Sub-processors

Last updated: 28 April 2026

A sub-processor is a third party we engage to help operate the Slatewick service that may, in doing so, process customer personal data. This page lists every current sub-processor, what they do, where they process data, and the legal mechanism for any transfers outside the United Kingdom.

1. How we use sub-processors

We engage sub-processors only where necessary for the operation, security, support, or billing of the service. Each sub-processor is bound by a written contract that imposes data-protection obligations no less protective than those in our Data Processing Agreement with you.

We remain liable to you for any sub-processor's acts and omissions to the same extent as for our own.

2. Notice of changes

We will give at least 30 days' notice before adding or replacing a sub-processor by updating this page. To receive change notifications by email, send a message with the subject "Sub-processor notifications" to privacy@slatewick.co.uk. You may object to a new sub-processor on reasonable data-protection grounds during the notice period as described in clause 8 of the DPA.

3. Current sub-processors

Infrastructure and hosting

Sub-processor	Purpose	Location of processing	Transfer mechanism
Kronaxis Limited (operator)	Application hosting, database, application logs, backups	United Kingdom	N/A — processed in the UK
RackNerd LLC	Edge web server, TLS termination, static asset delivery for the public site	United Kingdom	UK addendum to EU SCCs (controller-to-processor) where any logs leave the UK
Hetzner Online GmbH	Encrypted off-site backup storage (rclone-encrypted, content opaque to Hetzner)	Germany / Finland	UK addendum to EU SCCs; data is end-to-end encrypted before transfer

Artificial intelligence

Sub-processor	Purpose	Location of processing	Transfer mechanism
Google LLC (Gemini API)	Generative AI for document drafting, summarisation, and inspection-prep narrative	European Union (where available); United States as a fallback	UK addendum to EU SCCs; Google data-processing addendum; AI inputs and outputs not used to train Google's general-purpose models

Payments

Sub-processor	Purpose	Location of processing	Transfer mechanism
Stripe Payments Europe Ltd	Subscription billing, card-on-file management, invoice generation, VAT calculation	European Union; United Kingdom; United States	UK addendum to EU SCCs; PCI DSS Level 1 service provider

Email and SMS

Sub-processor	Purpose	Location of processing	Transfer mechanism
Postmark (ActiveCampaign LLC)	Transactional email delivery (account, billing, password reset, system notifications)	United States	UK addendum to EU SCCs
Telnyx LLC	SMS delivery for two-factor authentication and operational notifications, where a Customer enables it	United Kingdom; United States	UK addendum to EU SCCs

Operational tooling

Sub-processor	Purpose	Location of processing	Transfer mechanism
ntfy.sh (Heckel BV)	Internal operational push notifications to engineering staff (no Customer Personal Data)	European Union	UK adequacy decision

4. Sub-processors we deliberately do not use

Web analytics. No Google Analytics, Plausible, Fathom, Mixpanel, Heap, or similar.
Advertising. No Meta Pixel, Google Ads, LinkedIn Insight, TikTok Pixel, or similar.
Session replay. No Hotjar, FullStory, LogRocket, Smartlook, Microsoft Clarity, or similar.
Customer-data warehouses. No Segment, RudderStack, Hightouch, mParticle, or similar.

5. Affiliate processing

Kronaxis Limited may share Customer Personal Data with employees, contractors, and group companies acting as Slatewick personnel only to the extent necessary to provide the service, and always under written confidentiality and data-protection obligations equivalent to those in this register.

6. Contact

Sub-processor enquiries, objections, and notification opt-in: privacy@slatewick.co.uk