Sub-processors

When you send us an enquiry through this website, the third-party services listed below are involved in handling it. This page exists so you know where your message goes.

If you are a client, or considering becoming one, a separate and fuller list applies to the work we do for you — it names our hosting provider and the contracted personnel who work on client engagements. That list is in your workspace at app.confluxus.co.uk/subprocessors, and we will give it to you on request before you engage us, as UK GDPR Article 28 requires.

Each provider is engaged under a written data processing agreement that imposes the same obligations we owe our own clients, including confidentiality, security measures and deletion at the end of the contract. We use as few as the service can reasonably run on.

These three handle enquiries sent through this website — nothing more. We are not required to publish the providers involved in individual client work, and we do not, because it would map out how we deliver for anyone who cared to look.

What the law requires is that our clients know. They do: the full list sits in their workspace, we give it to prospective clients on request before they sign, and we tell them before we add anyone — so there is always the chance to object, which is the general authorisation Article 28(2) provides for.

Enquiries are held in the EU, which the UK’s adequacy regulations treat as offering equivalent protection. One thing goes further: the email that replies to you is delivered by a provider in the United States, which receives your name, email address and the content of that message. That rests on the UK International Data Transfer Addendum, supported by a transfer risk assessment.

Client engagement work involves other transfers, which are set out in the client list and in our Data Processing Agreement.

If we add or replace a provider handling website enquiries we will update this page. Changes affecting client engagements are notified to clients directly before they take effect, so there is time to raise an objection. See our Privacy Policy for how we handle personal data generally.