingMetrics, LLC | United States | UK IDTA / SCCs + UK Addendum | NEEDS VERIFICATION |
Ad platforms (independent controllers — see note)
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| Google Ads | Search, display, and conversion tracking | NEEDS VERIFICATION | United States (global infrastructure) | UK IDTA / SCCs + UK Addendum (controller-to-controller) | business.safety.google |
| Meta Ads | Conversion tracking and audience matching | NEEDS VERIFICATION | United States / Ireland | UK IDTA / SCCs + UK Addendum (controller-to-controller) | NEEDS VERIFICATION |
| LinkedIn Ads | B2B advertising and audience matching | NEEDS VERIFICATION | United States / Ireland | UK IDTA / SCCs + UK Addendum (controller-to-controller) | legal.linkedin.com |
| Microsoft Ads | Search and conversion tracking | NEEDS VERIFICATION | United States | UK IDTA / SCCs + UK Addendum (controller-to-controller) | NEEDS VERIFICATION |
| TikTok Ads | Conversion tracking and audience matching | NEEDS VERIFICATION | United States / Ireland / Singapore | UK IDTA / SCCs + UK Addendum (controller-to-controller) | NEEDS VERIFICATION |
Analytics and tag management
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| Google Tag Manager (client and server-side) | Tag orchestration | NEEDS VERIFICATION | United States (global infrastructure) | UK IDTA / SCCs + UK Addendum | business.safety.google |
| Google Analytics 4 | Web analytics | NEEDS VERIFICATION | United States | UK IDTA / SCCs + UK Addendum | business.safety.google |
Consent management
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| CookieYes | Google-certified Consent Management Platform; IAB TCF signalling | CookieYes Limited | United Kingdom | Adequacy (UK) | cookieyes.com |
Automation
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| n8n | Workflow automation | n8n GmbH | Self-hosted / EU | Adequacy (EU/UK hosted) | n8n.io |
AI tools
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| Anthropic (Claude API) | AI content audits and analysis | Anthropic Ireland, Limited | United States | NEEDS VERIFICATION | anthropic.com |
| OpenAI | AI-model probing for AI-visibility measurement; trend research; content-pipeline drafting | OpenAI OpCo, LLC | United States | SCCs + UK Addendum | openai.com |
| Google (Gemini) | AI-model probing for AI-visibility measurement; trend research | NEEDS VERIFICATION | NEEDS VERIFICATION | NEEDS VERIFICATION | NEEDS VERIFICATION |
| Perplexity | AI-assisted research | NEEDS VERIFICATION | United States | UK IDTA / SCCs + UK Addendum | perplexity.ai |
| Tavily | AI-assisted web search for research pipelines | AlphaAI Technologies Inc. (dba Tavily) | NEEDS VERIFICATION | NEEDS VERIFICATION | NEEDS VERIFICATION |
| Firecrawl | Web content retrieval and extraction for research | SideGuide Technologies, Inc. (d/b/a Firecrawl) | NEEDS VERIFICATION | NEEDS VERIFICATION | NEEDS VERIFICATION |
| ElevenLabs | Conversational AI voice assistant on this website (processes visitor microphone audio only after the visitor clicks to start and grants microphone permission) | Eleven Labs Inc. | United States | UK IDTA / SCCs + UK Addendum | elevenlabs.io |
Hosting and infrastructure
| Vendor | Function | Legal entity | HQ / Location | Transfer mechanism | DPA / trust page |
|---|---|---|---|---|---|
| Hetzner | Server hosting for the self-hosted CRM, the agency monitoring jobs, and the hosted chat service | Hetzner Online GmbH | Germany | Adequacy (EU/UK hosted) | hetzner.com |
| DigitalOcean | Server hosting for server-side tag management and the consent scanner | DigitalOcean, LLC | United States (EU/UK regions available) | UK IDTA / SCCs + UK Addendum | digitalocean.com |
| Upstash | Rate limiting and short-term caching for the public consent-checker tool | Upstash, Inc. (a Delaware corporation) | United States | SCCs + UK Addendum | upstash.com |
| Railway | Application hosting for the content pipeline | Railway Corporation | United States (Netherlands/Singapore regions available) | SCCs + UK Addendum | railway.com |
| Vercel | Site hosting; also provides Vercel Analytics and Speed Insights | Vercel Inc. | United States (EU edge regions available) | UK IDTA / SCCs + UK Addendum | vercel.com |
| Cloudflare | Edge workers and CDN | Cloudflare, Inc. | Global anycast network | UK IDTA / SCCs + UK Addendum | cloudflare.com |
| Neon | Postgres database | Neon, LLC (an affiliate of Databricks, Inc.) | EU (region-configurable) | Adequacy (EU/UK hosted) | neon.com |
| Resend | Transactional email | Plus Five Five, Inc. (trading as Resend) | United States | UK IDTA / SCCs + UK Addendum | resend.com |
| Supabase | Image storage for blog hero images | NEEDS VERIFICATION | EU (region-configurable) | Adequacy (EU/UK hosted) | supabase.com |
Note on ad platforms
Google Ads, Meta, LinkedIn, Microsoft Ads, and TikTok are listed here for transparency, but in most engagements they operate as independent data controllersfor conversion measurement and advertising, not as sub-processors acting on the client's behalf. Each determines the purposes and means of its own processing under its own terms with the advertiser and the end user. The relationship is therefore typically controller-to-controller, governed by the relevant platform's Data Processing Terms, and the transfer mechanism shown above reflects that.
Note on Anthropic (Claude API)
Per Anthropic's Commercial Terms of Service, inputs and outputs submitted to the Claude API are not used to train Anthropic's models. Anthropic retains operational logs for a limited period (typically up to 30 days) for safety and abuse monitoring, then deletes them. The free audit tools send URL content and extracted text only — no customer-relationship data is sent to the Claude API.
Note on ElevenLabs (voice assistant)
The optional voice assistant on this website is powered by ElevenLabs. It is off by default: nothing connects and the microphone is never accessed until a visitor explicitly clicks to start and grants browser microphone permission. While a conversation is active, the visitor's speech is streamed to ElevenLabs to generate the assistant's responses. No account is required and the assistant does not ask for sensitive personal data. See the Privacy Policy for the lawful basis and retention.
Contact
For questions about this list, sub-processor due diligence, or to request copies of underlying transfer mechanisms or vendor DPAs:
Nathan O'Connor
Email: info@nathanoconnor.co.uk