Subprocessor Name |
Contact Information |
Categories of Processing |
Data Location |
Data Transfer Safeguards |
Security Measures / Reference |
| Amazon Web Services EMEA SARL, UK Branch | 1 Principal Place, Worship Street, London EC2A 2FA, UK aws-eu-privacy@amazon.com |
Hosting infrastructure for all personal data (students and teachers) | UK | GDPR Addendum; no transfer outside UK unless necessary | AWS GDPR DPA |
| Dropbox International Unlimited Company | One Park Place, Hatch Street, Dublin 2, Ireland dpo@dropbox.com |
Document storage (internal + setup files with student/teacher info) | Ireland, EU, UK | Transfers to Dropbox Inc. under SCCs | Dropbox DPA, Privacy Whitepaper |
| Intercom Software UK Ltd | 2nd Floor, 55 Charterhouse Street, London EC1M 6HA, UK privacy@intercom.com |
Customer support communications (names, emails, messages) | USA | SCCs / appropriate safeguards for non-UK/EEA transfers | Intercom Privacy |
| Twilio UK Ltd | 7 Soho Square, London, W1D 3QB, UK privacy@twilio.com |
SMS-based password reset (phone numbers, reset codes) | UK / Global | BCRs, EU SCCs, UK IDTA, other legal mechanisms | Twilio DPA, BCR Info |
| Xero (UK) Limited | 1 Bedford Street, London, WC2E 9HG, UK privacy@xero.com |
Subscription accounting (school contact info, emails, addresses) | UK / Global | Compliance with UK GDPR before transfer | Xero Privacy, DPA |
| Sprint Media Ltd (Campus) | 15 Elmtree Road, Tewkesbury, Gloucestershire, GL20 8DN, UK support@sprint-media.co.uk |
Marketing exclusion list for teachers (emails, subjects) | UK / Global | EU GDPR-compliant transfers | Campus DPA |
| Google LLC | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA google-privacy-office@google.com |
Google Workspace – email & docs (student and teacher data) | USA / Global | SCCs & UK GDPR compliance | Google Privacy, DPA Terms |
| Shortcut Software Company | 2045 W Grand Ave Ste B, PMB 62489, Chicago, IL 60612, USA privacy@shortcut.com |
Feature requests (teacher names, schools, positions) | USA / Global | Privacy Shield or SCCs for non-adequacy countries | Shortcut Privacy |
| Slack Technologies Limited | One Park Place, Hatch Street, Dublin 2, Ireland privacy@slack.com |
Internal communication data, activity logs for support | Ireland / Global | SCCs; data deleted after 90 days; 2FA required | Slack Privacy, DPA |
| Stripe, Inc | 354 Oyster Point Blvd, South San Francisco, CA 94080, USA privacy@stripe.com |
Payment processing (school contact info, emails) | USA | Stripe’s GDPR-compliant DPA | Stripe SSA |
| Zoom Video Communications, Inc. | 55 Almaden Blvd, San Jose, CA 95113, USA privacy@zoom.us |
Webinar/training registration (teacher info) | USA / Global | SCCs for transfers | Zoom Privacy |
| Twinkl Ltd | Wards Exchange, 197 Ecclesall Rd, Sheffield, S11 8HW, UK dataprotection@twinkl.co.uk |
Business support and enquiries (names, emails) | UK / Global | Processing agreement with SCCs | Twinkl Privacy |
| Wonde Ltd | Suite 7 Clare Hall, St Ives Business Park, Cambs PE27 4WY, UK privacy@wonde.com |
School MIS integration (student and teacher data) | UK / Global | SCCs or other GDPR-compliant mechanisms | Wonde Privacy |