Sub-processors
Last updated: 14 September 2025
This page lists the sub-processors Technophobia Ltd uses when acting as your processor under our Data Processing Addendum (DPA). We use providers that support strong security and data protection terms.
How we update this list
- We add providers here when they start handling client personal data for our services.
- If a change materially affects you, we will notify your project contact before or shortly after the change.
- Questions or objections: email hello@technophobia.uk.
What the columns mean
- Primary location: where the provider mainly processes data for the service.
- Transfer basis: e.g. UK Addendum/SCCs, IDTA, or UK/EU adequacy decision.
- Data handled: typical categories; actual data depends on your setup.
Core sub-processors
| Provider | Purpose | Data handled | Primary location | Transfer basis |
|---|---|---|---|---|
| UK hosting (named in your SoW) | Hosting for self-hosted components (e.g. n8n, StirlingPDF), backups, monitoring | Operational logs, workflow metadata, limited customer records as configured | United Kingdom | Domestic UK processing |
| WordPress (self-hosted) | Website CMS and contact form handling | Contact form entries, site usage data (server logs) | United Kingdom | Domestic UK processing |
| Calendly | Call booking | Name, email, booking details, notes | EU/US | UK Addendum/SCCs or adequacy (as applicable) |
| Stripe | Deposits and payments | Name, email, billing details; no full card numbers held by us | EU/US | UK Addendum/SCCs or adequacy (as applicable) |
| OpenAI API (project-specific) | Classification/drafting within client automations | Text prompts and outputs configured in your flows | EU/US | UK Addendum/SCCs or adequacy (as applicable) |
| Twilio (project-specific) | SMS/voice delivery and inbound parsing | Phone numbers, message content, delivery metadata | EU/US | UK Addendum/SCCs or adequacy (as applicable) |
| Google (Analytics 4) (consent-based) | Website analytics | Usage data and identifiers (per your consent settings) | EU/US | UK Addendum/SCCs or adequacy (as applicable) |
Not sub-processors: platforms you control directly (e.g. your own Xero, HubSpot, Pipedrive, WordPress sites) are usually integrations rather than our sub-processors. They are covered by your contracts with those providers.
Data retention and deletion
- Operational logs on self-hosted systems: typically 30–90 days unless your SoW says otherwise.
- Data in third-party tools follows those tools’ retention settings; we configure short windows where practical.
- At contract end we delete or return data from systems we control, then remove our access (see the DPA).
Contact
Questions about this list or an objection to a provider? Email hello@technophobia.uk or call +44 1229 774591.
Technophobia Ltd · Company No. 14898332 · VAT GB 495 7043 58 · 13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom.