Subprocessor List

What a subprocessor is

A subprocessor is a supplier that processes personal information to help Affordit provide a service. Suppliers may support areas such as hosting, authentication, communications, payments, analytics, monitoring or approved automated explanations.

Not every supplier is a subprocessor for every journey. The final register will reflect the live processing arrangement and applicable contracts.

Register status

The material supplier inventory, processing locations and transfer safeguards are still being confirmed. No provider is presented here as an approved subprocessor entry until the product and data inventory has been validated.

This caution prevents a draft category list from being mistaken for a complete legal register.

What the approved register will show

• Provider and service purpose
• Data categories involved
• Hosting or processing location
• Applicable transfer safeguard
• Date added and current status
• Relevant contractual or transfer mechanism
• How users or institutions are notified of a material change

Service categories under review

Categories include hosting and database services, authentication, payments, email, analytics, monitoring and approved automated-system providers. This list describes functions, not confirmed legal entities.

How suppliers are reviewed

Material suppliers should be assessed for security, privacy, resilience, data location, further subprocessors, breach terms, deletion, AI training, certifications and exit risk.

Contracts should include appropriate confidentiality, security and data-protection terms. A supplier is not treated as approved merely because its service has been technically integrated.

International processing

Where personal information is stored outside the UK or can be accessed remotely from another country, the register should identify the location and applicable UK transfer safeguard. The underlying transfer assessment is restricted and is not published in full.

Changes to the register

The approved register should be reviewed when a supplier, processing purpose, data category or location changes. Institutions and users will be notified where law or contract requires it.