Data Processors

Data Processors

HIRO Analytics

Location
Hiro Analytics Inc. Dover, Delaware, USA, Email/SMS analytics & client reporting (Klaviyo data), US storage and processing. Transfers covered by SCCs + UK IDTA via Hiro's published DPA.
Processing activities
Analytics and retention marketing services

Anthropic

Location
Anthropic PBC, San Francisco, USA, AI/LLM processing, US (storage), with processing potentially in EU/APAC. Transfers covered by SCCs + UK IDTA.
Processing activities
Processing (including collection, storage, organization and structuring) of summarised data as part of a natural language-based, machine-learning tool. Used for analytics assessment and reporting activities.

OpenAI

Location OpenAI OpCo, LLC, San Francisco, USA, AI/LLM processing, US (storage by default), with optional regional data residency available in the UK, EU and APAC for eligible business/API customers. Transfers covered by SCCs + UK IDTA.
Processing activities Processing (including collection, storage, organization and structuring) of summarised data as part of a natural language-based, machine-learning tool. Used for analytics assessment and reporting activities.

Microsoft 365 / SharePoint

Location Microsoft Ireland Operations Limited (contracting entity for UK/EEA) — Dublin, Ireland (parent: Microsoft Corporation, Redmond, USA) — Cloud productivity, collaboration, document storage and email services (Microsoft 365, SharePoint Online, OneDrive, Exchange Online, Teams) — Core customer data (Exchange mailbox content, SharePoint site content, OneDrive files) stored in the EU/UK under Microsoft's EU Data Boundary commitments; some processing and sub-processor activity may occur in the US and other regions. Transfers covered by EU SCCs (Module 2) + UK Addendum + EU-US Data Privacy Framework.

Processing activities Processing (including collection, storage, organisation and structuring) of business communications, documents, calendar entries, user identity data and collaboration content as part of cloud-based productivity and collaboration services. Used for day-to-day business operations, internal communication, document storage and team collaboration.

Google Analytics

Location Google Ireland Limited (contracting entity for UK/EEA under the Google Analytics Terms of Service) — Dublin, Ireland (parent: Google LLC, Mountain View, USA) — Website and mobile app analytics — Data stored and processed across Google's globally distributed data centre network, including the US. Transfers covered by EU SCCs (Model Contract Clauses, processor module, incorporated via the Google Ads Data Processing Terms) + UK Addendum + EU-US Data Privacy Framework.

Processing activities Processing (including collection, storage, organisation and structuring) of website and app interaction data — including online identifiers (cookie IDs, IP addresses, device identifiers), pageview, event and session data — for the purpose of generating audience, acquisition and behaviour reports. Used for analytics assessment, conversion tracking and marketing performance reporting.

Meta

Location Meta Platforms, Inc. (UK Controllers) — 1 Meta Way, Menlo Park, CA 94025, USA / Meta Platforms Ireland Limited (EEA Controllers) — Merrion Road, Dublin 4, D04 X2K5, Ireland — Web and app conversion tracking, audience building and personalised advertising (Meta Pixel, Conversions API, Custom Audiences, Lead Ads) — Data stored and processed across Meta's globally distributed data centre network, primarily in the US; no meaningful EU data residency option for tracking/ad products. Transfers covered by EU SCCs (Module 2) + UK Addendum + EU-US Data Privacy Framework.

Processing activities Processing (including collection, storage, organization and structuring) of hashed identifiers, IP addresses, device and browser data, and website/app event and conversion data for the purpose of measuring conversion performance, building advertising audiences and serving personalised advertising via Meta's ad platform.

WhatsApp Business

Location WhatsApp LLC (UK Controllers) — 1 Meta Way, Menlo Park, CA 94025, USA / WhatsApp Ireland Limited (EEA Controllers) — Merrion Road, Dublin 4, D04 X2K5, Ireland — Business-to-consumer messaging via the WhatsApp Business Solution and Cloud API — Data stored and processed across Meta's globally distributed data centre network, primarily in the US. Transfers covered by EU SCCs (Module 2 controller → processor; Module 3 for onward sub-processor transfers) + UK Addendum + EU-US Data Privacy Framework.

Processing activities Processing (including collection, storage, organization and structuring) of customer contact data (phone numbers, WhatsApp profile information), message content and metadata for the purpose of facilitating business-to-consumer messaging between Controllers and their customers on the WhatsApp network.

Klaviyo

Location Klaviyo, Inc. — Boston, Massachusetts, USA (Delaware-incorporated, NYSE: KVYO) — Email, SMS, mobile push and customer engagement marketing platform for D2C eCommerce — Data stored in the United States; access by Klaviyo employees in the United States, Ireland, the United Kingdom, Australia and Singapore for support and service operations. Transfers covered by EU SCCs (Module 2) + UK Addendum + EU-US Data Privacy Framework (with UK Extension and Swiss-US DPF certifications).

Processing activities Processing (including collection, storage, organization and structuring) of subscriber and customer profile data — including identity and contact data (name, email address, phone number, postal address), purchase and order history, on-site browsing and engagement events, segmentation attributes, and marketing consent and preference data — for the purposes of email, SMS and mobile push marketing campaign delivery, lifecycle automation, segmentation, personalisation, deliverability monitoring and reporting.our text here...