Last updated: 1 November 2026 · Version 1.0
When we deliver services to you, we sometimes rely on third parties who process personal data
on our behalf. Under UK data protection law these are called subprocessors, and we are
required to tell you who they are.
This page lists every subprocessor we currently engage. It is the authoritative version — the
list attached to your Data Processing Agreement reflects the position when that agreement was
signed, and this page reflects the position today.
Which of these apply to you depends on which services you buy from us. A customer who takes
only broadband will have very few; a customer taking Microsoft 365, hosting, backup and
support will have most of them.
How we tell you about changes
We give 30 days’ notice before engaging a new subprocessor or replacing an existing one.
We do this by updating this page and emailing the data protection contact you have given us.
If you want to receive these notifications, send us the contact address at
dataprotection@pc-q.co.uk and we will add it to our notification list.
If you object to a new subprocessor on reasonable data protection grounds, tell us within the
notice period and we will work with you to find a resolution. Where we cannot, you may
terminate the affected service without penalty.
Occasionally we may need to engage a subprocessor at shorter notice to preserve the security
or continuity of a service. If that happens we will tell you as soon as we can and explain
why.
Productivity and communications
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd | Microsoft 365 — email, files, identity and collaboration services | Ireland | United Kingdom | Covered by UK adequacy |
| Giacom / Cloud Market Ltd | Supplies and provisions our Microsoft 365 licences | United Kingdom | United Kingdom | Not applicable — UK |
| Swiftnet Ltd (trading as SCG) | Hosted telephony and VoIP; legacy telephony and broadband | United Kingdom | United Kingdom | Not applicable — UK |
Hosting and infrastructure
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| HostPresto | Provides and maintains the physical servers our hosting platform runs on | United Kingdom | United Kingdom | Not applicable — UK |
| WebPros International GmbH (Plesk) | Hosting control panel software running on our servers | Switzerland | United Kingdom — runs on our UK infrastructure | Covered by UK adequacy |
| Cloudflare, Inc. | DNS, content delivery and web application firewall for customer domains | United States | Global edge network | International Data Transfer Addendum |
Backup and continuity
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Acronis International GmbH | Backup of Microsoft 365 data and hosted server data | Switzerland | United Kingdom (London) | Covered by UK adequacy |
Acronis engage their own subprocessors, including for geographic redundancy and technical
support. Their current list is published at
https://www.acronis.com/en-us/support/sub-processors/.
Security
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Bitdefender | Endpoint protection software on managed devices | Romania | EU | Covered by UK adequacy |
| CloudLinux Inc. (Imunify360) | Web application firewall, malware scanning and intrusion prevention on our hosting platform | United States | Confirming | Confirming |
| CyberSmart Ltd | Endpoint compliance monitoring and Cyber Essentials certification support | United Kingdom | United Kingdom | Not applicable — UK |
| KnowBe4, Inc. | Security awareness training and simulated phishing | United States | Confirming | International Data Transfer Addendum |
| Keeper Security, Inc. | Password management supplied to customers. Keeper operate a zero-knowledge architecture, which means vault contents are encrypted so that Keeper cannot read them. Administrative recovery features, where an organisation chooses to enable them, can allow recovery of a user’s vault — we will tell you what is configured for your organisation on request | United States | Confirming | International Data Transfer Addendum |
| AgileBits Inc. (1Password) | Password management used internally by PCQ, holding credentials for customer systems. Zero-knowledge architecture, which means 1Password cannot read vault contents | Canada Confirming | European Union | Covered by UK adequacy (Canada, PIPEDA) Confirming |
Service management
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Syncro (Servably, Inc.) | Our service desk and remote monitoring and management platform. Holds support requests, your contact details and device inventory. The management agent on devices on our care plans also provides remote access, patch deployment and the ability to run scripts, so during support work a technician can see and control the device | United States | United States | International Data Transfer Addendum |
| ISL Online (XLAB d.o.o.) | Remote access used to deliver support. During a session the technician can see and control the device, so anything displayed on it may be visible | Slovenia Confirming | European Union Confirming | Covered by UK adequacy (EU) Confirming |
| Anthropic PBC | AI assistance in service delivery and automation — see below | United States | United States | International Data Transfer Addendum |
Connectivity
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Zen Internet Ltd | Broadband and connectivity; hosted telephony and VoIP | United Kingdom | United Kingdom | Not applicable — UK |
| EE Ltd | Mobile data services | United Kingdom | United Kingdom | Not applicable — UK |
| Unity World Ltd | Provisions, bills and supports the O2 mobile SIMs and tariffs we supply. Holds the customer and connection details needed to do so | United Kingdom | United Kingdom | Not applicable — UK |
| Telefónica UK Ltd (O2) | Operates the mobile network carrying those services | United Kingdom | United Kingdom | Not applicable — UK |
A note on how carriers sit. The suppliers in this section have two roles at once. They act
as our subprocessors for the customer and order details we pass to them to provision and support
a service. They also act as controllers in their own right for the records their networks
generate, because they hold those to run and bill for the service and to meet obligations placed
on them as communications providers. We have listed them here for completeness, but where they
act as controllers our Data Processing Agreement does not govern what they do.
Where we supply a telephony, mobile or broadband service, the carrier delivering it necessarily
holds records of the service’s use — for telephony and mobile, that includes the numbers called,
the time and the duration. Carriers hold this data to provide and bill for the service and to
meet their own legal obligations as communications providers, and in doing so they act in their
own right rather than only on our instructions. We see this data where we need it to bill you
or investigate a fault.
Our use of AI
We think customers should be told plainly when AI is part of how a service is delivered, so
here is our position.
We use Anthropic’s Claude to help us run our service desk, analyse our systems, produce
reports and automate routine work. It genuinely improves what a small team can deliver, and we
would rather describe it openly than leave it for someone to discover in a questionnaire.
What it can access:
- Our service desk system, which holds your contact details, the content of support requests
and your device inventory - Our accounting system, which holds your billing contact details and invoice history. We
hold those records as a business in our own right rather than on your behalf — see
“Not subprocessors” below - Our hosting control panel and server management tools — configuration, domain and site
settings, server logs - Our DNS management
- PCQ’s own Microsoft 365 tenant — our own mail and files
What it cannot access:
- Your Microsoft 365 tenant
- Your mailboxes, files or documents
- Password vault contents
- Your backups
One thing we will not overstate. Hosting control panel access carries with it the technical
ability to reach the databases behind hosted sites. We do not use AI assistance for that and do
not direct it there, but the restriction is one of practice rather than something the access
level makes impossible, and we would rather say so than claim a boundary that is not really
there.
One distinction worth drawing out. Our service desk platform can, in a technician’s hands,
open a remote session to a managed device or run a script on it. The AI assistant cannot. It
is able to read and update records — tickets, assets, contacts, invoices — and it has no ability
to start a remote session, take control of a device, or execute anything on your machines. A
person does that, and a person remains accountable for it.
Training. Personal data processed this way is not used to train Anthropic’s models. We
have model training disabled on the account used to deliver our services.
Human oversight. Changes to your systems are made or approved by a person. We do not let
automated tooling make unsupervised changes to customer environments.
If you would prefer we did not use AI assistance in delivering your services, tell us and we
will discuss what that means for the services you take.
Not subprocessors
For completeness, these are suppliers we use to run our own business rather than to process
your data on your behalf. They appear in our Privacy Notice instead.
- Xero — our accounting system
- Our bank and payment providers — collecting payments due to us
- Our professional advisers — accountants, insurers and similar
Questions
If you have a question about anything on this page, or you need information for your own
subprocessor register or supplier assurance process, contact us at
dataprotection@pc-q.co.uk and we will answer it.
Previous versions
| Version | Date | Change |
|---|---|---|
| 1.0 | 1 November 2026 | First published |