A sub-processor is a third party that Preshift uses to help deliver its products and operate its business, where that third party may access personal data we hold. Under our Data Processing Agreement you authorise us to use the sub-processors below.
Every sub-processor is bound by a written contract that obliges them to protect your data at least to the standard we are obliged to apply ourselves under UK GDPR. The transfer-mechanism column indicates how we lawfully share data with each sub-processor when they are located outside the UK.
We will give existing customers at least thirty days' notice by email before we add a new sub-processor that materially affects the processing of your data. If you object during that period we will work with you to find an alternative; in the rare case we cannot, you may terminate the affected service.
Third parties that may access customer personal data as part of delivering Reports, Stack, or our other products.
United Kingdom (eu-west-2, London)
Purpose · Application hosting, database, file storage, backups. Primary production environment for Reports and Stack.
Data categories · Customer account data, operational data, contract data, AI commentary, alerts log
Transfer mechanism · UK hosting, no transfer
Global edge network with regional control; primary processing in EU/UK
Purpose · Frontend hosting and edge functions for preshift.co.uk and the customer-facing portals.
Data categories · Website analytics, anonymised request logs
Transfer mechanism · UK adequacy + UK IDTA where applicable
United States
Purpose · AI inference for Reports commentary and Stack contract extraction, clause risk scoring, negotiation drafting. Operated under a zero-retention, no-training contract.
Data categories · Daily Reports metrics (no personally identifiable customer data unless explicitly opted in); Stack contract content during processing only
Transfer mechanism · UK IDTA attached to the EU Standard Contractual Clauses, plus supplementary measures (no model training, zero retention)
United States
Purpose · Transactional email delivery (daily Reports digests, Stack renewal alerts, account notifications).
Data categories · Recipient name and email, email content (Reports digest, Stack alert)
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses
Ireland and United States
Purpose · Delivery of Reports digests and Stack renewal alerts to customers who opt for WhatsApp delivery.
Data categories · Recipient phone number, message content (Reports digest, Stack alert)
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses
United Kingdom and United States
Purpose · Billing, subscription management, payment processing.
Data categories · Customer billing contact, payment method, invoice history
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses for non-UK transfers
United States
Purpose · Error monitoring and performance observability for our production applications.
Data categories · Anonymised application error events, scrubbed of personally identifiable information at source
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses
Third parties that support our internal operations and may incidentally process customer contact information (for example, business emails between us and a customer).
EEA
Purpose · Internal email, calendar, document storage for the Preshift team.
Data categories · Customer business contacts, emails sent to or received from customers, supporting documents
Transfer mechanism · EU adequacy (UK)
United States
Purpose · Internal team communication.
Data categories · Customer business contacts where mentioned in internal threads
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses
United States (with EU hosting option)
Purpose · Customer relationship management for sales and customer success.
Data categories · Prospect and customer business contact details, communication history, engagement notes
Transfer mechanism · UK IDTA + EU Standard Contractual Clauses
European Economic Area
Purpose · Meeting scheduling.
Data categories · Meeting attendee name, email, scheduled times
Transfer mechanism · UK adequacy
European Economic Area
Purpose · Headless CMS for the preshift.co.uk marketing website.
Data categories · No customer personal data. Marketing site content only.
Transfer mechanism · UK adequacy
Email privacy@preshift.co.uk. To receive direct notification of sub-processor changes by email, ask us to add you to the list when you sign your Data Processing Agreement.
whenever you're ready
Half an hour on Zoom or in person. We'll show up with questions, not a slide deck.