Sub-processors

Last updated: 14 September 2025

This page lists the sub-processors Technophobia Ltd uses when acting as your processor under our Data Processing Addendum (DPA). We use providers that support strong security and data protection terms.

We add providers here when they start handling client personal data for our services.
If a change materially affects you, we will notify your project contact before or shortly after the change.
Questions or objections: email hello@technophobia.uk.

Primary location: where the provider mainly processes data for the service.
Transfer basis: e.g. UK Addendum/SCCs, IDTA, or UK/EU adequacy decision.
Data handled: typical categories; actual data depends on your setup.

Provider	Purpose	Data handled	Primary location	Transfer basis
UK hosting (named in your SoW)	Hosting for self-hosted components (e.g. n8n, StirlingPDF), backups, monitoring	Operational logs, workflow metadata, limited customer records as configured	United Kingdom	Domestic UK processing
WordPress (self-hosted)	Website CMS and contact form handling	Contact form entries, site usage data (server logs)	United Kingdom	Domestic UK processing
Calendly	Call booking	Name, email, booking details, notes	EU/US	UK Addendum/SCCs or adequacy (as applicable)
Stripe	Deposits and payments	Name, email, billing details; no full card numbers held by us	EU/US	UK Addendum/SCCs or adequacy (as applicable)
OpenAI API (project-specific)	Classification/drafting within client automations	Text prompts and outputs configured in your flows	EU/US	UK Addendum/SCCs or adequacy (as applicable)
Twilio (project-specific)	SMS/voice delivery and inbound parsing	Phone numbers, message content, delivery metadata	EU/US	UK Addendum/SCCs or adequacy (as applicable)
Google (Analytics 4) (consent-based)	Website analytics	Usage data and identifiers (per your consent settings)	EU/US	UK Addendum/SCCs or adequacy (as applicable)

Not sub-processors: platforms you control directly (e.g. your own Xero, HubSpot, Pipedrive, WordPress sites) are usually integrations rather than our sub-processors. They are covered by your contracts with those providers.

Operational logs on self-hosted systems: typically 30–90 days unless your SoW says otherwise.
Data in third-party tools follows those tools’ retention settings; we configure short windows where practical.
At contract end we delete or return data from systems we control, then remove our access (see the DPA).

Questions about this list or an objection to a provider? Email hello@technophobia.uk or call +44 1229 774591.

Technophobia Ltd · Company No. 14898332 · VAT GB 495 7043 58 · 13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom.